Weekly output: Google phones (x2), SXSL, e-mail encryption

I just watched the second presidential debate, and I was disappointed but not surprised by the lack of tech-policy banter. You?

yahoo-tech-google-phones-post10/3/2016: Why it matters that Google might be producing its own phones, Yahoo Finance

My suggestion at the end that Google might offer an installment-payment option for the new Pixel and Pixel XL phones–something analyst Jan Dawson suggested to me in an e-mail–panned out when Google introduced just that.

10/4/2016: Google’s new phones, WTOP

I spoke briefly about the Pixel and Pixel XL to the news station. One thing I wish I’d mentioned: These two new phones aren’t waterproof, unlike the iPhone 7 and the Galaxy S7.

10/4/2016: Obama gathers top tech to tackle US problems, Yahoo Finance

I spent most of Monday at the White House, which is not a bad way to while away an afternoon. This South by South Lawn event did not feature free beer (at least during the day) and so fell short of being a D.C. salute to Austin’s South by Southwest festival, but on the other hand SXSW has yet to allow me to see Rep. John Lewis (D.-Ga.) speak.

10/9/2016: How to protect your email from snooping, USA Today

Freelancing for multiple clients can sometimes lead to situations where one client asks you to write about an issue involving another.

Advertisements

Weekly output: iOS updates, Mac ransomware, ISP privacy (x2), wedding gifts, e-mail security

AUSTIN–I’ve been here since Friday morning, and somehow I have not eaten any brisket yet. If you choose to regard that oversight as a character issue, I can’t blame you.

3/7/2016: How to recover from iPhone update gone bad, USA Today

I made a mistake in this column–I misread an Apple tech-support note about restoring an iPhone in an Apple Store as evidence that you could also borrow a computer there to backup your iPhone and then restore it. That’s not the case, as two people pointed out, so I’ve asked my editor to correct the piece.

Yahoo Tech ISP-privacy post3/7/2016: Your ISP might not be spying on you now — but you’d be crazy not to worry that it will, Yahoo Tech

This post started life as a simpler, shorter unpacking of a report about the limits to Internet providers’ visibility of their subscribers’ online activity, but the topic and the word count expanded a bit from there.

3/8/2016: Ransomware on the Mac: Turns out identify theft is a problem for apps, too, Yahoo Tech

After this ran, a friend commented on my Facebook page that he uses the Transmission app but had chosen to skip the update that had been contaminated with a ransomware payload. Yikes.

3/9/2016: Great Wedding Registry Gift Ideas, The Sweethome

As part of this long guide to wedding presents, Casey Johnston interviewed my wife and I about the stand mixer that (I think) some of her parents’ friends gave us, and which I use to make bread every week.

3/11/2016: FCC proposes new broadband-privacy rules — and your ISP probably hates them, Yahoo Tech

Federal Communications Commission chairman Tom Wheeler proposed some not-too-sweeping proposals to limit what your ISP can do with the data it collects about your online activity, and Big Telecom is not amused.

3/13/2016: How to give your email a security checkup, USA Today

I was pleasantly surprised to see some large Internet providers support IMAP syncing and TLS encryption–but others have horribly obsolete and insecure setups. Think about that when you hear somebody insist that the only way to get a good and reliable service online is to pay for it.

Weekly output: online comments, Chrome and site security

We’re thisclose to the slow days of summer, but we’re not there yet.That’s probably why I’m still taking care of work chores on a Sunday night.

Yahoo Tech online-communities post7/21/2015: Why Online Comments Suck (and How to Fix Them), Yahoo Tech

You know where this essay about the lack of constructive conversation at Reddit and other places online got zero comments? At Reddit. You never know sometimes…

7/26/2015: Why Chrome questions your bank’s security, USA Today

This column became a lot more work to report when financial-industry PR types clammed up after I asked what I thought was a simple question about their sites’ security. And then Google wasn’t much more help itself.

