×
Programming

Google Expands its Flutter Development Kit To Windows Apps (venturebeat.com) 41

Google has announced that Flutter, its open source UI development kit for building cross-platform software from the same codebase, is finally available for Windows apps in alpha. From a report:For the world's leading desktop operating system with some 1 billion installations of Windows 10 alone, this has been a long time coming. Flutter's alpha incarnation was initially launched at Google's I/O developer conference back in 2017, before arriving in beta less than a year later. In its original guise, Flutter was designed for Android and iOS app development, but it has since expanded to cover the web, MacOS, and Linux, which are currently available in various alpha or beta iterations. Developers have had to consider unique platform-specific factors when designing for the desktop or mobile phones, such as different screen sizes and how people interact with their devices. On smartphones, people typically use touch and swipe-based gestures, while keyboards and mice are commonly used on PCs and laptops. This means Flutter has had to expand its support to cover the additional inputs.
Education

Jeff Bezos Is Opening His First Tuition-Free Bezos Academy Preschool, Where Each Child 'Will Be the Customer' (thehill.com) 114

An anonymous reader quotes a report from The Hill: Amazon founder and CEO Jeff Bezos on Tuesday announced he's soon opening the first location of a network of tuition-free "Montessori-inspired" preschools for underserved children. In an Instagram post, Bezos said the first Bezos Academy will open in Des Moines, Wash., on Oct. 19. The network of schools will offer year-round programming, five days a week, for children between the ages of 3 and 5. Admissions will prioritize low-income families, according to the Bezos Day One Fund website.

"This classroom is just the beginning," Bezos wrote in a post featuring a photo of a preschool classroom. "The @bezosacademy opens its doors on Oct. 19th. This one in Des Moines, WA, is the first of many free preschools that we'll be opening for underserved children." The nonprofit organization says it wants to run the schools using the same set of principles that have driven e-commerce giant Amazon. "Most important among those will be genuine, intense customer obsession. The child will be the customer," the organization said on its website.

Education

Maybe CS Class Isn't the Best Way To Expose Most Kids To CS 78

Long-time Slashdot reader theodp writes: "If we want all students to learn computer science (CS for All), we have to go to where the students are," writes University of Michigan Grand Valley State University CS Professor Mark Guzdial. "Unfortunately, that's not computer science class. In most US states, less than 5% of high school students take a course in computer science.

"Programming is applicable and useful in many domains today, so one answer is to use programming in science, mathematics, social studies, and other non-CS classes. We take programming to where the students are, and hope to increase their interest and knowledge about CS."

America's National Science Foundation (NSF) was intrigued enough by this idea to fund Creating Adoptable Computing Education Integrated into Social Studies Classes, a three-year project created by Guzdial and Grand Valley State University history professor Tamara Shreiner, a project which "aims to provide more students computing education by integrating programming activities into social studies classes and to use the computing to enhance students' data literacy." Along the same lines, the NSF has also greenlighted Northwestern University's CS professor Marcelo Worsley's Computational Thinking and Physical Computing in Physical Education for this fall, which will bring computer science to K-5 gym classes.

While the tech giants have lobbied for billions in spending on "rigorous" K-12 CS courses, could it be that the best "CS class" for most K-12 students is no CS class?
Java

Oracle's Plan to Keep Java Developers from Leaving for Rust and Kotlin (zdnet.com) 90

ZDNet reports: Oracle has released version 15 of Java, the language created 25 years ago by James Gosling at Sun Microsystems, which Oracle snapped up in 2009 for about $7.4bn to gain what it said was the "most important software Oracle has ever acquired". Java 15, or Oracle Java Development Kit (JDK) 15, brings the Edwards-Curve digital signature algorithm, hidden classes, and former preview features that have been finalized, including text blocks, and the Z Garbage Collector, while the sealed-classes feature arrives and pattern matching and records emerge as a second preview...

