desktop – Tech Today w/ Ken May

Why Windows Vista Ended Up Being a Mess

alaskana98 shares an article called “What Really Happened with Vista: An Insider’s Retrospective.” Ben Fathi, formerly a manager of various teams at Microsoft responsible for storage, file systems, high availability/clustering, file level network protocols, distributed file systems, and related technologies and later security, writes: Imagine supporting that same OS for a dozen years or more for a population of billions of customers, millions of companies, thousands of partners, hundreds of scenarios, and dozens of form factors — and you’ll begin to have an inkling of the support and compatibility nightmare. In hindsight, Linux has been more successful in this respect. The open source community and approach to software development is undoubtedly part of the solution. The modular and pluggable architecture of Unix/Linux is also a big architectural improvement in this respect. An organization, sooner or later, ships its org chart as its product; the Windows organization was no different. Open source doesn’t have that problem… I personally spent many years explaining to antivirus vendors why we would no longer allow them to “patch” kernel instructions and data structures in memory, why this was a security risk, and why they needed to use approved APIs going forward, that we would no longer support their legacy apps with deep hooks in the Windows kernel — the same ones that hackers were using to attack consumer systems. Our “friends”, the antivirus vendors, turned around and sued us, claiming we were blocking their livelihood and abusing our monopoly power! With friends like that, who needs enemies? I like how the essay ends. “Was it an incredibly complex product with an amazingly huge ecosystem (the largest in the world at that time)? Yup, that it was. Could we have done better? Yup, you bet… Hindsight is 20/20.” Read more of this story at Slashdot.

View original post here:
Why Windows Vista Ended Up Being a Mess

After Intel ME, Researchers Find Security Bug In AMD’s SPS Secret Chip-on-Chip

An anonymous reader writes: AMD has fixed, but not yet released BIOS/UEFI/firmware updates for the general public for a security flaw affecting the AMD Secure Processor. This component, formerly known as AMD PSP (Platform Security Processor), is a chip-on-chip security system, similar to Intel’s much-hated Management Engine (ME). Just like Intel ME, the AMD Secure Processor is an integrated coprocessor that sits next to the real AMD64 x86 CPU cores and runs a separate operating system tasked with handling various security-related operations. The security bug is a buffer overflow that allows code execution inside the AMD SPS TPM, the component that stores critical system data such as passwords, certificates, and encryption keys, in a secure environment and outside of the more easily accessible AMD cores. Intel fixed a similar flaw last year in the Intel ME. Read more of this story at Slashdot.

Read the original:
After Intel ME, Researchers Find Security Bug In AMD’s SPS Secret Chip-on-Chip

Ubuntu 17.10 Temporarily Pulled Due To A BIOS Corrupting Problem

An anonymous reader writes: Canonical has temporarily pulled the download links for Ubuntu 17.10 “Artful Aardvark” from the Ubuntu website due to ongoing reports of some laptops finding their BIOS corrupted after installing this latest Ubuntu release. The issue is appearing most frequently with Lenovo laptops but there are also reports of issues with other laptop vendors as well. This issue appears to stem from the Intel SPI driver in the 17.10’s Linux 4.13 kernel corrupting the BIOS for a select number of laptop motherboards. Canonical is aware of this issue and is planning to disable the Intel SPI drivers in their kernel builds. Canonical’s hardware enablement team has already verified this works around the problem, but doesn’t provide any benefit if your BIOS is already corrupted. Read more of this story at Slashdot.

Plexamp, Plex’s Spin on the Classic Winamp Player, Is the First Project From New Incubator Plex Labs

Media software maker Plex today announced a new incubator and community resource called Plex Labs. “The idea here is to help the company’s internal passion projects gain exposure, along with those from Plex community members, ” reports TechCrunch. “Plex Labs is also unveiling its first product: a music player called Plexamp, ” which is designed to replace the long-lost Winamp. From the report: The player was built by several Plex employees in their free time, and is meant for those who use Plex for music. As the company explains in its announcement, the goal was to build a small player that sits unobtrusively on the desktop and can handle any music format. The team limited itself to a single window, making Plexamp the smaller Plex player to date, in terms of pixel size. Under the hood, Plexamp uses the open source audio player Music Player Daemon (MPD), along with a combination of ES7, Electron, React, and MobX technologies. The end result is a player that runs on either macOS or Windows and works like a native app. That is, you can use media keys for skipping tracks or playing and pausing music, and receive notifications. The player can also handle any music format, and can play music offline when the Plex server runs on your laptop. The player also supports gapless playback, soft transitions and visualizations to accompany your music. Plus, the visualizations’ palette of colors is pulled from the album art, Plex notes. Additionally, Plexamp makes use of a few up-and-coming features that will be included in Plex’s subscription, Plex Pass, in the future. These new features are powering functionality like loudness leveling (to normalize playback volume), smart transitions (to compute the optimal overlap times between tracks), soundprints (to represent tracks visually), waveform seeking (to present a graphical view of tracks), Library stations, and artist radio. Read more of this story at Slashdot.

