Trailrunner7 writes "Microsoft will issue an out-of-band patch on Monday for a critical vulnerability in all of the current versions of Windows. The company didn't identify which flaw it will be patching, but the description of the vulnerability is a close match to the LNK flaw that attackers have been exploiting for several weeks now, most notably with the Stuxnet malware. The advance notification from Microsoft on Friday said that the company is patching a critical vulnerability that is being actively exploited in the wild and affects all supported Windows platforms. The LNK flaw in the Windows shell was first identified earlier this month when researchers discovered the Stuxnet worm spreading from infected USB drives to PCs. Stuxnet has turned out to be a rather interesting piece of malware as it not only uses the LNK zero day vulnerability to spread, but it had components that were signed using a legitimate digital certificate belonging to Realtek, a Taiwanese hardware manufacturer."

Read more of this story at Slashdot.

pcardno writes "The UK government has responded to a petition encouraging government departments to move away from IE6 that had over 6,000 signatories. Their response seems to be that a fully patched IE6 is perfectly safe as long as firewalls and malware scanning tools are in place, and that mandating an upgrade away from IE6 will be too expensive. The second part is fair enough in this age of austerity (I'd rather have my taxes spent on schools and hospitals than software upgrade testing at the moment), but the whole reaction will be a disappointment to the petitioners."

Read more of this story at Slashdot.

drbutts writes "The Toronto Star has an interesting story on how they are securing DNS: 'It's housed in two high-security facilities separated by the North American landmass. The one authenticated map of the Internet. Were it to be lost — either through a catastrophic physical or cyber attack — it could be recreated by seven individuals spread around the globe. One of them is Ottawa's Norm Ritchie. Ritchie was recently chosen to hold one of seven smartcards that can rebuild the root key that underpins this system' called DNSSEC (Domain Name System Security Extensions). In essence, these seven can rebuild the architecture that allows users to know for certain where they are and where they are going when navigating the Web."

Read more of this story at Slashdot.

Hugh Pickens writes "The NY Times covers a report released by the National Research Council, which says the ability of the US to identify the source of a nuclear weapon used in a terrorist attack is fragile and eroding. The goals of the highly specialized detective work, known as nuclear attribution, is to clarify options for retaliation and to deter terrorists by letting them know that nuclear devices have fingerprints that atomic specialists can find and trace. 'Although US nuclear forensics capabilities are substantial and can be improved, right now they are fragile, under-resourced and, in some respects, deteriorating,' the report warns. 'Without strong leadership, careful planning and additional funds, these capabilities will decline.' The report calls on the federal government to take steps to strengthen its forensic capabilities and argues for the necessity of better planning, more robust budgets, clearer lines of authority and more realistic exercises."

Read more of this story at Slashdot.

Channard writes "While there have been occasional reports of previous PS3 firmware upgrades causing system crashes and so forth, Sony's new firmware upgrade for the system, 3.41, is apparently stopping PS3 owners from upgrading their hard disks. This problem has been encountered by many users on Sony's forums and occurs when you try to put a new hard disk into a PS3 that already has the firmware upgrade installed. The general course of action for upgrading a PS3's drive is that you download the latest PS3 firmware onto a memory stick and, after swapping the hard drive in the PS3, plug the stick in, allowing the PS3 to properly prepare the disk for use. But as of upgrade 3.41, the PS3 fails to recognize the firmware on the stick, complaining that it can't proceed until you insert the correct firmware. Repeating the process and re-downloading the firmware does not fix the problem, as I can confirm, having encountered the problem myself. Users can put the old hard disk back in, provided they've not reformatted it for some other purpose, so all is not lost. Sony have apparently told gaming website CVG that 'The information available to our Consumer Services Department does not suggest that this is a problem PlayStation owners are likely to experience when upgrading the HDD with 3.41 update.' This seems to fly in the face of the currently available information — although whether or not this statement was issued by Kevin Butler is unclear. Either way, PS3 owners encountering this problem will likely have to wait a few days for a fix and use their old HDDs for now."

Read more of this story at Slashdot.

eagledck tips news that the FCC has "finally approved the first 4G Long Term Evolution (LTE) phone for sale in the US." The Samsung device will use MetroPCS as a carrier, but tech specs, software details and a launch timetable are still uncertain. Meanwhile, Verizon is ramping up testing of their own LTE infrastructure, hoping to launch in 25 to 30 markets by the end of the year. An anonymous reader notes that LTE rollouts could be hampered by a confused and conflicted patent situation. "It is impossible to know where all the patents are but we have identified more than 60 companies holding essential patents. It is a very large landscape and fragmented. If there was one major patent pool and a handful of individual companies to deal with, that would be possible. But signing license deals with 40 plus [entities] is not. A unified patent pool is best," said a representative for one of three patent pool organizations trying to accomplish that.

