Google's Fuchsia OS is Taking Over Smart Displays, Now on Its Second Device (arstechnica.com) 23
You are getting a slightly newer code version, though, and it comes with a Bluetooth menu. If you dive into the settings and hit "about device," you'll see a "Fuchsia Version" field that will say something like "6.20211109.1.3166243." It's a bit weird to do an entire OS switch to the futuristic, secretive Fuchsia project and then have basically nothing to show (or say) for it in terms of obvious improvements in performance or security. You can dive into the minutia of the Fuchsia source code, but it continues to be a mystery in terms of what practical benefits it offers consumers. Google never talks about Fuchsia, so not much is known about what, exactly, Google is accomplishing here.
TikTok Owner ByteDance Quietly Launches Search App in China (scmp.com) 3
Google Pixel Sees Huge Sales Growth, Has 2% of North American Market (arstechnica.com) 29
YouTube Launches a Dedicated 'Explore' Page For Podcasts (9to5google.com) 7
You're just browsing through regular video thumbnails rather than anything more optimized. Meanwhile, tapping one just opens the regular player on Android, and doesn't even default to the "Listening controls" available for YouTube Premium subscribers. You get large buttons and shortcuts to like, save, and quickly adjust playback speed. The podcast experience for end users will presumably get more optimized over time, while it remains to be seen what the UI in YouTube Music is going to be.
Erik Prince Wants To Sell You a 'Secure' Smartphone That's Too Good To Be True (technologyreview.com) 86
Boasting falsely that Unplugged has built "the first operating system free of big tech monetization and analytics," Prince bragged that the device is protected by "government-grade encryption." Better yet, the pitch added, Unplugged is to be hosted on a global array of server farms so that it "can never be taken offline." One option is said to be a server farm "on a vessel" located in an "undisclosed location on international waters, connected via satellite to Elon Musk's StarLink." An Unplugged spokesperson explained that "they benefit in having servers not be subject to any governmental law." The Unplugged investor pitch deck is a messy mix of these impossible claims, meaningless buzzwords, and outright fiction. While none of the experts I spoke with had yet been able to test the phone or read its code, because the company hasn't provided access, the evidence available suggests Unplugged will fall wildly short of what's promised.
[...] The UP Phone's operating system, called LibertOS, is a proprietary version of Google's Android, according to an Unplugged spokesperson. It's running on an unclear mix of hardware that a company spokesperson says they've designed on their own. Even just maintaining a unique Android "fork" -- a version of the operating system that departs from the original, like a fork in the road -- is a difficult endeavor that can cost massive money and resources, experts warn. For a small startup, that can be an insurmountable challenge. [...] Another key issue is life span. Apple's iPhones are considered the most secure consumer device on the market due in part to the fact that the company offers security updates to some of its older phones for six years, longer than virtually all competitors. When support for a phone ends, security vulnerabilities go unaddressed, and the phone is no longer secure. There is no information available on how long UP Phones will receive security support. "There are two things happening here," says Allan Liska, a cyberintelligence analyst at the cybersecurity firm Recorded Future. "There are the actual attempts to make real secure phones, and then there is the marketing BS. Distinguishing between those two can be really hard."
"When I worked in US intelligence, we [penetrated] a number of phone companies overseas," says Liska. "We were inside those phone companies. We could easily track people based on where they connected to the towers. So when you talk about being impenetrable, that's wrong. This is a phone, and the way that phones work is they triangulate to cell towers, and there is always latitude and longitude for exactly where you're sitting," he adds. "Nothing you do to the phone is going to change that."
The UP Phone is due out in November 2022.
Five Years Later, Google is Still All-in on Kotlin (techcrunch.com) 40
Earlier this week, I sat down with Google's James Ward, the company's product manager for Kotlin, to talk about the language's role in the Android ecosystem and beyond, as well as the company's future plans for it. It's no surprise that Google's hope is that over time, all Android developers will switch over to Kotlin. "There is still quite a bit of Java still happening on Android," Ward said. "We know that developers are generally more satisfied with Kotlin than with Java. We know that they're more productive, the quality of applications is higher and so getting more of those people to move more of their code over has been a focus for us. The interoperability of Kotlin ... with Java has made it that people can kind of progressively move code bases over and it would be great to get to the point down the road, where just everything is all Kotlin."