See the original post:
Plexamp, Plex’s Spin on the Classic Winamp Player, Is the First Project From New Incubator Plex Labs

Microsoft Disables Word DDE Feature To Prevent Further Malware Attacks

An anonymous reader writes: As part of the December 2017 Patch Tuesday, Microsoft has shipped an Office update that disables the DDE feature in Word applications, after several malware campaigns have abused this feature to install malware. DDE stands for Dynamic Data Exchange, and this is an Office feature that allows an Office application to load data from other Office applications. For example, a Word file can update a table by pulling data from an Excel file every time the Word file is opened. DDE is an old feature, which Microsoft has superseded via the newer Object Linking and Embedding (OLE) toolkit, but DDE is still supported by Office applications. The December Patch Tuesday disables DDE only in Word, but not Excel or Outlook. The reason is that several cybercrime and spam groups have jumped on this technique, which is much more effective at running malicious code when compared to macros or OLE objects, as it requires minimal interaction with a UI popup that many users do not associate with malware. For Outlook and Excel, Microsoft has published instructions on how users can disable DDE on their own, if they don’t want this feature enabled. Read more of this story at Slashdot.

Continue reading here:
Microsoft Disables Word DDE Feature To Prevent Further Malware Attacks

Linux Pioneer Munich Confirms Switch To Windows 10

The German city of Munich, once seen as a open-source pioneer, has decided to return to Windows. Windows 10 will be rolled out to about 29, 000 PCs at the city council, a major shift for an authority that has been running Linux for more than a decade. From a report: Back in 2003 the council decided to to switch to a Linux-based desktop, which came to be known as LiMux, and other open-source software, despite heavy lobbying by Microsoft. But now Munich will begin rolling out a Windows 10 client from 2020, at a cost of about Euro 50m ($59.6m), with a view to Windows replacing LiMux across the council by early 2023. Politicians who supported the move at a meeting of the full council today say using Windows 10 will make it easier to source compatible applications and hardware drivers than it has been using a Linux-based OS, and will also reduce costs associated with running Windows and LiMux PCs side-by-side. Read more of this story at Slashdot.

More:
Linux Pioneer Munich Confirms Switch To Windows 10

iMac Pro Will Have An A10 Fusion Coprocessor For ‘Hey, Siri’ Support and More Secure Booting, Says Report

According to Apple firmware gurus Steven Troughton-Smith and Guilherme Rambo, the upcoming iMac Pro will feature an A10 Fusion coprocessor to enable two interesting new features. “The first is the ability for the iMac Pro to feature always-on ‘Hey, Siri’ voice command support, similar to what’s currently available on more recent iPhone devices, ” reports The Verge. “[T]he bigger implication of the A10 Fusion is for a less user-facing function, with Apple likely to use the coprocessor to enable SecureBoot on the iMac Pro.” From the report: In more practical terms, it means that Apple will be using the A10 Fusion chip to handle the initial boot process and confirm that software checks out, before passing things off to the regular x86 Intel processor in your Mac. It’s not something that will likely change how you use your computer too much, like the addition of “Hey, Siri” support will, but it’s a move toward Apple experimenting with an increased level of control over its software going forward. Read more of this story at Slashdot.

View original post here:
iMac Pro Will Have An A10 Fusion Coprocessor For ‘Hey, Siri’ Support and More Secure Booting, Says Report

Linux 4.14 Has Been Released

diegocg quotes Kernel Newbies: Linux 4.11 has been released. This release adds support for bigger memory limits in x86 hardware (128PiB of virtual address space, 4PiB of physical address space); support for AMD Secure Memory Encryption; a new unwinder that provides better kernel traces and a smaller kernel size; support for the zstd compression algorithm has been added to Btrfs and Squashfs; support for zero-copy of data from user memory to sockets; support for Heterogeneous Memory Management that will be needed in future GPUs; better cpufreq behaviour in some corner cases; faster TBL flushing by using the PCID instruction; asynchronous non-blocking buffered reads; and many new drivers and other improvements. Phoronix has more on the changes in Linux 4.14 — and notes that its codename is still “Fearless Coyote.” Read more of this story at Slashdot.

Linux Has a USB Driver Security Problem

Catalin Cimpanu, reporting for BleepingComputer: USB drivers included in the Linux kernel are rife with security flaws that in some cases can be exploited to run untrusted code and take over users’ computers. The vast majority of these vulnerabilities came to light on Monday, when Google security expert Andrey Konovalov informed the Linux community of 14 vulnerabilities he found in the Linux kernel USB subsystem. “All of them can be triggered with a crafted malicious USB device in case an attacker has physical access to the machine, ” Konovalov said. The 14 flaws are actually part of a larger list of 79 flaws Konovalov found in Linux kernel USB drivers during the past months. Not all of these 79 vulnerabilities have been reported, let alone patched. Most are simple DoS (Denial of Service) bugs that freeze or restart the OS, but some allow attackers to elevate privileges and execute malicious code. Read more of this story at Slashdot.

View article:
Linux Has a USB Driver Security Problem

Samsung To Let Proper Linux Distros Run on Galaxy Smartphones

An anonymous reader shares a report: Samsung has announced it will soon become possible to run actual proper Linux on its Note8, Galaxy S8 and S8+ smartphones — and even Linux desktops. Yeah, yeah, we know Android is built on Linux, but you know what we mean. Samsung said it’s working on an app called “Linux on Galaxy” that will let users “run their preferred Linux distribution on their smartphones utilizing the same Linux kernel that powers the Android OS.” “Whenever they need to use a function that is not available on the smartphone OS, users can simply switch to the app and run any program they need to in a Linux OS environment, ” Samsung says. The app also allows multiple OSes to run on a device. Linux desktops will become available if users plug their phones into the DeX Station, the device that lets a Galaxy 8 run a Samsung-created desktop-like environment when connected to the DeX and an external monitor. Read more of this story at Slashdot.

See the original article here:
Samsung To Let Proper Linux Distros Run on Galaxy Smartphones