In July, Java fell out of RedMonk's top two positions for the first time since 2012 and now resides behind JavaScript and Python in terms of popularity. Tiobe in September ranked Java in second position, behind C and ahead of Python.... But Java is still hugely popular and widely used in the enterprise, according to Oracle, which notes it is used by over 69% of full-time developers worldwide... It counts Arm, Amazon, IBM, Intel, NTT Data, Red Hat, SAP and Tencent among its list of notable contributors to JDK 15. Oracle also gave a special mention to Microsoft and cloud system monitoring service DataDog for fixes...

As part of Java's 25th anniversary, Oracle commissioned analyst firm Omdia to assess its six-month release strategy for Java and whether it would be enough to keep millions of Java developers away from memory-safe alternatives such as Kotlin, the language Google has endorsed for Android development, and Rust, a system programming language that was created at Mozilla. "In Omdia's opinion, the work Oracle began a few years ago in moving to a six-month update cycle and introducing a new level of modularity, puts the vendor in good stead with its constituency of approximately 12 million developers," Oracle said in its report on Omdia's analysis.

"However, Oracle and the Java programming language need an ongoing series of innovative, must-have, and 'delightful' features that make the language even more user friendly and cloud capable. These will keep existing Java developers happy while steering potential Java developers away from newer languages like Rust and Kotlin."

Microsoft

Microsoft Submits Linux Kernel Patches to Make Linux Run as Root Partition on Hyper-V (zdnet.com) 40

"Microsoft has submitted a series of patches to Linux kernel developers," reports ZDNet, "requesting that Linux run as the root partition on the Hyper-V, its hypervisor software for running Windows and non-Windows instances on hardware." Microsoft "wants to create a complete virtualization stack with Linux and Microsoft Hypervisor", according to Microsoft principle software engineer Wei Liu. Liu has proposed an RFC or request for comment that for now merely implements what are only the "absolutely necessary components to get things running... There will be a subsequent patch series to provide a device node (/dev/mshv) such that userspace programs can create and run virtual machines. We've also ported Cloud Hypervisor over and have been able to boot a Linux guest with Virtio devices since late July." Cloud Hypervisor is an experimental open-source hypervisor implementation from Intel written in the Rust programming language. It's a virtual-machine monitor that runs on top of KVM, the Kernel-based Virtual Machine hypervisor in the Linux kernel that's designed for cloud workloads...

Liu points out three more changes beyond amendments to the Hyper-V Top-Level Functional Specification. For example, Microsoft wants Linux to set up existing Hyper-V facilities differently. It also wants Linux kernel developers to change the kernel's behavior when accessing hardware memory in a way that affects driver access to the GPU and CPU that's being managed by an operating system memory manager. It's this issue that Microsoft engineers are least confident about and are asking for Linux developer support, according to Liu....

As Microsoft's executive VP of the cloud and enterprise group, Scott Guthrie, told ZDNet last year, Microsoft's shift to Linux and open source started over a decade ago when it open-sourced ASP.NET. "We recognized open source is something that every developer can benefit from. It's not nice, it's essential. It's not just code, it's community," explained Guthrie.

Movies

DC Universe Streaming Service Will Become Universe Infinite Comics Platform (cnet.com) 18

DC Universe, which started out as a streaming service for original DC superhero content, will in January become DC Universe Infinite, a supersized subscription service for DC Comics. CNET reports: The service launches on Jan. 21 for $7.99 per month, or $74.99 for a year-long subscription. DC says that subscribers will be able to read 24,000 comic book titles at launch, along with digital-first titles and access to exclusive fan events. Recently released titles featuring Batman, Superman, Wonder Woman and other DC mainstays will make their way onto the platform in digital format six months after the physical copies arrive in stores. Those who subscribe during the initial preorder run will receive a $10 voucher to the DC Shop on Feb. 1 -- and make that $25 if you lock in a year-long subscription.

The move comes as DC nestles in with HBO, with original DC programming making a home on the HBO Max streaming service. A third season of the Harley Quinn animated series starring Kaley Cuoco was just announced for the platform earlier today, with all seasons of the show now sitting as an HBO exclusive. [...] To that end, DC is extending its offer for DC Universe subscribers to add HBO Max membership for $4.99 per month. Fans can jump on that deal through the end of October.