Weekly output: e-mail security (x2), MacBook webcam

This week’s work involved the Virginia countryside, a space capsule, robots playing soccer, and some quality time with drones. And yet none of those things showed up in this week’s articles. But there’s always next week…

Yahoo Tech TLS post6/10/2014: Explained: How ‘TLS’ Keeps Your Email Secure, Yahoo Tech

I enjoyed crafting the photo for this, and not just because it gave me an excuse to flip through old postcards. I did not enjoy reading the comments as much: the repeated assertion there that nothing online can be made secure is both incorrect on a technical level and fundamentally defeatist.

6/10/2014: 4 Ways Your Email Provider Can Encrypt Your Messages, Yahoo Tech

I wrote a short sidebar–something we’ve taken to doing more often at Yahoo Tech–outlining how e-mail encryption has advanced over the last decade or so… at least at some providers.

6/15/2014: Revisiting a fix for your MacBook webcam, USA Today

Yes, you read about this topic earlier this year in my USAT column. But this time around the remedy may work a little more reliably. There’s also a tip about watching Netflix on a computer without Microsoft’s Silverlight plug-in–if you’re running Windows 8.1.

Heartbleed and bleeding-heart open-source advocacy

For at least the last decade, I’ve been telling readers that open-source development matters and helps make better software. If everybody can read the code of an application or an operating system, there can’t be any hidden backdoors; if anybody can rewrite that code to fix vulnerabilities and add features, the software’s progress can’t be thwarted by any one company’s distraction, fraud or bankruptcy.

OpenSSL pitchMy glowing endorsement of Mozilla Firefox 1.0 in November 2004 set the tone:

…the beauty of an open-source product like this is that you can participate in its evolution. Firefox’s code is open for anybody to inspect and improve...

Since then, I’ve recommended open-source operating systems, office suites, anti-virus utilitiessecure-deletion tools, file-encryption software, two-factor authentication apps, PDF exporters, DVD rippers and video-playback toolkits. And I’ve had one phrase in mind each time: Given enough eyeballs, all bugs are shallow.

My experience using open-source software tells me this is true–even if that doesn’t guarantee a constant rate of improvement or an elegant interface.

And if any genre of software should benefit from this method of development, it ought to be code that Web sites use to secure their interactions with users from eavesdropping: Everybody sending or storing private information needs this feature, billions of dollars of transactions are at stake, and you don’t even have to worry about wrapping a home-user-friendly UI around it.

True, right? Except Heartbleed happened. Two years ago, an update to the widely-used OpenSSL encryption library added a “heartbeat” function that made it easier for sites to keep an encrypted session going. But it also harbored an disastrous vulnerability to buffer-overflow attacks that would cause a site to return 64 kilobytes of whatever happened to be adjacent in the server’s memory to an attacker: usernames, passwords, e-mail content, financial transactions, even the private key the site uses to encrypt the session. And the attacked site can’t check afterwards to see if it got hit. I defy the NSA to script a better hack.

And despite buffer overflows being a well-known risk with documented defenses, nobody caught this for two years. Two years! It took a Google researcher and engineers at the Finnish security firm Codenomicon to find the bug separately and report it to the OpenSSL team.

How bad is this? Ask security researcher Bruce Schneier:

“Catastrophic” is the right word. On the scale of 1 to 10, this is an 11.

It seems that everything that could go right in open source development went wrong in this case. As an excellent story from Craig Timberg in the Post outlines, the free nature of OpenSSL made it an obvious choice for hundreds of thousands of sites and something of a natural monopoly, that same enormous deployment of OpenSSL encouraged people to assume that they themselves didn’t need to inspect the code that carefully, and OpenSSL developers got so little financial support from the corporations relying on their work that they couldn’t even subject their code to a proper security audit.

The stupid thing is, we knew this could happen. See John Viega’s 2000 essay, “The myth of open source security,” in which he outlines how thousands of users failed to catch “a handful of glaring security problems” in code he’d contributed to the Mailman mailing-list manager:

Everyone using Mailman, apparently, assumed that someone else had done the proper security auditing, when, in fact, no one had.

That doesn’t mean that closed-source development suddenly looks better. (When all this is done, Microsoft’s proprietary and hideous Internet Explorer 6 may still have greased the skids for more successful attacks than OpenSSL.) But it does mean that selfishness/laziness/distraction and open source can become a toxic mix, one we should have seen coming.

Updated, 10:25 a.m., to add a link to Viega’s prescient article.