An anonymous reader quotes Reuters: Blacklisted Chinese telecoms equipment giant Huawei is in early-stage talks with some U.S. telecoms companies about licensing its 5G network technology to them, a Huawei executive told Reuters on Friday. Vincent Pang, senior vice president and board director at the company said some firms had expressed interest in both a long-term deal or a one-off transfer, declining to name or quantify the companies.

"There are some companies talking to us, but it would take a long journey to really finalize everything," Pang explained on a visit to Washington this week. "They have shown interest," he added, saying conversations are only a couple of weeks old and not at a detailed level yet.

Long-time Slashdot reader Kekke shared this article from Ars Technica: A potentially serious vulnerability in Linux may make it possible for nearby devices to use Wi-Fi signals to crash or fully compromise vulnerable machines, a security researcher said.

The flaw is located in the RTLWIFI driver, which is used to support Realtek Wi-Fi chips in Linux devices. The vulnerability triggers a buffer overflow in the Linux kernel when a machine with a Realtek Wi-Fi chip is within radio range of a malicious device. At a minimum, exploits would cause an operating-system crash and could possibly allow a hacker to gain complete control of the computer. The flaw dates back to version 3.10.1 of the Linux kernel released in 2013...

The vulnerability is tracked as CVE-2019-17666. Linux developers proposed a fix on Wednesday that will likely be incorporated into the OS kernel in the coming days or weeks. Only after that will the fix make its way into various Linux distributions.

Nico Waisman, who is a principal security engineer at Github [and discovered the bug] said he has not yet devised a proof-of-concept attack that exploits the vulnerability in a way that can execute malicious code on a vulnerable machine. "I'm still working on exploitation, and it will definitely... take some time (of course, it might not be possible)," he wrote in a direct message. "On paper, [this] is an overflow that should be exploitable. Worst-case scenario, [this] is a denial of service; best scenario, you get a shell."
The article notes that the flaw "can't be triggered if Wi-Fi is turned off or if the device uses a Wi-Fi chip from a different manufacturer."

hcs_$reboot writes: Everyone in California will now receive earthquake alerts on their phones seconds before the ground begins to shake, giving residents up to 20 seconds of warning before shaking begins. Developed by seismologists at the University of California, Berkeley, the MyShake application (residents will need to download the app to receive the alerts in areas without cell phone coverage) is designed to alert the public when a magnitude 4.5 earthquake or greater has been detected and has been shown to be faster than other alert delivery methods. The wireless emergency alerts will be sent in the event of a more significant quake, magnitude 5.0 or greater. The system does not predict earthquakes. Rather, it uses numerous seismic stations to detect the start of an earthquake and light-speed communications to send the data to computers that instantly calculate location, magnitude, intensity of shaking and create alerts to be distributed to areas that will be affected. When the MyShake app was released back in 2016 it already detected over 200 earthquakes in more than ten countries.

A paper describing the early results gives a general idea of the app's success: "On a typical day about 8,000 phones provide acceleration waveform data to the MyShake archive. The on-phone app can detect and trigger on P waves and is capable of recording magnitude 2.5 and larger events. The largest number of waveforms from a single earthquake to date comes from the M5.2 Borrego Springs earthquake in Southern California, for which MyShake collected 103 useful three-component waveforms. The network continues to grow with new downloads from the Google Play store everyday and expands rapidly when public interest in earthquakes peaks such as during an earthquake sequence."

Motorola has sent out invitations to an event on Nov. 13, where the rumored foldable Razr phone could launch. CNET reports: Motorola said the evening event in downtown Los Angeles will feature the "highly anticipated unveiling of a reinvented icon." The save the date is a gif showing a device being folded and unfolded. "An original unlike any other," it reads, also displaying the numeric 11/13/19 date. According to the invitation, the event will feature special guests and musical performers, as well as "a journey through immersive experiences." "You're going to flip," Motorola's invite says. Motorola's Razr phone is rumored to have a foldable screen, but instead of opening out into a tablet, the phone could fold vertically to fit inside pockets. "It's also been reported that the phone will cost $1,500; measure 6.2 inches; run on a Qualcomm Snapdragon 710 processor; come in white, black and gold; and have a 2,730mAh battery, 4GB or 6GB of RAM and 64GM or 128GB of storage," reports CNET.