IOS

Developers Frustrated at Apple for Just One Day's Notice To Submit Apps Ahead of iOS 14 Release Today (mashable.com) 31

While developers have had access to beta versions of the software updates since June, many were caught off guard by Apple's much shorter notice of the final releases. By comparison, Apple started accepting apps built for iOS 13 on September 10 last year, over one week before the software update was released on September 19. From a story yesterday: "I think a lot of developers won't be sleeping tonight or will instead just give up and opt to release [their app] when they want to, instead of alongside the new OS," said iOS developer Shihab Mehboob in a message. "Apple has seemingly out of the blue decided to surprise developers with no real warning or care." [...] "Without advance warning like this, nothing is ready," a developer at High Caffeine Content, Steve Troughton-Smith, told me. "Developers aren't ready, the App Store is't ready, and everybody is rushing to react instead of having the chance to finish their apps properly." Steve ran through the normal iOS release process with me. Apple usually gives third-party app developers a heads up of about a week before the official public release of a new iOS. The company puts out a "Golden Master" copy of the new iOS and Xcode developer tool before the latest operating system is officially released to the public. This gives iPhone app developers the time they need to make sure the apps they've been building for the beta releases of the new iOS actually work on the final version. Sometimes there are critical bugs that are only revealed or could only be fixed at this point in the process.

The extra time can also be used to add new features for any new devices announced at the Apple Event. Apple's approval process for apps also takes some time, so developers have that week to make sure they submit in time to guarantee their work will be in the App Store for the iOS release. "Gone are the hopes of being on the store by the time users install the new iOS 14 and are looking for new apps. Gone is the chance to get some last-minute fixes into your existing apps to make sure they don't stop working outright by the time users get to upgrade their OS," explained Steve. "There are some developers who have spent all summer working on something new, using the latest technologies, hoping to be there on day one and participate in the excitement (and press coverage) of the new iOS," he continued. "For many of them, they'll be incredibly upset to have it end like this instead of a triumphant launch, and it can dramatically decrease the amount of coverage or sales they receive."

Programming

Did You Know Today Is 'The Day of the Programmer'? (wikipedia.org) 62

Long-time Slashdot reader destinyland shares Wikipedia's entry reminding us that this year's "Day of the Programmer" falls on September 13: The Day of the Programmer is an international professional day that is celebrated on the 256th (hexadecimal 100th, or the 2**8th) day of each year (September 13 during common years and on September 12 in leap years). It is officially recognized in Russia.

The number 256 (2**8) was chosen because it is the number of distinct values that can be represented with a byte, a value well known to programmers...

In China, the programmer's day is October 24, which has been established for many years. The date was chosen because it can also be written as 1024, which is equal to 210. It is also consistent regardless of leap years.

The original submission suggests we celebrate with "this delightful acoustic version of Code Monkey, which songwriter Jonathan Coulton describes as "how it feels to write software for a living."

But did any Slashdot readers even know today was The Day of the Programmer?
Programming

C++ is About To Get a Huge Update (zdnet.com) 217

ZDNet reports: The International Organization for Standardization's (ISO) C++ group, Working Group 21 (WG21), has agreed upon the finalized version of 'C++20', the first major update to the 35 year-old programming language since C++17 from 2017... The 2020 release of C++ is huge by historical standards. Herb Sutter, a Microsoft engineer and long-time chair of WG21 C++ ISO committee, said it "will be C++'s largest release since C++11", meaning it's bigger than any of the past three releases, which happen every three years. It's also the first version that has been standardized....

Two of the most important features coming to C++20 are "modules" and "coroutines". Modules, which was led by Google's Richard Smith, stands in for header files and helps isolate the effects of macros while supporting larger builds. As Sutter noted recently, C++20 marks the "first time in about 35 years that C++ has added a new feature where users can define a named encapsulation boundary...."

Coroutines represents a generalization of a function. "Regular functions always start at the beginning and exit at the end, whereas coroutines can also suspend the execution to be resumed later at the point where they were left off," C++ contributors explain in a proposal for coroutines.

"We expect it to be formally published toward the end of 2020," Sutter said said in an announcement.

