Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. Also, Slashdot's Facebook page has a chat bot now. Message it for stories and more. ×
Android

LG Unveils G6 Android Nougat Smartphone With a Compact 5.7-Inch QHD+ 18:9 Display (hothardware.com) 76

MojoKid writes: LG recently unveiled the new G6 smartphone, going completely back to the drawing board versus its predecessor -- the not so well-received G5. In its place is a very compact aluminum unibody design and a large 5.7-inch QHD+ display with a 2880x1440 resolution. That display is the main focal point of the G6, and it has a rather unorthodox 18:9 screen ratio, which LG says allows that smartphone to better fit in your hand. LG also notes that the aspect ratio is being adopted as a universal format from the likes of film studios and content providers like Netflix. Its thin bezel also gives the LG G6 an 80 percent screen-to-body ratio. The handset is powered by a Qualcomm Snapdragon 821 processor along with 4GB of RAM, 32GB of internal storage and a microSD slot, which can accommodate up to an additional 2TB of storage. LG also outfitted the G6 with dual 13-megapixel rear cameras: a wide angle (F2.4 / 125 degree) shooter and a standard camera (F1.8 / 71 degree) with optical image stabilization. The LG G6 launches next month and will be available in Ice Platinum, Mystic White, Astro Black color options. Pricing is TBD. Some other specs include a non-removable 3,300 mAh battery, USB-C connectivity, 802.11ac Wi-Fi, Bluetooth 4.2, fingerprint sensor and an IP68 water and dust resistance rating. It's also the first non-Google smartphone to come pre-loaded with the Google Assistant. How do you think the LG G6 compares to what we currently know about the soon-to-be-launched Samsung Galaxy S8?
Google

Google Assistant To Be Available On Older Versions of Android Soon (zdnet.com) 27

Matthew Miller, writing for ZDNet: Google has announced that Google Assistant is coming to smartphones running Android 7.0 Nougat and Android 6.0 Marshmallow, starting this week. The Google Assistant will begin rolling out this week to English users in the US, followed by English in Australia, Canada and the United Kingdom, as well as German speakers in Germany. Google continue to add more languages in the future.
Transportation

Questioning The Privacy Policies Of Data-Collecting Cars (autoblog.com) 83

Remember when Vizio's televisions started collecting data about what shows people were watching? One transportation reporter is more worried about all the data being collected by cars. schwit1 quotes Autoblog: Nowadays, auto manufacturers seem to be tripping over each other pointing out that they offer Apple CarPlay and Google Android Auto. And more recent phenomenon are announcements -- from companies including Ford and Hyundai -- that they are offering Amazon Alexa capabilities. You talk. It listens... Here's the thing. While it may seem appealing to have all manner of connectivity in cars, there is the other side of that. Without getting all tinfoil hat about this, when your TV set is ratting you out, isn't it likely that your car will? It drives. And watches. And listens. And collects data...
That data could be shared with everyone from auto insurers and advertisers to law enforcement officials and divorce attorneys. But the real problem may be consumers assuming strong privacy protections that don't actually exist. The article argues that GM's privacy policy "is like most privacy policies, which boils down to: You use it (the device, software, etc.), you potentially give up a portion of your privacy."
Transportation

'Uber Is Doomed', Argues Transportation Reporter (jalopnik.com) 314

When an Uber self-driving car ran a red light last year, they blamed and suspended the car's driver, even though it was the car's software that malfunctioned, according to two former employees, ultimately causing Uber cars to run six different red lights. But technical issues may be only the beginning. An anonymous reader writes: Jalopnik points out that in 2016 Uber "burned through more than $2 billion, amid findings that rider fares only cover roughly 40% of a ride, with the remainder subsidized by venture capitalists" (covering even less than the fares of government-subsidized mass transit systems). So despite Google's lawsuit and other recent bad publicity, "even when those factors are removed, it's becoming more evident that Uber will collapse on its own."

Their long analysis argues that the problems are already becoming apparent. "Uber, which didn't respond to questions from Jalopnik about its viability, recently paid $20 million to settle claims that it grossly misled how much drivers could earn on Craigslist ads. The company's explosive growth also fundamentally required it to begin offering subprime auto loans to prospective drivers without a vehicle."

Last month transportation industry analyst Hubert Horan calculated that Uber Global's losses have been "substantially greater than any venture capital-funded startup in history."
Google

Is Google's Comment Filtering Tool 'Vanishing' Legitimate Comments? (vortex.com) 97

Slashdot reader Lauren Weinstein writes: Google has announced (with considerable fanfare) public access to their new "Perspective" comment filtering system API, which uses Google's machine learning/AI system to determine which comments on a site shouldn't be displayed due to perceived high spam/toxicity scores. It's a fascinating effort. And if you run a website that supports comments, I urge you not to put this Google service into production, at least for now.

