Technology News, Analysis, Comments and Product Reviews for IT Professionals

Former Mozilla exec : Google has sabotaged Firefox for years | ZDNET
▻https://www.zdnet.com/article/former-mozilla-exec-google-has-sabotaged-firefox-for-years

A former high-ranking Mozilla executive has accused Google of intentionally and systematically sabotaging Firefox over the past decade in order to boost Chrome’s adoption.

Cet article ressort suite à ça :

▻https://news.ycombinator.com/item?id=38345858

From reddit discussion (▻https://www.reddit.com/r/firefox/comments/17ywbjj/comment/k9...):
> To clarify it more, it’s simply this code in their polymer script link:
> setTimeout(function() { c(); a.resolve(1) }, 5E3);
> which doesn’t do anything except making you wait 5s (5E3 = 5000ms = 5s).

Ca dit aussi :

As far as I understand, this code is a part of the anti-adblocker code that (slowly) constructs an HTML fragment

Puis aussi :

Why is it only trying to detect ads when the user agent is Firefox?

Bref, c’est tout chaud, et ça rentre à priori dans la lutte anti-adblockers, avec effets collatéraux malheureux.

Google Cloud, AWS, and Cloudflare report largest DDoS attacks ever | ZDNET
▻https://www.zdnet.com/article/google-cloud-aws-and-cloudflare-report-largest-ddos-attacks-ever

The Google Cloud was hit by the largest DDoS attack in history this past August, with the digital onslaught peaking at an unprecedented 398 million requests per second (RPS). How big is that? According to Google, in two minutes, the Google Cloud was slammed by more RPS than Wikipedia saw in all of September 2023.

Linus Torvalds: Rust will go into Linux 6.1 | ZDNET
▻https://www.zdnet.com/article/linus-torvalds-rust-will-go-into-linux-6-1

The Rust programming language entering the Linux kernel has been coming for some time. At the 2020 Linux Plumbers Conference, developers started considering using the Rust language for new Linux inline code. Google, which supports Rust for developing Android — itself a Linux distro — began pushing for Rust in the Linux kernel in April 2021.

Quantum Computing | ZDNET
▻https://www.zdnet.com/topic/quantum-computing

https://www.zdnet.com/a/fly/bundles/zdnetcore/images/logos/zdnet-logo-yellow.png

Microsoft analysed how the working day has changed. You might not like what it discovered | ZDNet
▻https://www.zdnet.com/article/microsoft-reveals-how-your-working-day-has-changed-you-might-not-like-it
▻https://www.zdnet.com/a/img/resize/4d12fb0e9d6059a98b0ac1e9d82dbdba63cd38b5/2020/10/06/0633ea14-706c-4095-a605-9441333bbb23/remote-work.jpg?width=770&height=578&fit=crop&auto=webp

Microsoft has been analyzing work patterns among its employees who are working from home and what they’re experiencing with more flexible hours. One indicator of change is that when the pandemic began, meetings on Microsoft Teams were happening more frequently after 5pm, most often between 6pm and 8pm at night, according to Microsoft, which recently published its second annual Work Trend Index report.

The company’s data suggests that 9-to-5 is over and that meetings outside of previous norms are now common, creating a third peak of activity at night for some. Microsoft researchers call it the “triple peak day”.

“Traditionally, knowledge workers had two productivity peaks in their workday: before lunch and after lunch. But when the pandemic sent so many people into work-from-home mode, a third peak emerged for some in the hours before bedtime,” Microsoft notes in a blogpost.

The finding will likely not surprise parents who work and manage children after picking them up from school in the afternoon.

Microsoft found that 30 percent of its employees worked more at night based on “keyboard events”. That slight uptick in keyboard activity was much lower than traditional work peaks around 10am and 3pm, but around 10pm there is a spike.