The Upcoming Pixel Tablet Could Ship With a 64-Bit Only Version of Android 13 (xda-developers.com) 32
Google Releases Android 13, Rolling Out First To Pixel Phones (theverge.com) 23
Back in January, we wrote that Google planned to spend this year catching up with Apple's ecosystem integrations, and there's more evidence of this in Android 13's official release. The update includes support for spatial audio with head tracking, which is designed to make sounds appear as though they're coming from a fixed point in space when you move your head while wearing compatible headphones, similar to a feature Apple offers for its AirPods. Today's post doesn't say exactly which headphones this will work with, but Google previously announced it would be updating its Pixel Buds Pro to offer support for spatial audio. Secondly, there's the ability to stream messages from apps including Google Messages directly to a Chromebook, similar to iMessage on the Mac.
Google's New Bug Bounties Include Their Custom Linux Kernel's Experimental Security Mitigations (theregister.com) 5
"Because of this, we have heavily invested in Linux's security — and today, we're announcing how we're building on those investments and increasing our rewards." In 2020, we launched an open-source Kubernetes-based Capture-the-Flag (CTF) project called, kCTF. The kCTF Vulnerability Rewards Program lets researchers connect to our Google Kubernetes Engine (GKE) instances, and if they can hack it, they get a flag, and are potentially rewarded.
All of GKE and its dependencies are in scope, but every flag caught so far has been a container breakout through a Linux kernel vulnerability.
We've learned that finding and exploiting heap memory corruption vulnerabilities in the Linux kernel could be made a lot harder. Unfortunately, security mitigations are often hard to quantify, however, we think we've found a way to do so concretely going forward....
First, we are indefinitely extending the increased reward amounts we announced earlier this year, meaning we'll continue to pay $20,000 — $91,337 USD for vulnerabilities on our lab kCTF deployment to reward the important work being done to understand and improve kernel security. This is in addition to our existing patch rewards for proactive security improvements.
Second, we're launching new instances with additional rewards to evaluate the latest Linux kernel stable image as well as new experimental mitigations in a custom kernel we've built. Rather than simply learning about the current state of the stable kernels, the new instances will be used to ask the community to help us evaluate the value of both our latest and more experimental security mitigations. Today, we are starting with a set of mitigations we believe will make most of the vulnerabilities (9/10 vulns and 10/13 exploits) we received this past year more difficult to exploit. For new exploits of vulnerabilities submitted which also compromise the latest Linux kernel, we will pay an additional $21,000 USD. For those which compromise our custom Linux kernel with our experimental mitigations, the reward will be another $21,000 USD (if they are clearly bypassing the mitigations we are testing). This brings the total rewards up to a maximum of $133,337 USD.
We hope this will allow us to learn more about how hard (or easy) it is to bypass our experimental mitigations.....
With the kCTF VRP program, we are building a pipeline to analyze, experiment, measure and build security mitigations to make the Linux kernel as safe as we can with the help of the security community. We hope that, over time, we will be able to make security mitigations that make exploitation of Linux kernel vulnerabilities as hard as possible.
"We don't care about vulnerabilities; we care about exploits," Vela told the Register. "We expect the vulnerabilities are there, they will get patched, and that's nice and all. But the whole idea is what do to beyond just patching a couple of vulnerabilities." In total, Google paid out $8.7 million in rewards to almost 700 researchers across its various VPRs last year. "We are just one actor in the whole community that happens to have economic resources, financial resources, but we need the community to help us make the Kernel better," Vela said.
"If the community is engaged and helps us validate the mitigations that we have, then, we will continue growing on top of that. But the whole idea is that we need to see where the community wants us to go with this...."
