Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. Also, Slashdot's Facebook page has a chat bot now. Message it for stories and more. ×
Bug

Severe IE 11 Bug Allows 'Persistent JavaScript' Attacks (bleepingcomputer.com) 46

An anonymous reader writes: New research published today shows how a malicious website owner could show a constant stream of popups, even after the user has left his site, or even worse, execute any kind of persistent JavaScript code while the user is on other domains. In an interview, the researcher who found these flaws explains that this flaw is an attacker's dream, as it could be used for: ad fraud (by continuing to load ads even when the user is navigating other sites), zero-day attacks (by downloading exploit code even after the user has left the page), tech support scams (by showing errors and popups on legitimate and reputable sites), and malvertising (by redirecting users later on, from other sites, even if they leave the malicious site too quickly).

This severe flaw in the browser security model affects only Internet Explorer 11, which unfortunately is the second most used browser version, after Chrome 55, with a market share of over 10%. Even worse for IE11 users, there's no fix available for this issue because the researcher has decided to stop reporting bugs to Microsoft after they've ignored many of his previous reports. For IE11 users, a demo page is available here.

Government

FCC To Halt Rule That Protects Your Private Data From Security Breaches (arstechnica.com) 109

According to Ars Technica, "The Federal Communications Commission plans to halt implementation of a privacy rule that requires ISPs to protect the security of its customers' personal information." From the report: The data security rule is part of a broader privacy rulemaking implemented under former Chairman Tom Wheeler but opposed by the FCC's new Republican majority. The privacy order's data security obligations are scheduled to take effect on March 2, but Chairman Ajit Pai wants to prevent that from happening. The data security rule requires ISPs and phone companies to take "reasonable" steps to protect customers' information -- such as Social Security numbers, financial and health information, and Web browsing data -- from theft and data breaches. The rule would be blocked even if a majority of commissioners supported keeping them in place, because the FCC's Wireline Competition Bureau can make the decision on its own. That "full commission vote on the pending petitions" could wipe out the entire privacy rulemaking, not just the data security section, in response to petitions filed by trade groups representing ISPs. That vote has not yet been scheduled. The most well-known portion of the privacy order requires ISPs to get opt-in consent from consumers before sharing Web browsing data and other private information with advertisers and other third parties. The opt-in rule is supposed to take effect December 4, 2017, unless the FCC or Congress eliminates it before then. Pai has said that ISPs shouldn't face stricter rules than online providers like Google and Facebook, which are regulated separately by the Federal Trade Commission. Pai wants a "technology-neutral privacy framework for the online world" based on the FTC's standards. According to today's FCC statement, the data security rule "is not consistent with the FTC's privacy standards."
Government

Security Lapse Exposed New York Airport's Critical Servers For a Year (zdnet.com) 42

An anonymous reader quotes a report from ZDNet: A security lapse at a New York international airport left its server backups exposed on the open internet for almost a year, ZDNet has found. The internet-connected storage drive contained several backup images of servers used by Stewart International Airport, but neither the backup drive nor the disk images were password protected, allowing anyone to access their contents. Since April last year, the airport had been inadvertently leaking its own highly-sensitive files as a result of the drive's misconfiguration. Vickery, who also posted an analysis of his findings, said the drive "was, in essence, acting as a public web server" because the airport was backing up unprotected copies of its systems to a Buffalo-branded drive, installed by a contract third-party IT specialist. When contacted Thursday, the contractor dismissed the claims and would not comment further. Though the listing still appears on Shodan, the search engine for unprotected devices and databases, the drive has since been secured. The files contained eleven disk images, accounting for hundreds of gigabytes of files and folders, which when mounted included dozens of airport staff email accounts, sensitive human resources files, interoffice memos, payroll data, and what appears to be a large financial tracking database. Many of the files we reviewed include "confidential" internal airport documents, which contain schematics and details of other core infrastructure.
Bug

Cloudflare Leaks Sensitive User Data Across the Web (theregister.co.uk) 81

ShaunC writes: In a bug that's been christened "Cloudbleed," Cloudflare disclosed today that some of their products accidentally exposed private user information from a number of websites. Similar to 2014's Heartbleed, Cloudflare's problem involved a buffer overrun that allowed uninitialized memory contents to leak into normal web traffic. Tavis Ormandy, of Google's Project Zero, discovered the flaw last week. Affected sites include Uber, Fitbit, and OK Cupid, as well as unnamed services for hotel booking and password management. Cloudflare says the bug has been fixed, and Google has purged affected pages from its search index and cache. Further reading: The Register, Ars Technica
Wikipedia