The bottom line is that I view Google's spam detection systems as currently too prone to false positives -- thereby enabling a form of algorithm-driven "censorship" (for lack of a better word in this specific context) -- especially by "lazy" sites that might accept Google's determinations of comment scoring as gospel... as someone who deals with significant numbers of comments filtered by Google every day -- I have nearly 400K followers on Google Plus -- I can tell you with considerable confidence that the problem isn't "spam" comments that are being missed, it's completely legitimate non-spam, non-toxic comments that are inappropriately marked as spam and hidden by Google.

Lauren is also collecting noteworthy experiences for a white paper about "the perceived overall state of Google (and its parent corporation Alphabet, Inc.)" to better understand how internet companies are now impacting our lives in unanticipated ways. He's inviting people to share their recent experiences with "specific Google services (including everything from Search to Gmail to YouTube and beyond), accounts, privacy, security, interactions, legal or copyright issues -- essentially anything positive, negative, or neutral that you are free to impart to me, that you believe might be of interest."
Bug

Google Discloses Yet Another New Unpatched Microsoft Vulnerability In Edge/IE (bleepingcomputer.com) 71

An anonymous reader quotes BleepingComputer: Google has gone public with details of a second unpatched vulnerability in Microsoft products, this time in Edge and Internet Explorer, after last week they've published details about a bug in the Windows GDI (Graphics Device Interface) component... The bug, discovered by Google Project Zero researcher Ivan Fratric, is tracked by the CVE-2017-0037 identifier and is a type confusion, a kind of security flaw that can allow an attacker to execute code on the affected machine, and take over a device.

Details about CVE-2017-0037 are available in Google's bug report, along with proof-of-concept code. The PoC code causes a crash of the exploited browser, but depending on the attacker's skill level, more dangerous exploits could be built... Besides the Edge and IE bug, Microsoft products are also plagued by two other severe security flaws, one affecting the Windows GDI component and one the SMB file sharing protocol shipped with all Windows OS versions...

Google's team notified Microsoft of the bug 90 days ago, only disclosing it publicly on Friday.
Security

Apache Subversion Fails SHA-1 Collision Test, Exploit Moves Into The Wild (arstechnica.com) 159

WebKit's bug-tracker now includes a comment from Friday noting "the bots all are red" on their git-svn mirror site, reporting an error message about a checksum mismatch for shattered-2.pdf. "In some cases, due to the corruption, further commits are blocked," reports the official "Shattered" web site. Slashdot reader Artem Tashkinov explains its significance: A WebKit developer who tried to upload "bad" PDF files generated from the first successful SHA-1 attack broke WebKit's SVN repository because Subversion uses SHA-1 hash to differentiate commits. The reason to upload the files was to create a test for checking cache poisoning in WebKit.

Another news story is that based on the theoretical incomplete description of the SHA-1 collision attack published by Google just two days ago, people have managed to recreate the attack in practice and now you can download a Python script which can create a new PDF file with the same SHA-1 hashsum using your input PDF. The attack is also implemented as a website which can prepare two PDF files with different JPEG images which will result in the same hash sum.

Hardware Hacking

Open Source Car-Hacking Tool Successfully Crowdfunded (kickstarter.com) 54

An anonymous reader writes: Two geeks are crowdfunding an open source car hacking tool that will allow builders to experiment with diagnostics, telematics, security, and prototyping. "Cars have become complicated and expensive to work with," they explain on a Kickstarter page. "Macchina wants to use open source hardware to help break down these barriers and get people tinkering with their cars again." After years developing a beta prototype, they announced a tiny plug-and-play device/development platform (that can also be hardwired under the hood) on an Arduino Due board with a 32-bit ARM microcontroller. They almost immediately reached their $25,000 funding goal, and with 24 days left to go they've already raised $41,672, and they're now also selling t-shirts to benefit the EFF's "Right to Repair" activism.

Challenging "the closed, unpublished nature of modern-day car computers," their M2 device ships with protocols and libraries "to work with any car that isn't older than Google." With catchy slogans like "root your ride" and "the future is open," they're hoping to build a car-hacking developer community, and they're already touting the involvement of Craig Smith, the author of the Car Hacker's Handbook from No Starch Press.