At an event in New York today, Google unveiled Pixel 4 and Pixel 4 XL, its latest flagship smartphones. The Pixel smartphones have over the years set a new benchmark for photography prowess. So you can imagine that a lot is riding on what Google, which has in curtailed several of its hardware ambitions in recent quarters, does with the new Pixel smartphones. From a report: Google makes it a point that the majority of the primary features are the same between the Pixel smartphones, with the primary exception being the display and screen technology. That is the case this year as well, with the Pixel 4 featuring a 5.7-inch Full HD+ P-OLED display, while the Pixel 4 XL boasts a 6.3-inch Quad HD OLED screen. Both panels support a 90Hz refresh rate, though. Inside both handsets is a Qualcomm Snapdragon 855 processor, and both smartphones boast 6GB of RAM. The handsets come in either 64GB or 128GB of built-in storage options, but there is no microSD card slot for expandable storage. There is a USB-C port for charging, and both handsets feature stereo speakers as well. The battery in the Pixel 4 measures in at 2800mAh, while the Pixel 4 XL has a 3700mAh battery tucked inside.

Meanwhile, around back, the real star of the show: the cameras. That's right, Google is bumping up the rear camera count to two. It starts with the standard 12-megapixel "Dual Pixel" camera, which is accompanied by a 16-megapixel telephoto lens. The rounded square camera housing also hosts a microphone and a flash. [...] And finally, the front-facing camera is equipped with a radar sensor that gives the handsets much more utility than previous models. It starts with true depth detection while using the front-facing camera to unlock the phone with a face unlock biometric feature. Google is also including a new "Motion Sense" technology, letting the Pixel 4 and Pixel 4 XL support gestures for controlling media playback and more. The pricing for Pixel 4 starts at $799, while its bigger sibling begins at $899. Unlike previous Pixel smartphone models, the Pixel 4 and 4 XL won't offer their users the ability to upload unlimited photos in their original resolution and qualirty to Google Photos at no charge. Both the handsets, though, come bundled with a new voice recorder app that transcribes voice recording in real time for free, Google said.

dryriver writes: A study in the British Medical Journal that looked at 24 of the 100s of Medical apps available on Google Play found that 79% pass all sorts of user info -- including sensitive medical info like what your reported symptoms are and what medications you are taking in some cases -- on to third and fourth parties. A German-made and apparently very popular medical app named Ada was found to share user data with trackers like Facebook, Adjust and Amplitude for example. [Click here for the article in German.] The New York Times also warned recently about apps that want to retrieve/store your medical records.

From the conclusion of the study: "19/24 (79%) of sampled apps shared user data. 55 unique entities, owned by 46 parent companies, received or processed app user data, including developers and parent companies (first parties) and service providers (third parties). 18 (33%) provided infrastructure related services such as cloud services. 37 (67%) provided services related to the collection and analysis of user data, including analytics or advertising, suggesting heightened privacy risks. Network analysis revealed that first and third parties received a median of 3 (interquartile range 1-6, range 1-24) unique transmissions of user data. Third parties advertised the ability to share user data with 216 "fourth parties"; within this network (n=237), entities had access to a median of 3 (interquartile range 1-11, range 1-140) unique transmissions of user data. Several companies occupied central positions within the network with the ability to aggregate and re-identify user data."

Chris Matyszczyk from ZDNet retells the draconian story of a Financial Times writer who wasn't able to prove she purchased a ticket for the London buses because her phone died (she used Apple Pay), which led to her being charged a criminal. An anonymous reader shares an excerpt from the report: Today's witness is Jemima Kelly. She's a writer for The Financial Times. Please don't let any personal thoughts about that get in the way of her story. You see, she just experienced a little technological nightmare. A cheery digital convert, she admits she often leaves the house without her wallet. But surely not without her iPhone. Apple Pay is, after all, a contemporary joy. It's right up there with Tinder in its ability to make your life easier.