Study Reveals Bot-On-Bot Editing Wars Raging On Wikipedia's Pages (theguardian.com) 96

An anonymous reader quotes a report from The Guardian: A new study from computer scientists has found that the online encyclopedia is a battleground where silent wars have raged for years. Since Wikipedia launched in 2001, its millions of articles have been ranged over by software robots, or simply "bots," that are built to mend errors, add links to other pages, and perform other basic housekeeping tasks. In the early days, the bots were so rare they worked in isolation. But over time, the number deployed on the encyclopedia exploded with unexpected consequences. The more the bots came into contact with one another, the more they became locked in combat, undoing each other's edits and changing the links they had added to other pages. Some conflicts only ended when one or other bot was taken out of action. The findings emerged from a study that looked at bot-on-bot conflict in the first ten years of Wikipedia's existence. The researchers at Oxford and the Alan Turing Institute in London examined the editing histories of pages in 13 different language editions and recorded when bots undid other bots' changes. While some conflicts mirrored those found in society, such as the best names to use for contested territories, others were more intriguing. Describing their research in a paper entitled Even Good Bots Fight in the journal Plos One, the scientists reveal that among the most contested articles were pages on former president of Pakistan Pervez Musharraf, the Arabic language, Niels Bohr and Arnold Schwarzenegger. One of the most intense battles played out between Xqbot and Darknessbot which fought over 3,629 different articles between 2009 and 2010. Over the period, Xqbot undid more than 2,000 edits made by Darknessbot, with Darknessbot retaliating by undoing more than 1,700 of Xqbot's changes. The two clashed over pages on all sorts of topics, from Alexander of Greece and Banqiao district in Taiwan to Aston Villa football club.
Businesses

Website Builder Wix Acquires Art Community DeviantArt For $36 Million (techcrunch.com) 62

An anonymous reader quotes a report from TechCrunch: Wix.com has made another acquisition to build out the tools that it provides to users to build and administer websites: it has acquired DeviantArt, an online community for artists, designers and art/design enthusiasts with some 325 million individual pieces of original art and more than 40 million registered members, for $36 million in cash, including $3 million of assumed liabilities. Wix said that it will continue to operate DeviantArt as a standalone site, but it will also use it to boost its own business in a couple of ways. First, DeviantArt users will get access to Wix's web design tools to build out more dynamic online presences. These tools do not only cover design, but commerce and other features for running businesses online. Second, Wix will open up DeviantArt's repository of art and creative community to the Wix platform, giving Wix's users access to that work to use in their own site building. The deal will also include putting further investment into developing DeviantArt's desktop and mobile apps. (Today, that desktop experience is based on a very simple, pared-down interface that is reminiscent of the 2000 birthdate of the startup itself.)
Communications

FCC Votes To Lift Net Neutrality Transparency Rules For Smaller Internet Providers (theverge.com) 114

The Federal Communications Commission today voted to lift transparency requirements for smaller internet providers. According to The Verge, "Internet providers with fewer than 250,000 subscribers will not be required to disclose information on network performance, fees, and data caps, thanks to this rule change. The commission had initially exempted internet providers with fewer than 100,000 subscribers with the intention of revisiting the issue later to determine whether a higher or lower figure was appropriate." From the report: The rule passed in a 2-1 vote, with Republicans saying the reporting requirements unfairly burdened smaller ISPs with additional work. Only Democratic commissioner Mignon Clyburn opposed. Clyburn argued that the disclosures were an important consumer protection that was far from overbearing on businesses, particularly ones this large. Clyburn also argued that the rule would allow larger internet providers to avoid disclosing information by simply breaking their service areas up into different subsidiaries. Republican commissioner Michael O'Rielly voted in favor of the change, saying he actually would have preferred the subscriber exemption to be even higher. And commission chairman Ajit Pai said the rules were necessary to protect "mom and pop internet service providers" from "burdensome requirements [...] that impose serious and unnecessary costs."
Google