Interestingly, the year C++ was first released in 1985, Microsoft used it to build Windows 1.0, ZDNet points out. "These days Microsoft is exploring Mozilla-developed Rust to replace legacy Windows code written in C and C++ because of Rust's memory safety qualities."
Businesses

Apple Loosens App Store Rules That Hurt Streaming Games, Classes (bloomberg.com) 13

Apple adjusted its App Store review guidelines to loosen restrictions on iPhone and iPad games that stream directly from the internet and in-app purchase rules that have frustrated developers. From a report: The changes mean Apple will approve games that stream from the web, versus from content installed on a device, for the first time. That reverses a rule that frustrated companies including Microsoft. The new rules will still require games to be submitted individually. That means companies still won't be able to launch all-you-can-eat streaming game services on Apple's platform. However, these services can now offer a catalog that directs users to other streaming games from the same developer. But that catalog must point players to the App Store to download those other games individually. Apple is also no longer imposing its in-app purchase requirements on online teaching apps, such as tutoring or workout offerings.
China

In China, GitHub Is a Free Speech Zone for Covid Information (wired.com) 28

As coronavirus news was increasingly trapped behind the Great Firewall, the programming platform became a refuge from censorship. It may not last long. From a report: When the coronavirus first spread through China in January, Chinese PhD student Weilei Zeng watched the pandemic unfold online from his apartment in Riverside, California. Thousands of miles from home, he frantically tried to keep up with news of the crisis, following the rare outpouring of discontent that flooded Chinese social media: lockdown diaries penned by anxious patients; video footage of overcrowded hospitals; tributes to Li Wenliang, the young doctor who was reprimanded for "rumor-mongering" when he first warned the public about the virus (and would die of Covid-19 only a month later). Then, inevitably, as Chinese censors stepped in to scrub the internet clean, Zeng would return to a link he'd visited just a few days earlier to find only the familiar 404 error message -- indicating that the page had vanished. Zeng soon discovered that these posts were not gone. Many had been preserved and quietly tucked away in an unexpected corner of the internet: GitHub, the world's largest open source software site. Founded in 2008 and acquired by Microsoft in 2018, GitHub is popular among developers and programmers, who use the platform mostly to share and crowdsource code. Zeng often used it as a way to collaborate with his university peers on research projects. But after the pandemic hit, he stumbled on thousands of Chinese internet users repurposing GitHub as a Covid-19 archive, racing against censors to document the outbreak in the form of news articles, medical journals, and personal accounts.

One collaborative project, known as a "repository," was named #2020nCovMemory. Founded by seven volunteers from around the world, it included everything from investigative reports published by Chinese news magazine Caixin to the diary entries of Wuhan writer Fang Fang, who criticized the local government's suppression of information and initial failure to warn the public about the virus. Another repository, called Terminus2049 -- named after a planet in Isaac Asimov's Foundation series -- collected sensitive articles that were otherwise inaccessible behind China's Great Firewall, such as an interview with Ai Fen, the doctor who first discovered the virus in December. In February, Zeng joined a repository called 2020nCov_individual_archives, to crowdsource online diary entries and citizens' accounts of everyday life during the pandemic. "It made me feel much more at peace, knowing that these stories were being saved somewhere," Zeng says. On the Chinese internet, global social media platforms like Facebook and Twitter are banned, and domestic platforms like WeChat and Weibo are strictly monitored. But GitHub, known to some Chinese internet users as the "last land of free speech in China," remains accessible. Chinese authorities cannot censor individual projects, because GitHub uses the HTTPS protocol, which encrypts all traffic.

Businesses

Ten Years Ago, Epic Helped To Legitimize iOS as a Gaming Platform With a Small Demo (theverge.com) 46

An anonymous reader shares a report: On September 1st, 2010, Epic Games released its Citadel tech demo in the Apple App Store. It was a boring thing to actually play -- you simply walked around a medieval town in first-person perspective, taking in the sights with no objectives -- but this calm debut marked a big moment for iOS, the App Store, and Epic Games. It proved that developers could fit gigantic, richly detailed set pieces running on a smartphone and do it while utilizing Unreal Engine 3, the same engine that powered some of the most popular games in the Xbox 360 and PS3 era of consoles. The devices of choice, if you wanted to get access to mobile games with impressive graphics, were suddenly just the iPhone, iPad, and iPod touch. The Citadel demo didn't come to Android until almost two and a half years later in 2013.