#Travail #Télétravail #Microsoft

Cet article signalé en 2011 par @fil: Why is Chrome so important to Google? It’s a ’locked-in user’
▻https://www.zdnet.com/article/why-is-chrome-so-important-to-google-its-a-locked-in-user

Boil those comments down and the Chrome returns look something like this:

– A Chrome user can contribute to a feedback loop that improves search quality.
– A Chrome user will use Google extensively with little to no slippage.
– Google can spend less on traffic acquisition costs.
– The company doesn’t have to spend as much on distribution---think the fees for the Firefox search bar.
– And this locked-in Google user is more likely to increase engagement as the company adds Chrome apps and social features down the line.

By the way, Chrome also gives Google a hand in browser standards, but that ROI seems decidedly naive when you consider the lifetime value of Chrome user.

Hacker modified drinking water chemical levels in a US city | ZDNet
▻https://www.zdnet.com/article/hacker-modified-drinking-water-chemical-levels-in-a-us-city

https://zdnet3.cbsistatic.com/hub/i/r/2021/02/08/d5afc40a-d112-4995-891b-332212950ec6/thumbnail/770x578/7822b56ac405a8b91515b366c589077d/water-tap.jpg

An unidentified hacker has accessed the computer systems for the water treatment facility in the city of Oldsmar, Florida, and has modified chemical levels to dangerous parameters.

News of the attack was disclosed today in a press conference by city officials.

The intrusion took place on Friday, February 5, when the hacker accessed a computer system that was set up to allow for the remote control of water treatment operations.

The hacker first accessed this system at 8 am, in the morning, and then again for a second and more prolonged intrusion at 1:30 pm, in the afternoon.

This second intrusion lasted for about five minutes and was detected right away by an operator who was monitoring the system and saw the hacker move the mouse cursor on the screen and access software responsible for water treatment.
Hacker modified lye levels

“Sodium hydroxide, also known as lye, is the main ingredient in liquid drain cleaners. It’s also used to control water acidity and remove metals from drinking water in the water treatment plant,” said Oldsmar Sheriff Bob Gualtieri.

“The hacker changed the sodium hydroxide from about 100 parts per million to 11,100 parts per million. This is obviously a significant and potentially dangerous increase.”

Oldsmar city staff said that no tainted water was delivered to local residents as the attack was caught in time before any lye levels could be deployed.

According to Sheriff Gualtieri, the hacker disconnected as soon as they modified the lye levels, and a human operator set the chemical level back to normal right away.

Officials didn’t attribute the attack to any specific hacker group or entity. The timing of the attack is also of note as the city of Oldsmar is located near the Tampa urban center, which hosted the Super Bowl LV game on Sunday.
Not the first time

This is the second incident of its kind where a hacker has accessed a water treatment facility and modified chemical levels.

A similar incident was reported back in 2015-2016 at an unnamed water treatment facility, but investigators said the intruders didn’t seem to know what they were doing, making random changes, and investigators classified the intrusion as an accident rather than an intentional attack.

Another set of attacks took place earlier this year, but without as dire consequences. In the spring and summer of 2020, Israeli officials reported attacks against local water treatment facilities, water pumps, and agricultural irrigation systems.

Tel Aviv officials, which blamed the attacks on the Iranian government, said hackers tried to access the management panels of several types of smart water management systems and asked local organizations to change their passwords.

None of the attacks were successful, officials and local media reported at the time.

#Cyber_terrorisme #Eau #Société_du_risque

I looked at all the ways Microsoft Teams tracks users and my head is spinning
▻https://www.zdnet.com/article/i-looked-at-all-the-ways-microsoft-teams-tracks-users-and-my-head-is-spinning

Microsoft Teams isn’t just there to make employees’ lives easier. It’s also there to give bosses data about so many things. My head is recovering from something of a pivot. You see, a couple of weeks ago Microsoft CEO Satya Nadella declared, in an interview with the Financial Times, that Teams could soon be a digital platform as important as the internet browser. Yes, Microsoft Teams. This startled me a touch. The world seems to have moved rather quickly of late. I thought of all those (...)

