Forgot your password?
typodupeerror

Catch up on stories from the past week (and beyond) at the Slashdot story archive

Data Storage

Apple Disables Trim Support On 3rd Party SSDs In OS X 326

Posted by timothy
from the paying-more-for-the-exit-row dept.
MojoKid (1002251) writes One of the disadvantages to buying an Apple system is that it generally means less upgrade flexibility than a system from a traditional PC OEM. Over the last few years, Apple has introduced features and adopted standards that made using third-party hardware progressively more difficult. Now, with OS X 10.10 Yosemite, the company has taken another step down the path towards total vendor lock-in and effectively disabled support for third-party SSDs. We say "effectively" because while third-party SSDs will still work, they'll no longer perform the TRIM garbage collection command. Being able to perform TRIM and clean the SSD when it's sitting idle is vital to keeping the drive at maximum performance. Without it, an SSD's real world performance will steadily degrade over time. What Apple did with OS X 10.10 is introduce KEXT (Kernel EXTension) driver signing. KEXT signing means that at boot, the OS checks to ensure that all drivers are approved and enabled by Apple. It's conceptually similar to the device driver checks that Windows performs at boot. However, with OS X, if a third-party SSD is detected, the OS will detect that a non-approved SSD is in use, and Yosemite will refuse to load the appropriate TRIM-enabled driver.
GNOME

GTK+ Developers Call For Help To Finish Cross-Platform OpenGL Support 89

Posted by timothy
from the gears-spinning dept.
jones_supa writes OpenGL support under GTK is getting into good shape for providing a nice, out-of-the-box experience by default on key platforms for the GTK+ 3.16 / GNOME 3.16 release in March. For a few weeks now within mainline GTK+ has been native OpenGL support and as part of that a new GtkGLArea widget for allowing OpenGL drawing within GTK applications. Since that initial work landed, there's been more GTK+ OpenGL code progressing that right now primarily benefits Linux X11 and Wayland users. While good progress is being made and improvements still ongoing to the GNOME toolkit, GNOME developers are requesting help in ensuring other GTK+ backends can benefit from this OpenGL support. If you are using or planning to use GTK+ 3 on Windows or OS X, and you know how to use OpenGL on those two platforms, please consider helping out the GTK+ developers by implementing the GdkGLContext API using WGL and AppleGL.
IT

Ask Slashdot: Who's the Doctors Without Borders of Technology? 111

Posted by timothy
from the trespassers-mostly dept.
danspalding writes I'm transitioning into full time tech work after 10 years in education. To that end, after years of tooling around with command line and vim, I'm starting a programming bootcamp in early December. I used to think I wanted to go into ed tech. But the more I think about it, the more I just want to contribute to the most important work I can using my new skills — mostly JavaScript (with a strong interest in graph databases). Ideally an organization that does bold, direct humanitarian work for the people who need it most. So where should I apply to work when I finish bootcamp next March? Who's the MSF of the tech world?
Cellphones

Microsoft Aims To Offer Windows 10 Upgrades For All Windows Phone 8 Lumias 77

Posted by timothy
from the number-by-any-other-number dept.
An anonymous reader writes News suggesting that Microsoft plans to offer Windows 10 upgrades for all its Windows Phone 8 devices broke today. "It's our intention to enable a Windows 10 upgrade for Lumia Windows Phone 8 smartphones," a Microsoft spokesperson told VentureBeat. "At this early stage in the development process, and given the vast portfolio of Windows devices worldwide, we can't predict that all devices will be upgradeable, but it is our intention that the Lumia smartphone line be upgradeable to Windows 10."
Operating Systems

FreeBSD 10.1 Released 119

Posted by timothy
from the longstanding-contributions dept.
An anonymous reader writes Version 10.1 of the venerable FreeBSD operating system has been released. The new version of FreeBSD offers support for booting from UEFI, automated generation of OpenSSH keys, ZFS performance improvements, updated (and more secure) versions of OpenSSH and OpenSSL and hypervisor enhancements. FreeBSD 10.1 is an extended support release and will be supported through until January 1, 2017. Adds reader aojensen: As this is the second release of the stable/10 branch, it focuses on improving the stability and security of the 10.0-RELEASE, but also introduces a set of new features including: vt(4) a new console driver, support for FreeBSD/i386 guests on the bhyve hypervisor, support for SMP on armv6 kernels, UEFI boot support for amd64 architectures, support for the UDP-Lite protocol (RFC 3828) support on both IPv4 and IPv6, and much more. For a complete list of changes and new features, the release notes are also available.
Power