The Citadel demo was groundbreaking at the time, and it possibly helped to kickstart the trend of bringing console-like experiences to the nascent mobile gaming platform. When I first saw it, I remember feeling like I immediately needed to throw my HTC Droid Eris out the window and buy an iPhone instead. I eventually got to try it out on an iPad at the gadget store where I was employed at the time, and it was stunning to see high-fidelity textures that had dimension and lighting that dynamically shifted when you walked into a building. There were even reflections at a certain point. I had played better-looking games on PC at that point, but something about the experience of being packed into a tiny device made for a magical proof of concept that left an impact on me, even as the fun of walking around Citadel lost its appeal. Ten years later, things are very different. Right now, Epic Games and Apple are in the midst of a high-profile legal battle that will likely have a serious impact on their relationship moving forward.

IOS

How App Developers Manipulate Your Mood To Boost Ranking? (ft.com) 41

Higher ratings are the 'lifeblood' of the smartphone app world but what if they are inflated? From a report: Rating an iPhone app takes just a second, maybe two. "Enjoying Skype?" a prompt will ask, and you click on a 1-5 star rating. Millions of people respond to these requests, giving little thought to their fleeting whim. Behind the scenes, though, an entire industry has spent countless hours and lines of code to craft this moment. The prompt, seemingly random, can be orchestrated to hit your glowing screen only at times when you are most likely to leave a five star review. Gaming apps will solicit a rating just after you reach a high score. Banking apps will ask when they know it's payday. Gambling apps will prompt users after they are dealt the perfect Blackjack hand. A sporting app will give the nudge only when a user's team is winning.

Apple has for a decade clamped down on "ratings farms" and "download bots" that companies use to fraudulently garner five-star scores and manipulate App Store rankings. And it has had some success. But these are blunt instruments trying to cheat the system in clear violation of Apple's rules. The more sophisticated techniques stay within the rules but draw on behavioural psychology to understand your mood, emotions and behaviour -- they are not hacking the system; they are hacking your brain. "The algorithms that are used are very hush-hush," says Saoud Khalifah, chief executive of Fakespot, a service that analyses the authenticity of reviews on the web. "They can target you when you are euphoric, when you have a lot of dopamine. They can use machine learning to determine [when] a user will be more inclined to leave positive reviews."

China

China Bans Scratch, MIT's Programming Language for Kids (techcrunch.com) 85

China's enthusiasm for teaching children to code is facing a new roadblock as organizations and students lose an essential tool: the Scratch programming language developed by the Lifelong Kindergarten Group at the MIT Media Lab. From a report: China-based internet users can no longer access Scratch's website. Greatfire.org, an organization that monitors internet censorship in China, shows that the website was 100% blocked as early as August 20, while a Scratch user flagged the ban on August 14. Nearly 60 million children around the world have used Scratch's visual programming language to make games, animations, stories and the likes. That includes students in China, which is seeing a gold rush to early coding as the country tries to turn its 200 million kids into world-class tech talents. At last count, 5.65% or 3 million of Scratch's registered users are based in China, though its reach is greater than the figure suggests as many Chinese developers have built derivatives based on Scratch, an open-source software.
Programming

'If Everyone Hates Object-Oriented Programming, Why Is It Still So Widely Spread?' (stackoverflow.blog) 386

Object-oriented programming "has been wildly successful. But was the success just a coincidence?" asks Stack Overflow's blog: Asking why so many widely-used languages are OOP might be mixing up cause and effect. Richard Feldman argues in his talk that it might just be coincidence. C++ was developed in the early 1980s by Bjarne Stroustrup, initially as a set of extensions to the C programming language. Building on C , C++ added object orientation but Feldman argues it became popular for the overall upgrade from C including type-safety and added support for automatic resource management, generic programming, and exception handling, among other features.