Kelly, indeed, hops on London buses and uses Apple Pay to tap her payment instead of buying a ticket the old-fashioned way. Which, as she cheerily described, is easy unless a ticket inspector wanders by. Just after your iPhone's battery has died. She couldn't prove that she'd paid, but gave her personal details and assumed there'd be a record of her probity on the transportation company's computers. But then she was charged with, well, not providing proof of payment. Charged as in would be forced to go to court and to plead guilty or not guilty within 21 days. Here's where things got (more) awkward. Kelly produced a bank statement that proved she'd paid. The transportation company -- Transport For London -- insisted this wasn't enough.

It seems she'd failed another digital task -- registering her Apple Pay with Transport For London. She was edging ever closer to criminal status. But did her Apple Pay details need to be registered? Kelly revealed: "They told me, 'there is no requirement for cards to be registered, the same as paying for any goods and services in a shop'. But it's not the same, actually; in a shop, you are given a breakdown in the form of a receipt." So, here she was, contactless and receiptless. Next, she heard that her court case had happened and she'd been found guilty. Oh, and she also owed a fine of around $592. In the end, Kelly managed to get back to court and persuade the judge to void her conviction, but the process took months.

"Her story, however, aptly describes how the digital world demands our complete and unyielding participation," writes Matyszczyk. "Digital systems are designed by those who strive for complete perfection and consistency. Which doesn't describe the human condition at all." Do you think digitizing everything is a good thing?

An anonymous reader quotes a report from Ars Technica: AT&T and other mobile carriers are trying to hide detailed 5G maps from the public despite constantly touting the supposed pace and breadth of their 5G rollouts. With the Federal Communications Commission planning to require carriers to submit more accurate data about broadband deployment, AT&T and the mobile industry's top lobby group are urging the FCC to exclude 5G from the upgraded data collection. "There is broad agreement that it is not yet time to require reporting on 5G coverage," AT&T told the FCC in a filing this week.

As evidence of that "broad agreement," AT&T cited comments by CTIA -- the mobile industry lobby group that represents AT&T, Verizon, T-Mobile, and Sprint. "[A]s CTIA points out, service standards for 5G are still emerging, precluding reporting of service-level coverage for 5G networks (other than the 5G-NR submissions already required)," AT&T wrote. That's a reference to 5G New Radio, the global standard for 5G. CTIA told the FCC in September that it doesn't object to the 5G-NR requirement because "the 5G-NR standards are technical ones; they do not establish what service level consumers should be able to expect when using 5G." But CTIA said requiring more than that would be "premature" because "industry consensus is still emerging around how best to measure the deployment of this still-nascent technology." Verizon also told the FCC in September that "adoption of standardized parameters is premature" for 5G. "Calling 5G a 'still-nascent technology' that can't properly be measured yet raises the question of why carriers have been telling the FCC and public that 5G is guaranteed to revolutionize modern life and that carriers need regulatory favors to speed its rollout," adds Ars Technica. "The mobile industry didn't think it was 'premature' for the U.S. government to preempt local regulation of 5G deployments, an action FCC Chairman Ajit Pai took more than a year ago."

Rwanda's Mara Group just released two smartphones, earning the company the title of the first smartphone manufacturer in Africa. Their grand ambitions are to help turn Rwanda into a regional tech hub. Fast Company reports: Rwanda President Paul Kagame has announced Africa's "first high tech smartphone factory," CNN reported. While smartphones are assembled in other African nations (Egypt, Algeria, and South Africa all have assembly plants), according to Reuters, those companies all import the components. But at Mara, they manufacture the phones from the motherboards to the packaging, which is all done in the new factory. Kagame made the announcement in a press conference on Monday in the capital of Kigali. The phones, called Mara X and Mara Z, are the first "Made in Africa" models. Both run on Google's Android operating system. While the company admits they are a little more expensive than other options, like the popular Tecno brand phones made by a Chinese-owned company, they hope customers are willing to pay a bit more for quality and Made in Africa pride.