[I]t's not always about the cash payout, according to Vela, and different bug hunters have different motivations. Some want money, some want fame and some just want to solve an interesting problem, Vela said. "We are trying to find the right combination to captivate people."
Facing Privacy Concerns, Facebook Begins Testing End-to-End Encrypted Chats, Secure Backups (cnbc.com) 19
"As with end-to-end encrypted chats, secure storage means that we won't have access to your messages, unless you choose to report them to us."
CNBC provides some context: The announcement comes after Facebook turned over Messenger chat histories to Nebraska police as part of an investigation into an alleged illegal abortion. Meta spokesperson Andy Stone said the feature has been in the works for a while and is not related to the Nebraska case...
The feature is rolling out on Android and iOS devices this week, but it isn't yet available on the Messenger website. The company has been discussing full-scale deployment of end-to-end encryption since 2016, but critics have said the security measure would make it much more difficult for law enforcement to catch child predators....Meta said in the release that it is making progress toward the global rollout of default end-to-end encryption for personal messages and calls in 2023.
Other privacy enhancements announced Thursday by Meta:
- "We plan to bring end-to-end encrypted calls to the Calls Tab on Messenger."
- Meta announced that the deleting of messages will start syncing across your other devices "soon."
- Messenger will continue offering the option of "Disappearing" messages, in which viewed messages in an end-to-end encrypted chat automatically then disappear after a pre-specified period of time.
And there's more, according to Meta's announcement:.
"This week, we'll begin testing default end-to-end encrypted chats between some people. If you're in the test group, some of your most frequent chats may be automatically end-to-end encrypted, which means you won't have to opt in to the feature. You'll still have access to your message history, but any new messages or calls with that person will be end-to-end encrypted. You can still report messages to us if you think they violate our policies, and we'll review them and take action as necessary....
"Last year, we started a limited test of opt-in end-to-end encrypted messages and calls on Instagram, and in February we broadened the test to include adults in Ukraine and Russia. Soon, we'll expand the test even further to include people in more countries and add more features like group chats....
"We will continue to provide updates as we make progress toward the global rollout of default end-to-end encryption for personal messages and calls in 2023."
Facebook Will Begin Testing End-To-End Encryption As Default On Messenger App (theguardian.com) 13
'Samsung Still Hasn't Given Us a Good Reason To Buy a Foldable Phone' (theverge.com) 73
It's not even clear to me that Samsung knows why you should make all of those sacrifices. On its website, one of the first selling points the company offers is that you can prop up the screen on a table by opening it halfway for watching or taking videos hands-free. Here in reality, we call that a kickstand, and this is an awfully expensive one. In this mode, you're also only using half the screen, which sort of defeats the whole purpose. So far, multitasking seems to be the foldable's one actual advantage. Open up your Galaxy Fold, and you can run two apps side by side or even three or four on the screen at once! This, I agree, is a delightful thing. Being able to use my browser and my notes app side by side or see my calendar and my email together is much better than constantly swiping between two full-screen apps. And seeing two pages at a time in the Kindle app is the best. And you know what? Big screens are just good -- good for games, good for reading, good for watching Netflix.
But these aren't just arguments for foldables; they're arguments for tablets. And so far, the arguments for Android tablets don't seem to be convincing many users. While Android has gotten better as a large-screen operating system, and the Fold 4's software being based on Android 12L is a good sign, too many apps that are "optimized" for foldables are actually just sticking a giant sidebar onto one side, which doesn't accomplish much. Others just streeeetch everything to fit the larger screen. Don't even get me started on how the vast majority of apps deal with Microsoft's approach of two separate screens attached with a hinge. Samsung has done an admirable job of wrangling all of Android's weirdness onto the Fold's screen, and in general, it's not that the Fold doesn't work; it's that there's nothing about the Fold that is dramatically better than the phone or tablet you might already be carrying around. And shoving them into a single device actually makes them both a little worse.