Google Releases an AI Tool For Publishers To Spot and Weed Out Toxic Comments (bbc.com) 191

Google today launched a new technology to help news organizations and online platforms identify and swiftly remove abusive comments on their websites. The technology, called Perspective, will review comments and score them based on how similar they are to comments people said were "toxic" or likely to make them leave a conversation. From a report on BBC: The search giant has developed something called Perspective, which it describes as a technology that uses machine learning to identify problematic comments. The software has been developed by Jigsaw, a division of Google with a mission to tackle online security dangers such as extremism and cyberbullying. The system learns by seeing how thousands of online conversations have been moderated and then scores new comments by assessing how "toxic" they are and whether similar language had led other people to leave conversations. What it's doing is trying to improve the quality of debate and make sure people aren't put off from joining in.
The Courts

Judge Blocks California Law Limiting Publication of Actor's Ages (politico.com) 123

mi writes: IMDb has a reason to rejoice. Politico reports: "A federal judge has barred the State of California from enforcing a new law limiting online publication of actors' ages. Acting in a case brought by online movie information website IMDb, U.S. District Court Judge Vince Chhabria ruled Wednesday that the California law likely violates the First Amendment and appears poorly tailored to proponents' stated goal of preventing age discrimination in Hollywood. The judge expressed deep skepticism that the law, which he said appeared to apply only to IMDb, would have any effect on discrimination. The judge rejected the state's arguments that the law was a regulation of commercial speech, finding that IMDb was acting as a publisher in posting the birthday and age information online." "It's not clear how preventing one mere website from publishing age information could meaningfully combat discrimination at all. And even if restricting publication on this one website could confer some marginal anti-discrimination benefit, there are likely more direct, more effective, and less speech-restrictive ways of achieving the same end," Chhabria wrote in a three-page order.
Power

Disney Develops Room With 'Ubiquitous Wireless' Charging (cnet.com) 109

An anonymous reader quotes a report from CNET: The scientific and tech arm of the entertainment giant Disney has built a prototype room with "ubiquitous wireless power delivery" that allows several devices to be charged wirelessly in much the way we get internet access through Wi-Fi. By tapping quasistatic cavity resonance, researchers discovered they could generate magnetic fields inside specially built structures to deliver kilowatts of power to mobile devices inside that structure. "This new innovative method will make it possible for electrical power to become as ubiquitous as WiFi," Alanson Sample, associate lab director and principal research scientist at Disney Research, told Phys.org. "This in turn could enable new applications for robots and other small mobile devices by eliminating the need to replace batteries and wires for charging." All you have to do is be in the room and your device will start charging automatically. And depending on where you are in the room, delivery efficiency can be as high as 95 percent, researchers said. There is one potential issue: you have to not mind being in a room constructed mostly of aluminum, that includes the walls, ceiling and floor. There's a copper pole in the middle of the room, and 15 discrete high quality factor capacitors that separate the magnetic field from the electric field.
Privacy

GE, Intel, and AT&T Are Putting Cameras and Sensors All Over San Diego (fortune.com) 124

An anonymous reader shares a Fortune report: General Electric will put cameras, microphones, and sensors on 3,200 street lights in San Diego this year, marking the first large-scale use of "smart city" tools GE says can help monitor traffic and pinpoint crime, but raising potential privacy concerns. Based on technology from GE's Current division, Intel and AT&T, the system will use sensing nodes on light poles to locate gunshots, estimate crowd sizes, check vehicle speeds and other tasks, GE and the city said on Wednesday. The city will provide the data to entrepreneurs and students to develop applications. Companies expect a growing market for such systems as cities seek better data to plan and run their operations. San Diego is a test of "Internet of things" technology that GE Current provides for commercial buildings and industrial sites.
Transportation

College Senior Turns His Honda Civic Into a Self-Driving Car Using Free Hardware, Software (technologyreview.com) 131

holy_calamity writes: University of Nebraska student Brevan Jorgenson swapped the rear-view mirror in his 2016 Honda Civic for a home-built device called a Neo, which can steer the vehicle and follow traffic on the highway. Jorgenson used hardware designs and open-source software released by Comma, a self-driving car startup that decided to give away its technology for free last year after receiving a letter asking questions about its functionality from the National Highway Traffic Safety Administration (NHTSA). Jorgenson is just one person in a new hacker community trying to upgrade their cars using Comma's technology. "A Neo is built from a OnePlus 3 smartphone equipped with Comma's now-free Openpilot software, a circuit board that connects the device to the car's electronics, and a 3-D-printed case," reports MIT Technology Review. The report notes that Neodriven, a startup based in Los Angeles, has recently started selling a pre-built Neo device that works with Comma's Openpilot software, but it costs $1,495.
Censorship