Apple, a company that loves to talk about its values, has this week demonstrated that when it comes to China -- one of its biggest markets and where most of its iPhones and other products are assembled taking full benefit of low-cost labors -- even the Steve Jobs-founded company lacks a backbone. The company has bowed down to Chinese pressure and pulled an app from the Chinese App Store that helped pro-democracy protesters track cops to ensure their safety. Apple, a company with nearing $1 trillion in market cap, said the app "violates our guidelines and local laws."

The company has also pulled news app Quartz, which has been extensively covering the protests in Hong Kong, from the app store. The explanation from Apple, the company which has spent hundreds of millions of dollars to plaster every mall on the face of this planet in recent weeks to tell us that its new iPhone models have an ultra-wide lens? Crickets. On the Chinese App Store, Apple also does not offer The New York Times app because it "violates its policies." That's right. The New York Times, the biggest publication on the planet that wins tons of awards for its reportage each year and is celebrated across the globe and is a partner of Apple for Apple News subscription service, violates Apple's policies in China.

A few other times when x-ray report showed Apple did not have a backbone.

Camera bumps on smartphones may soon go away thanks to a team of researchers at the University of Utah who've developed a radically thin camera lens. Gizmodo reports: For comparison, the lens elements used in today's smartphone cameras, which gather and focus light onto a tiny sensor, are a few millimeters thick. It might not sound like much, but the best smartphone cameras use multiple elements, which quickly add up, resulting in a thin phone simply not having enough room to house all of them: hence the camera bump trend. But a team of electrical and computer engineering researchers at the University of Utah have succeeded in creating a new type of optical lens that measures just a few microns thick, or about a thousand times thinner and one hundred times lighter than what you'll find in smartphones today.

The lens the researchers created is actually made up of innumerable tiny microstructures, imperceptible to the human eye, and strategically positioned so that each one bends and redirects light towards a camera's sensor. When they're all working together, they produce the same results as a single curved element does. Manufacturing the lenses also required the team to develop a new fabrication process, a new polymer, and custom algorithms to calculate the shape and position of each microstructure. But the resulting lens can be completely flat, and made of lightweight plastic. If you've ever spent a day carrying around a camera with a big lens hanging off the front, you'll appreciate that benefit alone. The study has been published in the Proceedings of the National Academy of Sciences.

Andy Rubin, the controversial mobile industry executive who co-founded Android, left Google amid allegations of sexual misconduct while retaining a huge severance package, and went on to create the Essential Phone, has tweeted photos teasing an upcoming device with an elongated design and very tall UI composed of card-like apps. The Verge reports: It look extremely small in his hands, too. The device has a large button and volume rocker on the right edge and a fingerprint divot around back, below what appears to be a single main camera. And as you can see, these devices have some decidedly flashy finishes that change color when you view them at different angles -- a sea green that shifts to yellow and blue, for example.

An Essential spokesperson confirmed to the The Verge that this is the company's new phone, adding: "We've been working on a new device that's now in early testing with our team outside the lab. We look forward to sharing more in the near future." A couple hours later, Essential tweeted some slightly more official images of the new phone, which it's calling Project Gem. XDA-Developers also spotted some leaked code that mentions the divot on the rear of the device may activate its voice assistant when you tap your finger to it. They also suggest it runs Android and packs a Qualcomm Snapdragon 730 processor.

The mobile version of video game franchise "Call of Duty" racked up 100 million downloads in its first week, industry site Sensor Tower said on Tuesday, dwarfing the debuts of previous smashes including "Fortnite" and "PlayerUnknown's Battlegrounds" (PUBG). From a report: PUBG, Fortnite and Electronic Arts' "Apex Legends" scored 26.3 million, 22.5 million and 25 million respectively in their first week of release. "This is by far the largest mobile game launch in history in terms of the player base that's been built in the first week," said Randy Nelson, head of mobile insights at Sensor Tower. "Call of Duty: Mobile" was launched by its publisher Activision Blizzard Inc on Oct. 1 and Sensor Tower said the numbers reflected worldwide unique downloads across Apple's App Store and Google Play in the period since.