#Microsoft #ProductivityScore #Windows #données #écoutes #surveillance #travail

https://zdnet3.cbsistatic.com/hub/i/r/2020/05/20/96f0d97b-40cb-4907-bd1e-8220d7f831ee/thumbnail/770x578/a94b212299ab55842b23476999ce4f13/teams1.jpg

Singapore police can access COVID-19 contact tracing data for criminal investigations
▻https://www.zdnet.com/article/singapore-police-can-access-covid-19-contact-tracing-data-for-criminal-invest

Under the country’s Criminal Procedure Code, the Singapore Police Force can obtain any data — including information gathered by the contact tracing TraceTogether app and wearable token — to facilitate criminal probes, confirms cabinet minister. Singapore has confirmed its law enforcers will be able to access the country’s COVID-19 contact tracing data to aid in their criminal investigations. To date, more than 4.2 million residents or 78% of the local population have adopted the TraceTogether (...)

#algorithme #TraceTogether #contactTracing #criminalité #police #données #COVID-19 (...)

##criminalité ##santé

https://zdnet3.cbsistatic.com/hub/i/r/2020/09/09/9dae7709-c6c3-4ea9-a580-498047810759/thumbnail/770x578/9e90a173f788f5b04b9bf19c5c6dd274/tracetogether-token-singapore.png

GitHub reinstates youtube-dl library after EFF intervention | ZDNet
▻https://www.zdnet.com/article/github-reinstates-youtube-dl-library-after-eff-intervention

https://zdnet1.cbsistatic.com/hub/i/r/2020/10/23/8eea8209-8f7a-4e55-8a44-96c994256d75/thumbnail/770x578/011a963a1b2a7cfbf6a9effea2aa43d6/github-dmcaa.png

GitHub has reinstated today the youtube-dl open-source project, a Python library that lets users download the source audio and video files behind YouTube videos.

GitHub, a code-hosting repository, had previously removed the library from its portal after it received a controversial DMCA takedown request from the Recording Industry Association of America (RIAA) on October 23.

In a DMCA takedown letter, RIAA argued that the library was being used to “circumvent the technological protection measures used by authorized streaming services such as YouTube” and to allow users to “reproduce and distribute music videos and sound recordings [...] without authorization.”

RIAA also noted that the project’s source code “expressly suggests its use to copy and/or distribute the following copyrighted works.”

More specifically, RIAA used Section 1201 of the Digital Millennium Copyright Act (DMCA) to claim that the youtube-dl library was breaking copyright by providing a tool to circumvent copyrighted material — even if the youtube-dl library didn’t contain copyright-infringing code itself.
Project reinstated after EFF letter

But in a blog post today, GitHub said the library did not actually break Section 1201 of the DMCA, citing a letter it received from Electronic Frontier Foundation lawyers, who to take up the youtube-dl project’s case.

In the letter, the EFF team explained that Google does not have any technical measures in place to prevent the download of its videos — all of which need to be made freely available to all kinds of apps, browsers, smart TVs, and more.

Hence, EFF lawyers argued that the library could never be taken down under Section 1201 of the DMCA since the library doesn’t actually circumvent any sort of copyright protection system in the first place.
GitHub establishes a developer defense fund

The entire youtube-dl case caught the eye of the entire open-source community ever since GitHub’s October enforcement. Many developers and legal experts felt that RIAA had abused the DMCA mechanism to take down a perfectly legitimate tool.

In an editorial, the Freedom of the Press Foundation argued that the library had many legitimate use cases, with the library being an essential tool for developers, journalists, and internet archivists alike.

The open-source community protested GitHub’s decision by re-uploading the library hundreds of times on the site and even used bugs in the GitHub platform to append the youtube-dl source code to the actual RIAA’s takedown notice.

GitHub got egg on its face after it had to enforce the DMCA takedown, going as far as warning users that they risk having their accounts banned by its automated systems if they continue re-uploading the code on the site.

But GitHub Senior Manager of Policy Abby Vollmer said today that GitHub had no choice and had to follow the law. Nonetheless, the entire youtube-dl takedown disaster has been a learning opportunity for the company.