Facebook Testing Lithium-Ion Batteries For Backup Power 41

Posted by timothy
from the economies-of-web-scale dept.
itwbennett writes Facebook has just started testing lithium-ion batteries as the backup power source for its server racks and plans to roll them out widely next year. Lithium-ion has been too expensive until now, says Matt Corddry, Facebook's director of hardware engineering, but its use in electric cars has changed the economics. It's now more cost effective than the bulky, lead-acid batteries widely used in data centers today.
Communications

81% of Tor Users Can Be De-anonymized By Analysing Router Information 136

Posted by timothy
from the keep-him-on-the-line dept.
An anonymous reader writes A former researcher at Columbia University's Network Security Lab has conducted research since 2008 indicating that traffic flow software included in network routers, notably Cisco's 'Netflow' package, can be exploited to deanonymize 81.4% of Tor clients. Professor Sambuddho Chakravarty, currently researching Network Anonymity and Privacy at the Indraprastha Institute of Information Technology, uses a technique which injects a repeating traffic pattern into the TCP connection associated with an exit node, and then compares subsequent aberrations in network timing with the traffic flow records generated by Netflow (or equivalent packages from other router manufacturers) to individuate the 'victim' client. In laboratory conditions the success rate of this traffic analysis attack is 100%, with network noise and variations reducing efficiency to 81% in a live Tor environment. Chakravarty says: 'it is not even essential to be a global adversary to launch such traffic analysis attacks. A powerful, yet non- global adversary could use traffic analysis methods [] to determine the various relays participating in a Tor circuit and directly monitor the traffic entering the entry node of the victim connection.'
IOS

US Gov't Issues Alert About iOS "Masque Attack" Threat 98

Posted by timothy
from the that'll-teach-'em dept.
alphadogg writes Three days after security company FireEye warned of an iPhone/iPad threat dubbed "Masque Attack", the U.S. government has issued a warning of its own about this new risk by malicious third-party apps to Apple iOS devices. US-CERT warned: "This attack works by luring users to install an app from a source other than the iOS App Store or their organizations' provisioning system. In order for the attack to succeed, a user must install an untrusted app, such as one delivered through a phishing link." Revelations of Masque came on the heels of a related exploit (that also threatens Macs) called WireLurker.
Network

Ask Slashdot: Getting Around Terrible Geolocation? 100

Posted by timothy
from the ok-but-does-this-get-you-irish-citizenship? dept.
First time accepted submitter AvitarX writes W3C has the IP address where I work as showing up in Ireland (we are in the USA). This is a nuisance for a lot of reasons (many dates now display in European format, prices are listed in euros, search results redirect to google.ie). Some of these issues can be worked around, but it's frustrating. I have searched as best as I can, and only can find information on the geolocation API in HTML5. The office is on a static IP address from Comcast. When I visit whatismyipaddress.com all info is correct except for W3C's result. I have submitted that it is inaccurate; is there anything else I can do? Googling, I have only managed to find usage examples for web developers/designers.
Government

Internet Voting Hack Alters PDF Ballots In Transmission 147

Posted by timothy
from the don't-let-the-nice-man-borrow-your-router dept.
msm1267 (2804139) writes Threats to the integrity of Internet voting have been a major factor in keeping the practice to a bare minimum in the United States. On the heels of the recent midterm elections, researchers at Galois, a computer science research and development firm in Portland, Ore., sent another reminder to decision makers and voters that things still aren't where they should be. Researchers Daniel M. Zimmerman and Joseph R. Kiniry published a paper called 'Modifying an Off-the-Shelf Wireless Router for PDF Ballot Tampering' that explains an attack against common home routers that would allow a hacker to intercept a PDF ballot and use another technique to modify a ballot before sending it along to an election authority. The attack relies on a hacker first replacing the embedded Linux firmware running on a home router. Once a hacker is able to sit in the traffic stream, they will be able to intercept a ballot in traffic and modify code strings representing votes and candidates within the PDF to change the submitted votes.
Android