"The one thing that all car hobbyists can agree on is that playing with cars isn't cheap," argues the campaign page. "Open source hardware is the answer!"
The Military

The US Department Of Defense Announces An Open Source Code Repository (defense.gov) 47

"The Pentagon is the latest government entity to join the open-source movement," writes NextGov. An anonymous reader quotes their report: The Defense Department this week launched Code.mil, a public site that will eventually showcase unclassified code written by federal employees. Citizens will be able to use that code for personal and public projects... The Defense Department's Digital Service team, whose members are recruited for short-term stints from companies including Google and Netflix, will be the first to host its code on the site once the agreement is finalized... "This is a direct avenue for the department to tap into a worldwide community of developers to collectively speed up and strengthen the software development process," a DOD post announcing the initiative said. The Pentagon also aims to find software developers and "make connections in support of DOD programs that ultimately service our national security."
Interestingly, there's no copyright protections on code written by federal employees, according to U.S. (and some international) laws, according to the site. "This can make it hard to attach an open source license to our code, and our team here at Defense Digital Service wants to find a solution. You can submit a public comment by opening a GitHub issue on this repository before we finalize the agreement at the end of March."
Transportation

Did Silicon Valley Lose The Race To Build Self-Driving Cars? (autoblog.com) 126

schwit1 quotes Autoblog: Up until very recently the talk in Silicon Valley was about how the tech industry was going to broom Detroit into the dustbin of history. Companies such as Apple, Google, and Uber -- so the thinking went -- were going to out run, out gun, and out innovate the automakers. Today that talk is starting to fade. There's a dawning realization that maybe there's a good reason why the traditional car companies have been around for more than a century.

Last year Apple laid off most of the engineers it hired to design its own car. Google (now Waymo) stopped talking about making its own car. And Uber, despite its sky high market valuation, is still a long, long way from ever making any money, much less making its own autonomous cars. To paraphrase Elon Musk, Silicon Valley is learning that "Making rockets is hard, but making cars is really hard."

The article argues the big auto-makers launched "vigorous in-house autonomous programs" which became fully competitive with Silicon Valley's efforts, and that Silicon Valley may have a larger role crunching the data that's collected from self-driving cars. "Last year in the U.S. market alone Chevrolet collected 4,220 terabytes of data from customer's cars... Retailers, advertisers, marketers, product planners, financial analysts, government agencies, and so many others will eagerly pay to get access to that information."
Security

Ask Slashdot: How Are You Responding To Cloudbleed? (reuters.com) 81

An anonymous IT geek writes: Cloudflare-hosted web sites have been leaking data as far back as September, according to Gizmodo, which reports that at least Cloudflare "acted fast" when the leak was discovered, closing the hole within 44 minutes, and working with search engines to purge their caches. (Though apparently some of it is still lingering...) Cloudflare CEO Matthew Prince "claims that there was no detectable uptick in requests to Cloudflare-powered websites from September of last year...until today. That means the company is fairly confident hackers didn't discover the vulnerability before Google's researchers did."

And the company's CTO also told Reuters that "We've seen absolutely no evidence that this has been exploited. It's very unlikely that someone has got this information... We do not know of anybody who has had a security problem as a result of this." Nevertheless, Fortune warns that "So many sites were vulnerable that it doesn't make sense to review the list and change passwords on a case-by-case basis." Some sites are now even resetting every user's password as a precaution, while site operators "are also being advised to wipe their sites' cookies and security certificates, and perform their own web searches to see if site data leaked." But I'd like to know what security precautions are being taken by Slashdot's readers?

Leave your own answers in the comments. How did you respond to Cloudbleed?
Open Source

Linus Torvalds On Git's Use Of SHA-1: 'The Sky Isn't Falling' (zdnet.com) 195

Google's researchers specifically cited Git when they announced a new SHA-1 attack vector, according to ZDNet. "The researchers highlight that Linus Torvald's code version-control system Git 'strongly relies on SHA-1' for checking the integrity of file objects and commits. It is essentially possible to create two Git repositories with the same head commit hash and different contents, say, a benign source code and a backdoored one,' they note." Saturday morning, Linus responded: First off - the sky isn't falling. There's a big difference between using a cryptographic hash for things like security signing, and using one for generating a "content identifier" for a content-addressable system like git. Secondly, the nature of this particular SHA1 attack means that it's actually pretty easy to mitigate against, and there's already been two sets of patches posted for that mitigation. And finally, there's actually a reasonably straightforward transition to some other hash that won't break the world - or even old git repositories...