Vollmer said that GitHub has decided to establish a $1 million “developer defense fund” that the company plans to use to protect developers against “unwarranted DMCA Section 1201 takedown claims.”

“Developers who want to push back against unwarranted takedowns may face the risk of taking on personal liability and legal defense costs. To help them, GitHub will establish and donate $1M to a developer defense fund to help protect open source developers on GitHub from unwarranted DMCA Section 1201 takedown claims,” Vollmer said.

Furthermore, Vollmer said GitHub will also hire technical and legal experts, along with independent specialists, who will from now on review all DMCA Section 1201 takedown claims going forward to ensure they’re compliant with the DMCA and to protect open-source developers from needless litigation.

“All of this will be done at our own cost and at no cost to the developers who use GitHub. We believe this represents the gold standard in developer-first 1201 claims handling,” Vollmer added.

#Open_source #DMCA #Youtube-dl

#ýoutube-dl est un logiciel libre permettant de télécharger des vidéos depuis plusieurs plateformes de distribution (pas seulement #YouTube). Il était distribué à partir de la plateforme de développement de logiciels #GitHub (le Facebook des geeks), propriété de #Microsoft. Il vient d’être retiré, sans discussion et sans possibilité pour l’auteur de se défendre (à la cow-boy, comme souvent aux États-Unis) suite à une demande #DMCA de la #RIAA, le lobby d’Hollywood.

L’ancien dépôt : ►https://github.com/ytdl-org/youtube-dl

La lettre de la RIAA : ▻https://github.com/github/dmca/blob/master/2020/10/2020-10-23-RIAA.md

L’article de TechCrunch : ▻https://techcrunch.com/2020/10/23/the-riaa-is-coming-for-the-youtube-downloaders

Celui de ZDnet : ▻https://www.zdnet.com/article/riaa-blitz-takes-down-18-github-projects-used-for-downloading-youtube-videos

Un miroir (assez chargé en ce moment mais je pense que d’autres apparaitront) : ▻https://git.rip/mirror/youtube-dl

#copyrightMadness #appropriationIntellectuelle

Hier, dimanche 30 août vers 10:00 h UTC, l’opérateur Internet #Level3 (désormais racheté par #CenturyLink mais l’ancien nom reste connu) a connu une panne sérieuse. (Une des premières alertes publiques était ▻https://twitter.com/g_bonfiglio/status/1300022993251446785). Compte-tenu de l’importance de Level3/CenturyLink, un des plus gros Tier1 (ces opérateurs Internet qui n’achètent pas de transit, car ils sont présents partout et s’appairent entre eux), cela a affecté beaucoup de gens sur l’Internet. Plein de signalements d’injoignabilité.

Le problème a surtout affecté la vieille version du protocole Internet, IPv4. Souvent la version actuelle, IPv6, elle, marchait.

La panne a d’abord été atténuée par la décision de nombreux opérateurs de couper leurs sessions #BGP avec Level3/CenturyLink), entre 11:00 et 13:00 h UTC. (Cela ne résolvait évidemment rien pour les gens qui n’étaient connectés que via CenturyLink et, de toute façon, les routeurs de Level3 ont continué à annoncer des routes pour des sessions coupées !) Puis Level3/CenturyLink a réparé vers 15:00 h UTC. Il était d’autant plus difficile de faire une réponse coordonnée que certains étaient déconnectés. Mais les autres Tier1 ont pu s’arranger via IRC, qui ne dépend pas de services centralisés contrairement aux outils appréciés du marketing. ▻https://twitter.com/JobSnijders/status/1300068892719697920

Il paraitrait que ce serait la faute de #FlowSpec (cf. ►https://www.bortzmeyer.org/5575.html) mais rien n’est sûr à l’heure actuelle. ▻https://puck.nether.net/pipermail/outages/2020-August/013229.html et ▻https://twitter.com/acontios_net/status/1300695692357271553/photo/1 (la description complète du problème par CenturyLink n’est pas publique, elle n’est envoyée qu’aux clients, certains l’ont fait suivre).

