Android Leftovers

• What are the Spectre and Meltdown bugs affecting Apple and Android devices, is there a patch and are you at risk from hackers?

• Acer's new Chromebook 11 has USB-C and Android app support, starts at $249

• Google is also running customer surveys inside Android Messages — and not just on Pixels

• Antivirus apps for Android: Worthwhile or does caution suffice?

Chrome and Mozilla (Robert O'Callahan Unlocks Secrets)

• Robert O'Callahan: Ancient Browser-Wars History: MD5-Hashed Posts Declassified

  Another lesson: in 2007-2008 I was overly focused on toppling IE (and Flash and WPF), and thought having all the open-source browsers sharing a single engine implementation wouldn't be a big problem for the Web. I've changed my mind completely; the more code engines share, the more de facto standardization of bugs we would see, so having genuinely separate implementations is very important. I'm very grateful to Brendan and others for disregarding my opinions and not letting me lead Mozilla down the wrong path. It would have been a disaster for everyone. To let off steam, and leave a paper trail for the future, I wrote four blog posts during 2007-2008 describing some of my thoughts, and published their MD5 hashes. The aftermath of the successful Firefox 57 release seems like an appropriate time to harmlessly declassify those posts. Please keep in mind that my opinions have changed.

• On Keeping Secrets

  Once upon a time I was at a dinner at a computer science conference. At that time the existence of Chrome was a deeply guarded secret; I knew of it, but I was sworn to secrecy. Out of the blue, one of my dinner companions turned to me and asked "is Google working on a browser?" [...] One thing I really enjoyed about working at Mozilla was that we didn't have many secrets to keep. Most of the secrets I had to protect were about other companies. Minimizing one's secrecy burden generally seems like a good idea, although I can't eliminate it because it's often helpful to other people for them to be able to share secrets with me in confidence.

• Chrome is turning into the new Internet Explorer 6

   

  Chrome, in other words, is being used in the same way that Internet Explorer 6 was back in the day — with web developers primarily optimizing for Chrome and tweaking for rivals later. To understand how we even got to this stage, here’s a little (a lot) of browser history. If you want to know why saying "Chrome is the new Internet Explorer 6" is so damning, you have to know why IE6 was a damnable problem in the early ‘00s.

Security: Meltdown & Spectre, Critical CSRF Security Vulnerability, OpenVPN and More

• Meltdown & Spectre

• Meltdown and Spectre Linux Kernel Status

  By now, everyone knows that something “big” just got announced regarding computer security. Heck, when the Daily Mail does a report on it , you know something is bad… Anyway, I’m not going to go into the details about the problems being reported, other than to point you at the wonderfully written Project Zero paper on the issues involved here. They should just give out the 2018 Pwnie award right now, it’s that amazingly good. If you do want technical details for how we are resolving those issues in the kernel, see the always awesome lwn.net writeup for the details. Also, here’s a good summary of lots of other postings that includes announcements from various vendors.

• Spectre and Meltdown: What you need to know going forward

  As you've likely heard by now, there are some problems with Intel, AMD, and ARM processors. Called Meltdown and Spectre, the discovered attack possibilities are rather severe, as they impact pretty much every technical device on the network or in your house (PCs, laptops, tablets, phones, etc.). Here's a breakdown of all the things you need to know. As things change, or new information becomes available, this article will be updated. The key thing to remember is not to panic, as the sky isn't about to come crashing down. The situation is one that centers on information disclosure, not code execution (a far more damning issue to deal with).

• Open Source Leaders: Take Intel to Task

  I do not know Linus Torvalds or Theo de Raadt. I have never met either of them and have read very little about them. What I do know, gleaned from email archives, is when it comes to bum hardware: they both have pretty strong opinions. Both Linus and Theo can be a bit rough around the edges when it comes to giving their thoughts about hardware design flaws: but at least they have a voice. Also, Linus and Theo have often been at odds whether it be about how to approach OS design, licensing etc but I suspect, or I at least have to believe, the latest incident from intel (the Spectre and Meltdown flaws) is one area they agree on. Linus and Theo cannot possibly be the only Open Source leaders out there who are frustrated and tired of being jerked around by intel. What I hope comes out of this is not many different voices saying the same thing here and there but instead, perhaps, our various leaders could get together and take intel to task on this issue. Intel not only created a horrible design flaw they lied by omission about it for several months. During those months the Intel CEO quietly dumped his stock. What a hero.

• Docker Performance With KPTI Page Table Isolation Patches

  Overall most of our benchmarks this week of the new Linux Kernel Page Table Isolation (KPTI) patches coming as a result of the Meltdown vulnerability have showed minimal impact overall on system performance. The exceptions have obviously been with workloads having high kernel interactions like demanding I/O cases and in terms of real-world impact, databases. But when testing VMs there's been some minor impact more broadly than bare metal testing and also Wine performance has been impacted. The latest having been benchmarked is seeing if the Docker performance has been impacted by the KPTI patches to see if it's any significant impact since overall the patched system overhead certainly isn't anything close to how it was initially hyped by some other media outlets.

• Can We Replace Intel x86 With an Open Source Chip?

• Critical CSRF Security Vulnerability in phpMyAdmin Database Tool Patched

  A "cross site request forgery" vulnerability in a popular tool for administrating MySQL and MariaDB databases that could lead to data loss has been patched.

• 8 reasons to replace your VPN client with OpenVPN

  OpenVPN could be the answer. It's an ultra-configurable open source VPN client which works with just about any VPN provider that supports the OpenVPN protocol. It gives you new ways to automate, optimize, control and troubleshoot your connections, and you can use it alongside your existing client, or maybe replace it entirely – it's your call.

• I’m harvesting credit card numbers and passwords from your site. Here’s how.

Tux Machines is proud to be hosted by