Read more of this story at Slashdot.

snydeq writes "A DefCon contest that invites contestants to trick employees at 30 US corporations into revealing not-so-sensitive data has rattled nerves at the FBI. Chris Hadnagy, who is organizing the contest, also noted concerns from the financial industry, which fears hackers will target personal information. The contest will run for three days, with participants attempting to unearth data from an undisclosed list of about 30 US companies. The contest will take place in a room in the Riviera hotel in Las Vegas furnished with a soundproof booth and a speaker, so an audience can hear the contestants call companies and try to weasel out what data they can get from unwitting employees." The group organizing the contest has established a strict set of rules to ensure participants don't violate any laws. Update: 07/31 04:45 GMT by S : PCWorld has coverage of one of the day's more successful attacks.

Read more of this story at Slashdot.

CurtMonash writes "Nontechnical people — for example marketers or small business owners — increasingly get the feeling they should know more about technology. And they're right. If you can throw up a small website or do some real number-crunching, chances are those skills will help you feed your family. But how should they get started? I started a thread with the question on DBMS2, and some consistent themes emerged, including: Learn HTML + CSS early on; Learn a bit of SQL, but you needn't make that your focus; Have your first real programming language be one of the modern ones, such as PHP or Python; MySQL is a good vehicle to learn SQL; It's a great idea to start with a project you actually want to accomplish, and that can be done by modifying a starter set of sample code (e.g., a WordPress blog); Microsoft's technology stack is an interesting alternative to some of the other technology ideas. A variety of books and websites were suggested, most notably MIT's Scratch. But, frankly, it would really help to get more suggestions for sites and books that help one get started with HTML/CSS, or with MySQL, or with PHP. And so, techie studs and studdettes, I ask you — how should a non-techie go about learning some basic technological skills?"

Read more of this story at Slashdot.

suraj.sun writes with news that the US Department of Justice has joined a lawsuit alleging Oracle of overcharging the federal government for its software products. Quoting: "In a nutshell, the lawsuit argues that Oracle's government customers — a wide array of agencies, including the State Department, the Energy Department, and the Justice Department itself — got deals 'far inferior' to those the enterprise software giant gave to its commercial clients. The allegations stem from a software deal between Oracle and the federal General Services Administration that the Justice Department says involved 'hundreds of millions of dollars in sales' and that ran from 1998 to 2006. Under the contract, Oracle was required to inform the GSA when commercial discounts improved and to offer those same discounts to government buyers. Oracle misrepresented its true commercial sales practices and thus defrauded the US, the lawsuit contends.

Read more of this story at Slashdot.

penciling_in writes "ISC has made the announcement that they have developed a technology that will allow 'cooperating good guys' to provide and consume reputation information about domains names. The release of the technology, called Response Policy Zones (DNS RPZ), was announced at DEFCON. Paul Vixie explains: 'Every day lots of new names are added to the global DNS, and most of them belong to scammers, spammers, e-criminals, and speculators. The DNS industry has a lot of highly capable and competitive registrars and registries who have made it possible to reserve or create a new name in just seconds, and to create millions of them per day. ... If your recursive DNS server has a policy rule which forbids certain domain names from being resolvable, then they will not resolve. And, it's possible to either create and maintain these rules locally, or, import them from a reputation provider. ISC is not in the business of identifying good domains or bad domains. We will not be publishing any reputation data. But, we do publish technical information about protocols and formats, and we do publish source code. So our role in DNS RPZ will be to define 'the spec' whereby cooperating producers and consumers can exchange reputation data, and to publish a version of BIND that can subscribe to such reputation data feeds. This means we will create a market for DNS reputation but we will not participate directly in that market.'"

Read more of this story at Slashdot.

eldavojohn writes "According to AfterDawn, Google has given app makers the option to use a license server as DRM to ensure the user has paid for an app before they can download it. Reportedly, the Market app will communicate with a Google license server using RSA encryption. It is important to note this is only available for non-free apps (built with SDK 1.5 and later), and it was instituted to provide a better solution to the old and widely criticized copy protection scheme that was susceptible to Android app piracy (like sideloading). For better or for worse, Android's Marketplace appears to now have an optional, phone-home form of DRM." Following news of the new licensing service, Hexage Ltd, makers of a popular Android game called Radiant, released the data they had collected on piracy of Radiant over a 10-month period beginning last October. A series of charts shows total users, paid users and the piracy rate, by region.

Read more of this story at Slashdot.

climenole points out a post from Canonical founder Mark Shuttleworth about internal strife in the free software community. He wrote, "Tribalism is when one group of people start to think people from another group are 'wrong by default.' It's the great-granddaddy of racism and sexism. And the most dangerous kind of tribalism is completely invisible: it has nothing to do with someone's 'birth tribe' and everything to do with their affiliations: where they work, which sports team they support, which Linux distribution they love. ... Right now, for a number of reasons, there is a fever pitch of tribalism in plain sight in the free software world. It's sad. It's not constructive. It's ultimately going to be embarrassing for the people involved, because the Internet doesn't forget. It's certainly not helping us lift free software to the forefront of public expectations of what software can be."

Read more of this story at Slashdot.

ideonexus writes "The Atlantic has an excellent interview with Andrew Hacker — co-author with Claudia Dreifus of a book titled Higher Education? — covering everything that's wrong with the American university system. The discussion ranges from entrenched tenured professors more concerned with publishing and parking spaces than quality teaching; to 22-year-old students with unrealistic expectations that some company will put them in a management position after graduating with six-figures of debt; to football teams siphoning money away from academic programs so that student tuitions must increase to compensate. It really lays out the farce of university culture and reminds me of everything I absolutely despised about my college life. Dreifus is active in the comments section of the article as well, lending to a fantastic discussion on the subject."