Attention, compte tenu du caractère très visible de la panne, il a pu être tentant pour certains de tout lui attribuer. C’est ce qu’a fait #Telefoot ▻https://twitter.com/telefoothelp/status/1300084662602211328 alors qu’il n’est pas sûr qu’il y ait un rapport.

Cloudflare ▻https://blog.cloudflare.com/analysis-of-todays-centurylink-level-3-outage et Qrator ▻https://radar.qrator.net/blog/another-centurylink-bgp-incident ont écrit des excellents articles techniques à ce sujet. Pour l’activité #BGP anormale que cite Cloudflare, on peut aussi regarder ce qu’a vu RIPE Stat : ▻https://stat.ripe.net/widget/bgp-update-activity#w.starttime=2020-08-16T21%3A00%3A00&w.endtime=2020-08

#CenturyLinkOutage #CenturyLinkDown

Linux team approves new terminology, bans terms like ’blacklist’ and ’slave’ | ZDNet
▻https://www.zdnet.com/article/linux-team-approves-new-terminology-bans-terms-like-blacklist-and-slave

https://zdnet4.cbsistatic.com/hub/i/r/2019/04/16/df9ecfb3-cdb2-454d-9f4f-75e6cd5e607f/thumbnail/770x578/8078fdabc55ac832125f2f6dd4eb512a/the-linux-desktop-is-in-trouble-5cb48113bd785600b9e68b77-1-apr-16-2019-15-33-38-poster.jpg

Going forward, Linux developers have been asked to use new terms for the master/slave and blacklist/whitelist terminologies.

Proposed alternatives for master/slave include:

primary/secondary
main/replica or subordinate
initiator/target
requester/responder
controller/device
host/worker or proxy
leader/follower
director/performer

Proposed alternatives for blacklist/whitelist include:

denylist/allowlist
blocklist/passlist

The Linux team did not recommend any specific terms but asked developers to choose as appropriate.

The new terms are to be used for new source code written for the Linux kernel and its associated documentation.

The older terms, considered inadequate now, will only be allowed for maintaining older code and documentation, or “when updating code for an existing (as of 2020) hardware or protocol specification that mandates those terms.”

The move to phase out the master/slave and blacklist/whitelist terminologies came after a proposal filed by Linux kernel maintainer Dan Williams on July 4. Linux creator Linus Torvalds approved the proposal on Friday in a pull request for the Linux 5.8 repository.

#Linux #Language #Racisme_systémique #Antiracisme

À propos de la grande panne des applications sur iOS (le système d’exploitation d’Apple pour ses gadgets très chers) aujourd’hui :

Bonne synthèse en anglais sur ZDnet : ▻https://www.zdnet.com/article/facebook-fixes-bug-that-crashed-major-ios-apps-like-tiktok-spotify-and-tinder

Une autre sur The Verge : ▻https://www.theverge.com/2020/5/7/21250689/facebook-sdk-bug-ios-app-crash-apple-spotify-venmo-tiktok-tinder

Une discussion technique qui part un peu dans tous les sens : ▻https://news.ycombinator.com/item?id=23097459

l’analyse technique détaillée d’une précédente panne analogue : ▻https://github.com/facebook/facebook-ios-sdk/issues/1374

#Facebook

Linux not Windows: Why Munich is shifting back from Microsoft to open source – again | ZDNet
▻https://www.zdnet.com/article/linux-not-windows-why-munich-is-shifting-back-from-microsoft-to-open-source-a

“We will adhere to the principle of ’public money, public code’. That means that as long as there is no confidential or personal data involved, the source code of the city’s software will also be made public,”

Si vous n’avez pas suivi toute l’affaire des failles de sécurité #Ripple20 (une faille dans la pile TCP/IP de la société #Treck, pile utilisée par de nombreux objets connectés), ou bien seulement sur BFM TV, voici les articles originaux :

#JSOF, la société qui a découvert les failles : ▻https://www.jsof-tech.com/ripple20