Almost 30 years after the World Wide Web was first invented, there are still billions of people that don't have access to any sort of internet connectivity. Microsoft wants to change that by using its 2017 Airband Initiative to streamline efforts to build out internet access across Africa, Latin America and Asia. "Moving forward, the company plans to connect 40 million people across the world to the internet by 2022," reports Engadget. From the report: Initially, Microsoft will focus on rural and remote communities in Latin America and Sub-Saharan Africa, with other regions to follow. The company adds that it plans to employ a four-part approach that will focus on working with local ISPs and communities to build out affordable and reliable internet access. Microsoft is pushing regulators for access to TV White Space (TVWS), which are wireless frequencies that can be repurposed to deliver internet access across a wide area. Microsoft is also working to build out internet access in rural communities across the U.S. The company currently aims to bring high-speed internet access to more than 9 million people in Iowa, Illinois, Kansas, Nebraska, Oklahoma and Texas.

Senator Cory Gardner (R-Colo.) introduced a bill, dubbed the Protecting Privacy in our Homes Act, that would require tech companies to include a label on products disclosing the presence of internet-connected microphones or cameras. "The proposed law does not define what kind of labels would need to be appended but rather would order the Federal Trade Commission to put in place specific regulations 'under which each covered manufacturer shall be required to include on the packaging of each covered device manufactured by the covered manufacturer a notice that a camera or microphone is a component of the covered device,'" reports Ars Technica. From the report: "Consumers face a number of challenges when it comes to their privacy, but they shouldn't have a challenge figuring out if a device they buy has a camera or microphone embedded into it," Gardner said. "This legislation is about consumer information, consumer empowerment, and making sure we're doing everything we can to protect consumer privacy." Most products that ship with cameras or microphones included tout the inclusion of such recording devices as a selling point, which could make this kind of regulation feel redundant at best. That said, there's quite a difference between "most" and "all." A rule such as the regulation Gardner proposes would close the gap that, for example, led owners of Nest Secure devices to the unpleasant discovery earlier this year that the products had shipped with undisclosed microphones.

D-Link won't patch a critical unauthenticated command-injection vulnerability in its routers that could allow an attacker to remotely take over the devices and execute code. Threatpost reports: The vulnerability (CVE-2019-16920) exists in the latest firmware for the DIR-655, DIR-866L, DIR-652 and DHP-1565 products, which are Wi-Fi routers for the home market. D-Link last week told Fortinet's FortiGuard Labs, which first discovered the issue in September, that all four of them are end-of-life and no longer sold or supported by the vendor (however, the models are still available as new via third-party sellers). The root cause of the vulnerability, according to Fortinet, is a lack of a sanity check for arbitrary commands that are executed by the native command-execution function. Fortinet describes this as a "typical security pitfall suffered by many firmware manufacturers." With no patch available, affected users should upgrade their devices as soon as possible.

China is taking every measure it can to verify the identities of its over 850 million mobile internet users. From a report: From Dec. 1, people applying for new mobile and data services will have to have their faces scanned by telecom providers, the Ministry of Industry and Information Technology said in a Sept. 27 statement. MIIT said the step was part of its efforts to "safeguard the legitimate rights and interests of citizens in the cyberspace" and to control phone and internet fraud. In addition to the facial-recognition test, phone users are also banned from passing their mobile phone numbers to others, and encouraged to check if numbers are registered under their name without their consent.