Then Java wanted to appeal to C++ programmers and doubled down on the OOP part. Ultimately, Sun Microsystems wanted to repeat the C++ trick by aiming for greatest familiarity for developers adopting Java. Millions of developers quickly moved to Java due to its exclusive integration in web browsers at the time. Seen this way, OOP seems to just be hitching a ride, rather than driving the success.

While acknowledging OOP cornerstones like encapsulation, inheritance, polymorphism, the article still takes a skeptical stance. "Seems like in 2020, there is not so much that OOP can do that other programming paradigms cannot, and a good programmer will use strategies from multiple paradigms together in the battle against complexity."
Programming

Survey Finds Only 3% of Ruby on Rails Developers Use Windows (rails-hosting.com) 71

This week saw the release of the 2020 Ruby on Rails Community Survey Results: 2,049 members of the Rails community from 92 countries kindly contributed their thoughts on tools, frameworks, and workflows in their day to day development lives. From these responses we hope to get an understanding of where Rails stands as a framework in 2020.

Some of these questions have been asked since our original survey over a decade ago, and show how the community has evolved over the last twelve years.
Inside.com's developer newsletter summarized some of the results: - The typical Rails developer is self-taught, has been working with Rails 4-7 years, and works remotely...

- Rails developers overwhelmingly choose lightweight solutions like jQuery over larger frameworks.

- Most of the developers surveyed feel Rails is still relevant, although they were split on whether or not the Rails core team is moving in the right direction, with 48% totally agreeing with that sentiment.

According to the results, 24% of survey respondents primarily developing on Linux, while 73% used Mac OS X (leaving just 3% using Windows or "Other"). Yet the most popular editor was Microsoft's Visual Studio Code (used by 32% of respondents), followed by Vim-based editors (21%), Sublime (16%), RubyMine (15%), Atom (9%), Emacs (3%), and TextMate (2%).

The survey also asked the size of development teams for "your primary Rails application."
  • A team of one - 17%
  • Two to four - 35%
  • Five to eight - 19%
  • Eight to 15 - 13%
  • 16 to 25 - 6%
  • 25-50 - 5%
  • 50-plus - 5%

Meanwhile, in a recent talk, Ruby creator Yukihiro Matsumoto confirmed that Ruby 3 will finally be released this Christmas, December 25, bringing a new pattern-matching syntax, right-hand-side variable assignment, and numbered block parameters.

He also promised improvements to help make Ruby more fast, more concurrent, and more correct. (Though "We don't pursue completeness nor soundness of the type systems, because, you know, Ruby is Ruby. Ruby is basically dynamically typed...")


Cloud

AWS Introduces a Rust Language-Oriented Linux for Containers (zdnet.com) 35

An anonymous reader shares this enthusiastic report from ZDNet: Earlier this year, Linus Torvalds approved of adding drivers and other components in Rust to Linux.* Last week, at the virtual Linux Plumbers Conference, developers gave serious thought to using the Rust language for new Linux inline code. ["Nothing firm has been determined yet," reported Phoronix, "but it's a topic that is still being discussed."] And, now Amazon Web Services (AWS) has announced that its just-released Bottlerocket Linux for containers is largely written in Rust.

Mozilla may have cut back on Rust's funding, but with Linux embracing Rust, after almost 30-years of nothing but C, Rust's future is assured. Rust was chosen because it lends itself more easily to writing secure software. Samartha Chandrashekar, an AWS Product Manager, said it "helps ensure thread safety and prevent memory-related errors, such as buffer overflows that can lead to security vulnerabilities." Many other developers agree with Chandrashekar.

Bottlerocket also improved its security by using Device-mapper's verity target. This is a Linux kernel feature that provides integrity checking to help prevent attackers from overwriting core system software or other rootkit type attacks. It also includes the extended Berkeley Packet Filter (eBPF), In Linux, eBPF is used for safe and efficient kernel function monitoring.

* Linus's exact words were "people are actively looking at, especially doing drivers and things that are not very central to the kernel itself, and having interfaces to do those, for example, in Rust. People have been looking at that for years now. I'm convinced it's going to happen one day."