#ForeScout, la société qui a cherché les nombreuses boites utiilisant le logiciel de Treck : ▻https://www.forescout.com/company/blog/identifying-and-protecting-devices-vulnerable-to-ripple20

Copie de la liste ici, au cas où : ▻https://gist.github.com/SwitHak/5f20872748843a8ad697a75c658278fe

Bon, sinon, ZDnet a fait un bon résumé : ▻https://www.zdnet.com/article/ripple20-vulnerabilities-will-haunt-the-iot-landscape-for-years-to-come

Et la vidéo faite par JSOF (sensationnaliste et pas très intéressante techniquement mais rigolote) : ▻https://www.youtube.com/watch?v=jkfNE_Twa1s&feature=emb_logo

Des hackers détournent des superordinateurs européens pour miner de la cryptomonnaie

▻https://cyberguerre.numerama.com/5137-des-hackers-detournent-la-puissance-de-calcul-des-superor

Une vague de malwares touche les superordinateurs aux quatre coins de l’Europe. Si pour l’instant la France est épargnée, le site ZDNet a relevé pas moins de 11 incidents la semaine du 9 mai. L’Allemagne est le pays le plus touché, mais les hackers ont également visé avec succès l’Espagne, la Suisse ou encore le Royaume-Uni.

Une fois entrés sur le système, les malfaiteurs utilisent l’immense puissance de calcul des superordinateurs pour miner une cryptomonnaie, le Monero. Ils génèrent ainsi de l’argent en faisant simplement fonctionner des machines qui appartiennent — dans la majorité des cas — à la recherche publique.

Hacker selling data of 538 million Weibo users | ZDNet
▻https://www.zdnet.com/article/hacker-selling-data-of-538-million-weibo-users

Data for 538 million Weibo users, including 172 million phone numbers, has been put up for sale on the dark web.

The personal details of more than 538 million users of Chinese social network Weibo are currently available for sale online, according to ads seen by ZDNet and corroborating reports from Chinese media. In ads posted on the dark web and other places, a hacker claims to have breached Weibo in mid-2019 and obtained a dump of the company’s user database. The database allegedly (...)

#Weibo #BigData #hacking #SocialNetwork

https://zdnet4.cbsistatic.com/hub/i/r/2020/03/22/bac6042e-bc1f-46de-91b7-10ce075217d5/thumbnail/770x578/464493a3a1eccd43bef3400bf00aaffa/sina-weibo.jpg

US, Israel, South Korea, and China look at intrusive surveillance solutions for tracking COVID-19 | ZDNet
▻https://www.zdnet.com/article/us-israel-south-korea-and-china-look-at-intrusive-surveillance-solutions-for-

As the coronavirus (COVID-19) outbreak spreads across the world, some governments are deploying or exploring the idea of deploying privacy-intrusive solutions for tracking the disease’s spread. As the global coronavirus (COVID-19) outbreak is leaving its mark across the world, at least four governments are deploying or at looking at implementing privacy-intrusive surveillance systems to track citizens and the disease’s spread. Countries like China and South Korea have already deployed (...)

#Google #Facebook #WeChat #algorithme #bracelet #Alipay #carte #CCTV #QRcode #smartphone #géolocalisation #métadonnées #vidéo-surveillance #BigData #santé (...)

##santé ##surveillance

https://zdnet4.cbsistatic.com/hub/i/r/2015/06/24/6e25c7c0-3573-4c02-b123-9438a67474f7/thumbnail/770x578/a32314a56e1f1b42aadf9471c4749b44/camerasurveillance.jpg

« On parle beaucoup en ce moment d’une "saturation des réseaux", de "risques pour l’#Internet", qui justifieraient des mesures autoritaires et discriminatoires, par exemple le blocage ou le ralentissement de Netflix, pour laisser de la place au "trafic sérieux". Que se passe-t-il exactement et qu’y a-t-il derrière les articles sensationnalistes ? »

►https://framablog.org/2020/03/21/linternet-pendant-le-confinement

#confinement