Read more of this story at Slashdot.

wooferhound writes "Like proud parents savoring their baby's very first steps, mission team members gathered in a gallery above a clean room at NASA's Jet Propulsion Laboratory to watch the Mars Curiosity rover roll for the first time. Engineers and technicians wore bunny suits while guiding Curiosity through its first steps, or more precisely, its first roll on the clean room floor. The rover moved forward and backward about 1 meter (3.3 feet). Mars Science Laboratory (aka Curiosity) is scheduled to launch in fall 2011 and land on the Red Planet in August 2012. Curiosity is the largest rover ever sent to Mars. It will carry 10 instruments that will help search an intriguing region of the Red Planet for two things: environments where life might have existed, and the capacity of those environments to preserve evidence of past life."

Read more of this story at Slashdot.

waderoush writes "Princeton's Ed Felten has criticized the iPhone and iPad as Disneyland-like 'walled gardens' and says there's no way the iTunes App Store can 'offer the scope and variety of apps that a less controlled environment can provide.' Now there's a central marketplace where developers can sell iPhone-optimized apps without going through Apple's gatekeepers. Launched today, it's called OpenAppMkt and it's a showcase for mobile Web apps — not just the type seen back in 2007-2008, before the advent of the App Store, but also for new games and other apps developed using HTML5/CSS/JavaScript (in some cases, the same apps compiled and sold as native iPhone apps). Xconomy has a behind-the-scenes interview with OpenAppMkt's creators, who say they're not out to compete with the native App Store, but that developers deserve new ways to reach users."

Read more of this story at Slashdot.

schliz writes "Physicists have observed 'bizarre' behaviour in graphene electrons that they say could make the material even more suitable to replace silicon in future electronic devices. When strained in a particular manner, nanobubbles formed on a sheet of graphene, within which electrons came to occupy particular, quantum energy levels rather than the usual, continuous range of energies in unstrained graphene. By controlling electrons' energy levels, researchers could control how easily they moved through graphene — in effect, controlling their conductivity, optical, or microwave properties."

Read more of this story at Slashdot.

astroengine writes "Sure, we're looking 172 years into the future, but an international collaboration of scientists have developed two mathematical models to help predict when a potentially hazardous asteroid (or PHA) may hit us, not in this century, but the next. The rationale is that to stand any hope in deflecting a civilization-ending or extinction-level impact, we need as much time as possible to deal with the threatening space rock. (Asteroid deflection can be a time-consuming venture, after all.) Enter '(101955) 1999 RQ36' — an Apollo class, Earth-crossing, 500 meter-wide space rock. The prediction is that 1999 RQ36 has a 1-in-1,000 chance of hitting us in the future, and according to one of the study's scientists, María Eugenia Sansaturio, half of those odds fall squarely on the year 2182."

Read more of this story at Slashdot.

suraj.sun writes with this excerpt from Ars Technica: "If you need a reminder of just how big China is—and just how important the Internet has become there—consider this stat: between them, two Chinese ISPs serve 20 percent of all broadband subscribers in the entire world and both companies continue to grow, even as growth slows significantly in more developed markets. Every other ISP trails dramatically. Japan's NTT comes in third with 17 million subscribers, and all US providers are smaller still. 'The gap between the top two operators and the world's remaining broadband service providers will continue to grow rapidly,' said TeleGeography Research Director Tania Harvey. 'Aside from the two Chinese companies, all of the top ten broadband ISPs operate in mature markets, with high levels of broadband penetration and rapidly slowing subscriber growth.'"

Read more of this story at Slashdot.

thecarchik writes "The Porsche 918 Spyder hybrid supercar, first shown as a concept at this spring's Geneva Motor Show, got official approval as a production model today from the company's board of directors. Just consider the specs: a 500-horsepower, 3.6-liter V-8 engine with a 9200-rpm redline, 0-to-62-mph acceleration of 3.2 seconds, and top speed of 198 miles per hour. Oh, and did we mention it gets 78 miles per gallon on the European cycle? The astounding fuel efficiency comes courtesy of an E-Drive mode that lets the 918 Spyder drive up to 16 miles on pure electric power, though [ahem] not at 198 mph."

Read more of this story at Slashdot.

spidweb writes "One Indie developer has written a nuanced article on a how software piracy affects him, approaching the issue from the opposite direction. He lists the ways in which the widespread piracy of PC games helps him. From the article: 'You don't get everything you want in this world. You can get piles of cool stuff for free. Or you can be an honorable, ethical being. You don't get both. Most of the time. Because, when I'm being honest with myself, which happens sometimes, I have to admit that piracy is not an absolute evil. That I do get things out of it, even when I'm the one being ripped off.' The article also tries to find a middle ground between the Piracy-Is-Always-Bad and Piracy-Is-Just-Fine sides of the argument that might enable single-player PC games to continue to exist."

Read more of this story at Slashdot.