The article also reminds readers that AWS's Bottlerocket "is also designed to be quick and easy to maintain... by including the bare essentials needed to run containers..."

"Besides its standard open-source elements, such as the Linux kernel and containerd container runtime, Bottlerocket's own code is licensed under your choice of either the Apache 2.0 or the MIT license."
Security

A Single Text Is All It Took To Unleash Code-Execution Worm In Cisco Jabber (arstechnica.com) 12

Until Wednesday, a single text message sent through Cisco's Jabber collaboration application was all it took to touch off a self-replicating attack that would spread malware from one Windows user to another, researchers who developed the exploit said. Ars Technica reports: The wormable attack was the result of several flaws, which Cisco patched on Wednesday, in the Chromium Embedded Framework that forms the foundation of the Jabber client. A filter that's designed to block potentially malicious content in incoming messages failed to scrutinize code that invoked a programming interface known as "onanimationstart." But even then, the filter still blocked content that contained , an HTML tag that had to be included in a malicious payload. To bypass that protection, the researchers used code that was tailored to a built-in animation component called spinner-grow. With that, the researchers were able to achieve a cross-site scripting exploit that injected a malicious payload directly into the internals of the browser built into Jabber.

A security sandbox built into the Chromium Embedded Framework, or CEF, would normally store the payload in a container that's isolated from sensitive parts of the app. To work around this constraint, the researchers abused the window.CallCppFunction, which is designed to open files sent by other Cisco Jabber users. By manipulating a function parameter that accepts files, the researchers were able to break out of the sandbox. "Since Cisco Jabber supports file transfers, an attacker can initiate a file transfer containing a malicious .exe file and force the victim to accept it using an XSS attack," researchers from security firm Watchcom Security wrote in a post. "The attacker can then trigger a call to window.CallCppFunction, causing the malicious file to be executed on the victim's machine." Accordingly, CVE-2020-3495, the designation assigned to the Cisco Jabber vulnerability, has a severity rating of 9.9 out of a maximum 10 based on the Common Vulnerability Scoring System. Cisco's advisory has more details here.

Education

Slashdot Asks: Favorite YouTube Channels For Web Development and Programming? (devandgear.com) 48

Dev & Gear created a long list of YouTube channels that offer technical videos to help you learn web development from scratch or just improve your skills. Some of the channels listed include: LearnCode.academy, Dev Ed, Traversy Media, Codecourse, and Wes Bos.

Is your favorite YouTube channel for web development and programming included on the list? If not, let us know what it is in a comment.
Programming

Psychology Today: How Programmers Can Avoid Burnout (psychologytoday.com) 61

An anonymous reader quotes Psychology Today: While software development jobs sound great right out of the gate, technology roles don't always offer a great career path. The entry-level salary is fantastic, and the job is fun. But five years on, the average developer reaches a senior role, and there aren't many more rungs on the technology career ladder. An article from 1998 in the New York Times reported that six years after finishing college, only 57 percent of computer science graduates were working as programmers. After 20 years, the figure dropped to 19 percent. In contrast, the figures for civil engineering were 61 percent and 52 percent...

It's not just about the money — it's at least as much about the control you have over what you do. And software developers these days have little say in what apps they build. "More than anything, what bothered me is the feeling that my work doesn't matter one way or another," said one of my friends before he quit his programming job. He continued, "You get into software thinking you'll build cool things, but instead, it's about jumping through hoops for business school people with bad ideas."

Rapid changes in technology make programming one of the fastest-moving careers. Avoiding burnout is the only way to have a long and sustainable career in tech. Veteran software developers often recommend to:

- Work at a place where you can grow. Constantly learning new things is a requirement in tech, but it's only sustainable if you can do it as part of the job.

- Build transferable skills. Many developers find it interesting to invest in learning leadership skills and explore technical management roles — those don't change as often as programming languages do.

- Have creative outlets and create a space to focus on yourself, to switch off and relax. Make sure you move enough, eat well, and spend quality time with friends and family.

Of course, there's always the nuclear option: make your money and get out.

Slashdot Top Deals