'We Won't Block Pirate Bay,' Swedish Telecoms Giant Says (torrentfreak.com) 27

Last week, a Swedish Patent and Market Court of Appeal ordered The Pirate Bay and streaming portal Swefilmer to be blocked by internet service provider Bredbandsbolaget for the next three years. The order was not well supported by other internet service providers in Sweden, as it appears they don't like the idea of becoming copyright policemen. TorrentFreak reports: Last week ISP Bahnhof absolutely slammed the decision to block The Pirate Bay, describing the effort as signaling the "death throes" of the copyright industry. It even hinted that it may offer some kind of technical solution to customers who are prevented from accessing the site. For those familiar with Bahnhof's stance over the years, this response didn't come as a surprise. The ISP is traditionally pro-freedom and has gone out of its way to make life difficult for copyright enforcers of all kinds. However, as one of the leading telecoms companies in Sweden and neighboring Norway, ISP Telia is more moderate. Nevertheless, it too says it has no intention of blocking The Pirate Bay, unless it is forced to do so by law. "No, we will not block if we are not forced to do so by a court," a company press officer said this morning. Telia says that the decision last week from the Patent and Market Court affects only Bredbandsbolaget, indicating that a fresh legal process will be required to get it to respond. That eventuality appears to be understood by the rightsholders but they're keeping their options open.
Government

Wyden To Introduce Bill To Prohibit Warrantless Phone Searches At Border (onthewire.io) 193

Trailrunner7 quotes a report from On the Wire: A senator from Oregon who has a long track record of involvement on security and privacy issues says he plans to introduce a bill soon that would prevent border agents from forcing Americans returning to the country to unlock their phones without a warrant. Sen. Ron Wyden said in a letter to the secretary of the Department of Homeland Security that he is concerned about reports that Customs and Border Patrol agents are pressuring returning Americans into handing over their phone PINs or using their fingerprints to unlock their phones. DHS Secretary John Kelly has said that he's considering the idea of asking visitors for the login data for their various social media accounts, information that typically would require a warrant to obtain. "Circumventing the normal protection for such private information is simply unacceptable," Wyden said in the letter, sent Monday. "There are well-established procedures governing how law enforcement agencies may obtain data from social media companies and email providers. The process typically requires that the government obtain a search warrant or other court order, and then ask the service provider to turn over the user's data."
Intel

Intel Supercharges Atom Chips With 16 Cores and Pro Level Features (pcworld.com) 77

Agam Shah, writing for PCWorld: Intel's Atom was mostly known as a low-end chip for mobile devices that underperformed. That may not be the case anymore. The latest Atom C3000 chips announced on Tuesday have up to 16 cores and are more sophisticated than ever. The chips are made for storage arrays, networking equipment, and internet of things devices. The new chips have features found mostly in server chips, including networking, virtualization, and error correction features. [...] A surprising feature in C3000 is RAS (reliability, availability, and serviceability) capabilities, which is mostly found on high-end Xeon chips. The feature corrects data errors on the fly and prevents networking and storage equipment from crashing.
Security

Netflix Just Announced a User Focused Security Application (netflix.com) 43

Moving beyond movies and TV shows (and their DVDs), Netflix announced on Tuesday Stethoscope, its "first project following a User Focused Security approach." From a company's blog post: The notion of "User Focused Security" acknowledges that attacks against corporate users (e.g., phishing, malware) are the primary mechanism leading to security incidents and data breaches, and it's one of the core principles driving our approach to corporate information security. [...] Stethoscope is a web application that collects information for a given user's devices and gives them clear and specific recommendations for securing their systems. If we provide employees with focused, actionable information and low-friction tools, we believe they can get their devices into a more secure state without heavy-handed policy enforcement. The company says Stethoscope tracks disk encryption, firewall, automatic updates, up-to-date OS/software, screen lock, jailbroken/rooted status, security software stack configurations of the device.
Privacy

GlobalSign Supports Billions of Device Identities In an Effort To Secure the IoT (globalsign.com) 27

Reader broknstrngz writes: GlobalSign, a WebTrust certified CA and identity services provider, has released its high volume managed PKI platform, taking a stab at the current authentication and security weaknesses in the IoT. The new service aims to commodify large scale rapid enrollment and identity management for large federated swarms of devices such as IP cameras, smart home appliances and consumer electronics, core and customer premises network equipment in an attempt to reduce the attack surface exploitable by IoT DDoS botnets such as Mirai.