Nvidia Shield Tablet Gets Android Lollipop Update, Half Life 2 EP1 and GRID 58

Posted by timothy
from the oopmh-and-grace dept.
MojoKid writes Nvidia's Shield Tablet is only a few months old, but Nvidia is already updating the device with a freshly minted OS, a refreshed Shield Hub and access to the company's newly upgraded GRID Game Streaming service. A number of new Tegra K1 optimized games are arriving as well, as well as a new game bundle which includes Half Life 2 Episode 1. The SHIELD Tablet Android Lollipop update will feature Android's new "material design" interface and improved app performance, according to Nvidia. The update will also come preloaded with a new version of Nvidia's own Dabbler drawing and painting app (Dabbler 2.0). In addition to a new interface inspired by Lollipop's design language, Dabbler 2.0 will offer full support for layers and it'll allow users to share their sessions over Twitch. Previously, accessing the Nvidia's GRID beta meant streaming games from a GRID server cluster on the west coast, but Nvidia is expanding the service with server clusters located in Virginia, Europe and Asia. For the best possible user experience, streaming games from the cloud must incur minimal latency, and adding more servers in strategic locations not only affords Nvidia greater capacity, but minimizes latency as well. Nvidia says the GRID service will be available in North America this month, Western Europe in December and Asia sometime next year. The company's GRID service gives gamers access to 20 top titles currently, including Batman Arkham City, Borderlands 2 and Psychonauts, among others, and Nvidia is planning to add new games every week.
Network

Ask Slashdot: How To Unblock Email From My Comcast-Hosted Server? 405

Posted by timothy
from the why-not-hand-deliver-those-messages? dept.
New submitter hawkbug writes For the past 15 years, I have hosted my own email server at home and it's been pretty painless. I had always used a local Denver ISP on a single static IP. Approximately two years ago, I switched to a faster connection, which now is hosted on Comcast. They provide me 5 static IPs and much faster speeds. It's a business connection with no ports blocked, etc. It has been mostly fine these last two years, with the occasional outage due to typical Comcast issues. About two weeks ago, I came across a serious issue. The following email services started rejecting all email from my server: Hotmail, Yahoo, and Gmail. I checked, and my IP is not on any real time blacklists for spammers, and I don't have any security issues. My mail server is not set as an open relay, and I use SPF records and pass all SPF tests. It appears that all three of those major email services started rejecting email from me based on a single condition: Comcast. I can understand the desire to limit spam — but here is the big problem: I have no way to combat this. With Gmail, I can instruct users to flag my emails as "not spam" because the emails actually go through, but simply end up in the spam folder. Yahoo and Hotmail on the other hand, just flat out reject the traffic at lower level. They send rejection notices back to my server that contain "tips" on how to make sure I'm not an open relay, causing spam, etc. Since I am not doing any of those things, I would expect some sort of option to have my IP whitelisted or verified. However, I can not find a single option to do so. The part that bugs me is that this happened two weeks ago with multiple major email services. Obviously, they are getting anti-spam policies from a central location of some kind. I don't know where. If I did, I could possibly go after the source and try to get my IP whitelisted. When I ask my other tech friends what they would do, they simply suggest changing ISPs. Nobody likes Comcast, but I don't have a choice here. I'm two years into a three-year contract. So, moving is not an option. Is there anything I can do to remedy this situation?
Android

Popular Smartphones Hacked At Mobile Pwn2Own 2014 52

Posted by timothy
from the keep-it-in-a-faraday-cage dept.
wiredmikey writes Researchers have hacked several popular smartphones during the Mobile Pwn2Own 2014 competition that took place alongside the PacSec Applied Security Conference in Tokyo this week. The competition, organized by HP's Zero Day Initiative (ZDI) targeted the Amazon Fire Phone, iPhone 5s, iPad Mini, BlackBerry Z30, Google Nexus 5 and Nexus 7, Nokia Lumia 1520, and Samsung Galaxy S5. Using various attacks, some Mobile Pwn2Own 2014 Pwnage included: Apple's iPhone 5s (hacked via the Safari Web browser, achieving a full sandbox escape); Samsung's Galaxy S5 (hacked multiple times using near-field communications attacks); Amazon's Fire Phone (Web browser exploited); Windows Phone (partial hacks using a browser attack), andthe Nexus 5 (a Wi-Fi attack, which failed to elevate privileges). All the exploits were disclosed privately to the affected companies. HP promised to reveal details in the upcoming weeks.
United States

Senate May Vote On NSA Reform As Soon As Next Week 127

Posted by samzenpus
from the stop-looking-at-me dept.
apexcp writes Senate Majority Leader (for now) Harry Reid announced he will be taking the USA FREEDOM Act to a floor vote in the Senate as early as next week. While the bill, if passed, would be the first significant legislative reform of the NSA since 9/11, many of the act's initial supporters have since disavowed it, claiming that changes to its language mean it won't do enough to curb the abuses of the American surveillance state
China