The reason for using a cryptographic hash in a project like git is because it pretty much guarantees that there is no accidental clashes, and it's also a really really good error detection thing. Think of it like "parity on steroids": it's not able to correct for errors, but it's really really good at detecting corrupt data... if you use git for source control like in the kernel, the stuff you really care about is source code, which is very much a transparent medium. If somebody inserts random odd generated crud in the middle of your source code, you will absolutely notice... It's not silently switching your data under from you... And finally, the "yes, git will eventually transition away from SHA1". There's a plan, it doesn't look all that nasty, and you don't even have to convert your repository. There's a lot of details to this, and it will take time, but because of the issues above, it's not like this is a critical "it has to happen now thing".

In addition, ZDNet reports, "Torvalds said on a mailing list yesterday that he's not concerned since 'Git doesn't actually just hash the data, it does prepend a type/length field to it', making it harder to attack than a PDF... Do we want to migrate to another hash? Yes. Is it game over for SHA-1 like people want to say? Probably not."
Government

FCC To Halt Rule That Protects Your Private Data From Security Breaches (arstechnica.com) 119

According to Ars Technica, "The Federal Communications Commission plans to halt implementation of a privacy rule that requires ISPs to protect the security of its customers' personal information." From the report: The data security rule is part of a broader privacy rulemaking implemented under former Chairman Tom Wheeler but opposed by the FCC's new Republican majority. The privacy order's data security obligations are scheduled to take effect on March 2, but Chairman Ajit Pai wants to prevent that from happening. The data security rule requires ISPs and phone companies to take "reasonable" steps to protect customers' information -- such as Social Security numbers, financial and health information, and Web browsing data -- from theft and data breaches. The rule would be blocked even if a majority of commissioners supported keeping them in place, because the FCC's Wireline Competition Bureau can make the decision on its own. That "full commission vote on the pending petitions" could wipe out the entire privacy rulemaking, not just the data security section, in response to petitions filed by trade groups representing ISPs. That vote has not yet been scheduled. The most well-known portion of the privacy order requires ISPs to get opt-in consent from consumers before sharing Web browsing data and other private information with advertisers and other third parties. The opt-in rule is supposed to take effect December 4, 2017, unless the FCC or Congress eliminates it before then. Pai has said that ISPs shouldn't face stricter rules than online providers like Google and Facebook, which are regulated separately by the Federal Trade Commission. Pai wants a "technology-neutral privacy framework for the online world" based on the FTC's standards. According to today's FCC statement, the data security rule "is not consistent with the FTC's privacy standards."
Android

Google Renames Messenger To Android Messages as the Company Pushes RCS (betanews.com) 91

We have come a long way from the age of flip phones and nine-key texting. Even as if group messaging and instant messengers took over, the SMS has largely retained its core standard over the years. Google wants to change that, and for this, it has been working with hundreds of carriers and manufacturers around the world to bring the text message into the 21st century. Using a standard called Rich Communications Services, the group plans to make a texting app that comes with your phone and is every bit as powerful as those dedicated messaging apps. This would make all the best features available to everyone with an Android phone. From a report on BetaNews: Just last week we were talking about Google's championing of RCS (Rich Communication Services), the successor to SMS. Now the company has renamed its Messenger app to Android Messages as it aims to become not just the default SMS app, but the default RCS app for Android users. Part of the reason for the name change is to convey the idea that the app is now about more than just one type of message. Google is betting big on RCS and this is hinted at in the app update description which says it adds "Simpler sign-up for enhanced features on supported carriers."
Google

With No Fair Use, It's More Difficult to Innovate, Says Google (torrentfreak.com) 65

Unlike the United States where 'fair use' exemptions are entrenched in law, Australia has only a limited "fair dealing" arrangement. This led head of copyright at Google to conclude that Australia wouldn't be a safe place for his company to store certain data, a clear hindrance to innovation and productivity. From a report on TorrentFreak: The legal freedom offered by fair use is a cornerstone of criticism, research, teaching and news reporting, one that enables the activities of thousands of good causes and enriches the minds of millions. However, not all countries fully embrace the concept. Perhaps surprisingly, Australia is currently behind the times on this front, a point not lost on Google's Senior Copyright Counsel, William Patry. Speaking with The Australian, Patry describes local copyright law as both arcane and not fit for purpose, while acting as a hindrance to innovation and productivity. "We think Australians are just as innovative as Americans, but the laws are different. And those laws dictate that commercially we act in a different way," Patry told the publication. "Our search function, which is the basis of the entire company, is authorized in the US by fair use. You don't have anything like that here." Australia currently employs a more restrictive "fair dealing" approach, but itâ(TM)s certainly possible that fair use could be introduced in the near future.
Apple

Treasure Trove of Internal Apple Memos Discovered in Thrift Store (gizmodo.com) 28