Fast Company highlights some of the "privacy nightmares" surrounding low-cost Android smartphones, which can be very attractive for those on a tight budget. One example is the MYA2 MyPhone: According to an analysis by the advocacy group Privacy International, a $17 Android smartphone called MYA2 MyPhone, which was launched in December 2017, has a host of privacy problems that make its owner vulnerable to hackers and to data-hungry tech companies. First, it comes with an outdated version of Android with known security vulnerabilities that can't be updated or patched. The MYA2 also has apps that can't be updated or deleted, and those apps contain multiple security and privacy flaws. One of those pre-installed apps that can't be removed, Facebook Lite, gets default permission to track everywhere you go, upload all your contacts, and read your phone's calendar. The fact that Facebook Lite can't be removed is especially worrying because the app suffered a major privacy snafu earlier this year when hundreds of millions of Facebook Lite users had their passwords exposed.

Philippines-based MyPhone said the specs of the MYA2 limited it to shipping the phone with Android 6.0, and since then it says it has "lost access and support to update the apps we have pre-installed" with the device. Given that the MYA2 phone, like many low-cost Android smartphones, runs outdated versions of the Android OS and can't be updated due to their hardware limitations, users of such phones are limited to relatively light privacy protections compared to what modern OSes, like Android 10, offer today. The MYA2 is just one example of how cheap smartphones leak personal information, provide few if any privacy protections, and are incredibly easy to hack compared to their more expensive counterparts.

In 2014 consumer expert and Silicon Valley startup founder Nir Eyal wrote Hooked: How to Build Habit-Forming Products. But five years later, the New York Times reports he's offering consumers a new book about how to resist those habits -- even while arguing that "addiction" is the wrong way to describe technology's hold on people: There was a problem, yes, but the thinking was all wrong, he decided. Using the language of addiction gave tech users a pass. It was too easy. The issue was not screens but people's own minds, and to solve the problem they had to look within. "If I call technology something that people get addicted to, there needs to be a pusher, a dealer doing it to you," Mr. Eyal said. "But if I say technology is something that people overuse, then it's, 'Oh, crap, now I need to do something about it myself....'" The solution he proposes in Indistractable is slow. It involves self-reflection. He argues that many times we look at phones because we are anxious and bad at being alone -- and that's not the phone's fault...

Mr. Eyal has written a guide to free people from an addiction he argues they never had in the first place. It was all just sloughing off personal responsibility, he figures. So the solution is to reclaim responsibility in myriad small ways. For instance: Have your phone on silent so there will be fewer external triggers. Email less and faster. Don't hang out on Slack. Have only one laptop out during meetings. Introduce social pressure like sitting next to someone who can see your screen. Set "price pacts" with people so you pay them if you get distracted -- though be sure to "learn self-compassion before making a price pact....."

"I got myself a feature phone that had no apps. I got on eBay a word processor, and all it does is let you type. I made my phone grayscale, which only ruined my pictures," he said. "I tried a digital detox, but I missed audiobooks and GPS...."
He also argues that getting hooked on social media isn't necessarily a bad thing. "For many people, social media is a very good thing and gaming is a very good thing. It's how you use it...." But he's also predicting a "post-digital" movement will emerge in 2020.

"We will start to realize that being chained to your mobile phone is a low-status behavior, similar to smoking."

ugen (Slashdot reader #93,902) writes: Something I discovered today, while trying to change a MAC address on a new MacBook Air (as I did for years on other MacBooks): ifconfig en0 ether "new mac" no longer works. It appears that this is a change made sometime last year, applicable to all Apple newer MacBooks.

Implications of permanently fixed MAC addresses on privacy and security are hard to underestimate. Given that Windows now supports complete Wifi MAC address randomization — I am sad to admit that Microsoft looks like a champion of privacy here. What are your thoughts? Solutions anyone knows of (I'll take a reasonable technical hack).

Here are a few mentions of this elsewhere:
Mac Rumors forums
The GitHub repo for SpoofMAC
A discussion on Stack Overflow
I've seen other theories about what's going on, though the bigger question is still what's the solution? Leave your own thoughts and suggestions in the comments.

And did MacOS stop allowing changes to wifi MAC addresses?