US Weather System and Satellite Network Hacked 76

Posted by samzenpus
from the all-your-weather-are-belong-to-us dept.
mpicpp writes with this story about Chinese hackers breaching the federal weather network. "Hackers attacked the U.S. weather system in October, causing a disruption in satellite feeds and several pivotal websites. The National Oceanic and Atmospheric Administration, NOAA, said that four of its websites were hacked in recent weeks. To block the attackers, government officials were forced to shut down some of its services. This explains why satellite data was mysteriously cut off in October, as well as why the National Ice Center website and others were down for more than a week. During that time, federal officials merely stated a need for "unscheduled maintenance." Still, NOAA spokesman Scott Smullen insisted that the aftermath of the attack "did not prevent us from delivering forecasts to the public." Little more is publicly known about the attack, which was first revealed by The Washington Post. It's unclear what damage, if any, was caused by the hack. But hackers managed to penetrate what's considered one of the most vital aspects of the U.S. government. The nation's military, businesses and local governments all rely on nonstop reports from the U.S. weather service."
Data Storage

Data Center Study Reveals Top 5 SMART Stats That Correlate To Drive Failures 138

Posted by samzenpus
from the about-to-go dept.
Lucas123 writes Backblaze, which has taken to publishing data on hard drive failure rates in its data center, has just released data from a new study of nearly 40,000 spindles revealing what it said are the top 5 SMART (Self-Monitoring, Analysis and Reporting Technology) values that correlate most closely with impending drive failures. The study also revealed that many SMART values that one would innately consider related to drive failures, actually don't relate it it at all. Gleb Budman, CEO of Backblaze, said the problem is that the industry has created vendor specific values, so that a stat related to one drive and manufacturer may not relate to another. "SMART 1 might seem correlated to drive failure rates, but actually it's more of an indication that different drive vendors are using it themselves for different things," Budman said. "Seagate wants to track something, but only they know what that is. Western Digital uses SMART for something else — neither will tell you what it is."
The Internet

After Silk Road 2.0 Shutdown, Rival Dark Net Markets Grow Quickly 86

Posted by Soulskill
from the enjoy-the-calm-before-your-storm dept.
apexcp writes: A week ago, Silk Road 2.0 was theatrically shut down by a global cadre of law enforcement. This week, the dark net is realigning. "In the wake of the latest police action against online bazaars, the anonymous black market known as Evolution is now the biggest Dark Net market of all time. Today, Evolution features 20,221 products for sale, a 28.8 percent increase from just one month ago and an enormous 300 percent increase over the past six months."
Encryption

ISPs Removing Their Customers' Email Encryption 245

Posted by Soulskill
from the aggressively-anticonsumer dept.
Presto Vivace points out this troubling new report from the Electronic Frontier Foundation: Recently, Verizon was caught tampering with its customer's web requests to inject a tracking super-cookie. Another network-tampering threat to user safety has come to light from other providers: email encryption downgrade attacks. In recent months, researchers have reported ISPs in the U.S. and Thailand intercepting their customers' data to strip a security flag — called STARTTLS — from email traffic. The STARTTLS flag is an essential security and privacy protection used by an email server to request encryption when talking to another server or client.

By stripping out this flag, these ISPs prevent the email servers from successfully encrypting their conversation, and by default the servers will proceed to send email unencrypted. Some firewalls, including Cisco's PIX/ASA firewall do this in order to monitor for spam originating from within their network and prevent it from being sent. Unfortunately, this causes collateral damage: the sending server will proceed to transmit plaintext email over the public Internet, where it is subject to eavesdropping and interception.
Security

US Postal Service Suspends Telecommuting Following Massive Breach 50

Posted by Soulskill
from the you-can't-go-home-again dept.
An anonymous reader writes: The folks at the USPS have responded to the recent breach that exposed data on 800K employees and another some 2.8 million customers. They have suspended telecommuting for all employees until further notice while they replace their VPN with a more secure version. "Additionally, the postal service will upgrade some of its equipment and systems in the coming weeks and months as part of a broad security overhaul in response to the breach."
Security

First Victims of the Stuxnet Worm Revealed 39

Posted by Soulskill
from the patient-zero dept.
An anonymous reader writes: Analyzing more than 2,000 Stuxnet files collected over a two-year period, Kaspersky Lab can identify the first victims of the Stuxnet worm. Initially security researchers had no doubt that the whole attack had a targeted nature. The code of the Stuxnet worm looked professional and exclusive; there was evidence that extremely expensive zero-day vulnerabilities were used. However, it wasn't yet known what kind of organizations were attacked first and how the malware ultimately made it right through to the uranium enrichment centrifuges in the particular top secret facilities. Kaspersky Lab analysis sheds light on these questions.

The reason why worry kills more people than work is that more people worry than work.

Working...