An anonymous reader shares a Gizmodo report: Peeking inside a book bin at a Seattle Goodwill, Redditor vadermeer caught an interesting, unexpected glimpse into the early days of Apple: a cache of internal memos, progress reports, and legal pad scribbles from 1979 and 1980, just three years into the tech monolith's company history. The documents at one point belonged to Jack MacDonald -- then the manager of systems software for the Apple II and III (in these documents referred to by its code name SARA). The papers pertain to implementation of Software Security from Apple's Friends and Enemies (SSAFE), an early anti-piracy measure. Not much about MacDonald exists online, and the presence of his files in a thrift store suggests he may have passed away, though many of the people included in these documents have gone on to long and lucrative careers. The project manager on SSAFE for example, Randy Wigginton, was Apple's sixth employee and has since worked for eBay, Paypal, and (somewhat tumultuously) Google. Apple co-founder Steve Wozniak also features heavily in the implementation of these security measures.
Google

Alphabet's Waymo Sues Uber For Allegedly Stealing Self-Driving Secrets (bloomberg.com) 63

An anonymous reader quotes a report from Bloomberg: It took Alphabet Inc.'s Waymo seven years to design and build a laser-scanning system to guide its self-driving cars. Uber Technologies Inc. allegedly did it in nine months. Waymo claims in a lawsuit filed Thursday that was possible because a former employee stole the designs and technology and started a new company. Waymo accuses several employees of Otto, a self-driving startup Uber acquired in August for $680 million, of lifting technical information from Google's autonomous car project. The "calculated theft" of Alphabet's technology earned Otto's employees more than $500 million, according to the complaint in San Francisco federal court. The claims in Thursday's case include unfair competition, patent infringement and trade secret misappropriation. Waymo was inadvertently copied on an e-mail from one of its vendors, which had an attachment showing an Uber lidar circuit board that had a "striking resemblance" to Waymo's design, according to the complaint. Anthony Levandowski, a former manager at Waymo, in December 2015 downloaded more than 14,000 proprietary and confidential files, including the lidar circuit board designs, according to the complaint. He also allegedly created a domain name for his new company and confided in some of his Waymo colleagues of plans to "replicate" its technology for a competitor. Levandowski left Waymo in January 2016 and went on in May to form Otto LLC, which planned to develop hardware and software for autonomous vehicles.
Bug

Cloudflare Leaks Sensitive User Data Across the Web (theregister.co.uk) 87

ShaunC writes: In a bug that's been christened "Cloudbleed," Cloudflare disclosed today that some of their products accidentally exposed private user information from a number of websites. Similar to 2014's Heartbleed, Cloudflare's problem involved a buffer overrun that allowed uninitialized memory contents to leak into normal web traffic. Tavis Ormandy, of Google's Project Zero, discovered the flaw last week. Affected sites include Uber, Fitbit, and OK Cupid, as well as unnamed services for hotel booking and password management. Cloudflare says the bug has been fixed, and Google has purged affected pages from its search index and cache. Further reading: The Register, Ars Technica
Iphone

Cellebrite Can Now Unlock Apple iPhone 6, 6 Plus (cyberscoop.com) 103

Patrick O'Neill writes: A year after the battle between the FBI and Apple over unlocking an iPhone 5c used by a shooter in the San Bernardino terrorist attack, smartphone cracking company Cellebrite announced it can now unlock the iPhone 6 and 6 Plus for customers at rates ranging from $1,500 to $250,000. The company's newest products also extract and analyze data from a wide range of popular apps including all of the most popular secure messengers around. From the Cyberscoop report: "Cellebrite's ability to break into the iPhone 6 and 6 Plus comes in their latest line of product releases. The newest Cellebrite product, UFED 6.0, boasts dozens of new and improved features including the ability to extract data from 51 Samsung Android devices including the Galaxy S7 and Galaxy S7 Edge, the latest flagship models for Android's most popular brand, as well as the new high-end Google Pixel Android devices."
Piracy

Google Says Almost Every Recent 'Trusted' DMCA Notices Were Bogus (torrentfreak.com) 81

Reader AmiMoJo writes: In comments submitted to a U.S. Copyright Office consultation, Google has given the DMCA a vote of support, despite widespread abuse. Noting that the law allows for innovation and agreements with content creators, Google says that 99.95% of URLs it was asked to take down last month didn't even exist in its search indexes. "For example, in January 2017, the most prolific submitter submitted notices that Google honored for 16,457,433 URLs. But on further inspection, 16,450,129 (99.97%) of those URLs were not in our search index in the first place."

Slashdot Top Deals