Google To Pay Nearly $43M Over Collection of Android Location Data (cnet.com) 13
Google Tries Publicly Shaming Apple Into Adopting RCS (theverge.com) 187
A Phone Carrier That Doesn't Track Your Browsing Or Location (wired.com) 33
PGPP's ability to mask your phone's identity from cell towers comes from a revelation about why cell towers collect the unique identifiers known as IMSI numbers, which can be tracked by both telecoms and other entities that deploy devices known as IMSI catchers, often called stringrays, which mimic a cell tower for surveillance purposes. Raghavan and Schmitt realized that at its core, the only reason carriers need to track IMSI numbers before allowing devices to connect to cell towers for service is so they can run billing checks and confirm that a given SIM card and device are paid up with their carrier. By acting as a carrier themselves, Invisv can implement their PGPP technology that simply generates a "yes" or "no" about whether a device should get service. On the PGPP "Mobile Pro" plan, which costs $90 per month, users get unlimited mobile data in the US and, at launch, unlimited international data in most European Union countries. Users also get 30 random IMSI number changes per month, and the changes can happen automatically (essentially one per day) or on demand whenever the customer wants them. The system is designed to be blinded so neither INVISV nor the cell towers you connect to know which IMSI is yours at any given time. There's also a "Mobile Core" plan for $40 per month that offers eight IMSI number changes per month and 9 GB of high-speed data per month.
Both of these plans also include PGPP's Relay service. Similar to Apple's iCloud Private Relay, PGPP's Relay is a method for blocking everyone, from your internet provider or carrier to the websites you visit, from knowing both who you are and what you're looking at online at the same time. Such relays send your browsing data through two way stations that allow you to browse the web like normal while shielding your information from the world. When you navigate to a website, your IP address is visible to the first relay -- in this case, Invisv -- but the information about the page you're trying to load is encrypted. Then the second relay generates and connects an alternate IP address to your request, at which point it is able to decrypt and view the website you're trying to load. The content delivery network Fastly is working with Invisv to provide this second relay. Fastly is also one of the third-party providers for iCloud Private Relay. In this way, each relay knows some of the information about your browsing; the first simply knows that you are using the web, and the second sees the sites you connect to, but not who specifically is browsing there. In addition to being included in the two PGPP data plans, customers can also purchase the Relay service on its own for $5 per month and turn it on while connected to mobile data or Wi-Fi. The carrier is still working to bring its services to Apple's iOS. It's also worth noting that Invisv only offers mobile data; there are no voice calling services.
ChromeOS 104 Rolling Out With Dark Theme, Redesigned Launcher, and More (9to5google.com) 14
The redesigned Launcher that's more compact and does not take up your entire screen is seeing wider availability. Additionally, some might be able to quickly search for Android apps from the Play Store with an inline rating. Version 104 of ChromeOS introduces a more full-featured Gallery app (with a new purple icon) that can open PDFs with the ability to fill out forms, sign documents, and make text annotations, like highlights. There's also a new Wallpaper & style application that's accessed by right-clicking the shelf and selecting the last option. Besides the collections curated by Google, you can set wallpapers from your Google Photos library. There's the ability to select an album and have a new background appear daily. This experience also lets you set the device theme (auto-switching available), and Screen saver with three styles available: Slide show, Feel the breeze, and Float on by.
Google Play Store Removes Version Numbers From Android App Listings (9to5google.com) 35
Raspberry Pi 4 Expands 3D Potential With Vulkan Update (arstechnica.com) 53
As with most Raspberry Pi advancements, there could be unforeseen opportunities unleashed by this seemingly tiny change. Vulkan 1.2 support gives developers the same 3D-graphics interface (if not anywhere near the same power) as 2019 NVIDIA graphics cards, 2020 Intel chips with integrated graphics, and dozens of other devices. With a Vulkan 1.0 driver installed, developer Iago Toral was able in 2020 to get the original Quake trilogy mostly running on a Pi 4, with not-too-shabby frame rates.