Strong device identity models are developed in partnership with TPM and hardware cryptographic providers such as Infineon and Intrinsic ID, as well as other Trusted Computing Group members.

China

China's Millennials Are Hustling For Part-Time Gigs Instead of Traditional Jobs (bloomberg.com) 147

Bloomberg has a report today in which it underscores a growing trend among millennials in China who are looking for part-time jobs. From the article: Hopping from one short-term stint to another isn't the sort of aspiration an earlier generation had in China, where the middle-class dream has long been university degrees followed by a stable job -- preferably one backed by the government. In a 2016 poll of 13,000 college students, 48 percent said they didn't want to enter the traditional labor market. Hardly any of these part-time jobs pay well, but it doesn't matter to millennials. The report adds: "The money is little," Zhang Chen, a 21-year-old accounting student said of the short gig that pays about 240 yuan ($35). "But I want a more interesting life." Chen was lined up for the work through DouMi, a startup that focuses exclusively on part-time positions and blends elements of a temp agency with an internet jobs board and marketing service. For around 130 yuan a day, DouMi users can sort crates of milk at a supermarket or hand out pamphlets on frozen sidewalks. Those considered "beautiful women," and between the ages of 18 and 28, can make four times as much plus tips by working as live-streaming models to keep mostly-male viewers entertained. Many of the roles run for mere days or weeks at a time, a flexibility that suits those juggling social lives and university studies. "Every month we have between 300,000 and 400,000 jobs," said Chief Executive Officer Zhao Shiyong.
The Internet

How is The New York Times Really Doing? (om.co) 407

Wired magazine did a profile on The New York Times in its this month's issue. Talking about the paper's transition from print to more digital-focus than ever, author Gabriel Snyder wrote, "It's to transform the Times' digital subscriptions into the main engine of a billion-dollar business, one that could pay to put reporters on the ground in 174 countries even if (OK, when) the printing presses stop forever." Veteran journalist Om Malik analyzes the numbers: -> The company reported revenue of nearly $1.6 billion in 2016 -- remarkably consistent with prior years.
-> Print advertising revenue dipped by $70 million year-over-year to $327 million in 2016.
-> Digital advertising revenue, while a meaningful portion of the Times' revenue, did not grow enough to offset vanishing print ad dollars.
-> Total digital ad revenue in 2016 was $206 million, up only 6% from the prior year.
-> The key revenue driver for the New York Times has been its digital subscription business, which added more than half a million paid subscribers in 2016. Thanks in part to interest around the presidential election, the newspaper added 276,000 new digital subscribers in Q4, the single largest quarterly increase since 2011 (the year the pay model was launched).

The Times' digital success is hinged upon two major drivers: affiliate revenues from services like the Wirecutter and digital subscriptions. Advertising might be a good short term bandaid, but the company needs to focus on how to evolve away from it even more aggressively. The Times needs to simplify their sign-up experience and make it easier for people to pay for the subscriptions. As of now, it is like the sound you hear when scratching your nails on a piece of glass.

Businesses

The Death of the Click (axios.com) 129

Sara Fischer, writing for Axios: For the past 10 years, we've operated on the premise that the most important digital metric is the click that refers a person to a website. That click usually comes from a social distribution channel, like Facebook or Twitter, or a search engine, like Google or Bing. But according to industry experts, the click referral is becoming an idea of the past, soon to be replaced by content exposure. [...] Most publishers have designed their websites to measure user interaction through clicks, not scroll rates or time spent on stories. As the industry moves away from click-through rates (CTR's) as the most meaningful marketing metric, those publishers will have a difficult time justifying the effectiveness of their platforms for marketers.

Slashdot Top Deals