Kid found a way to travel for free in Budapest. He filed a bug report. And was promptly arrested • The Register: "The arrest of a Hungarian bloke after he discovered a massive flaw in the website of Budapest's transport authority – and reported it – has sparked a wave of protests."

How to ensure that security, which is already ridiculously difficult, remains impossible.

Labels: security policy

Wisconsin court orders Apple pay $506M for infringing on WARF patent: "WARF first sued Apple in 2014 over alleged infringement of U.S. Patent No. U.S. 5,781,752 for a "Table based data speculation circuit for parallel processing computer." According to WARF and original patent claims, the IP provides a novel method of improving power efficiency and performance in modern computer processor designs using "predictor circuit" technology. The university leveraged the same patent to force Intel into a settlement in 2008."

If you had any questions as to why college education is barely affordable, here's your answer. How far have we come since Steve Jobs got excited about Mach at Carnegie-Mellon?

Labels: microprocessor patents, software engineering, software patents

“Perverse” malware infecting hundreds of Macs remained undetected for years | Ars Technica: "One of the interesting aspects of the latest Fruitfly variant is that it flew under the radar for so long. The malware relies on functions that were retired long ago and uses a crude method to remain installed once a Mac is infected. Compared to newer, more sophisticated malware, Fruitfly is much easier to detect. And yet, for whatever reason, no one caught it until recently. Two pieces of Mac software developed by Wardle would have given victims a strong indication they were infected. One, called BlockBlock, would have warned of the suspicious launch agent used by the malware. "

BlockBlock, like I said, good things.

Labels: security research

Microsoft’s secret weapon in ongoing struggle against Fancy Bear? Trademark law | Ars Technica: "In other words, any time an infected computer attempts to contact a command and control server through one of the domains, it will instead be connected to a Microsoft-controlled, secure server. "

That bear is dance.

Labels: security policy

Google drops the boom on WoSign, StartCom certs for good | Ars Technica: "The investigation uncovered a pattern of bad practices at WoSign and its subsidiary StartCom dating back to the spring of 2015. As a result, Google moved last October to begin distrusting new certificates issued by the two companies, stating "Google has determined that two CAs, WoSign and StartCom, have not maintained the high standards expected of CAs and will no longer be trusted by Google Chrome."

Now for the root CAs in lala land.

Labels: security policy

Objective-SeeBlockBlock has the ability query VirusTotal to see if either the process or startup item that was persisted, is known malware. Clicking on the 'virus total' button will generate a network request, which contains the path, name, and hash of both the process and startup item.

This looks very promising.

Labels: security tools mac

Apple no longer accepting VPN-based ad blockers to App Store, report says

This piqued my interest.

Labels: security policy

Qubes OS will ship pre-installed on Purism’s security-focused Librem 13 laptop | Ars Technica: "Qubes OS, the security-focused operating system that Edward Snowden said in November he was “really excited” about, announced this week that laptop maker Purism will ship their privacy-focused Librem 13 notebook with Qubes pre-installed."

This is the future of something, possibly the future of everything.

Labels: security policy, security research

Amazon supercharges GPU power, spits out Nvidia-backed G3 • The Register

Look, ma, I smell Metal in the cloud...

Labels: Apple vs. Apple

An AI can replace what a world leader said in his video-taped speech. This will end well. Not • The Register

Have to wonder who is funding this research.

Labels: 1984

Global Web standard for integrating DRM into browsers hits a snag | Ars Technica

I'm trying to understand what it gets in the way of.

Labels: security policy

Bloke takes over every .io domain by snapping up crucial name servers • The Register

Nothing to see here, move along.

Labels: 1984, 2001

Google Chrome's HTTPS ban-hammer drops on WoSign, StartCom in two months • The Register

The phrase false sense of security comes to mind.

Labels: security policy

Spanish media claims iPhone 6 with Secure Enclave unlocked by Cellebrite in course of investigation

Say it ain't so!