- apple-list - University of Manitoba Mailing Lists

Consult
by Jerry Morgan 24 Oct '25

24 Oct '25

Fund Management !!!

3 2

Confirm Your Subscription
by Chic Boutique 22 May '25

22 May '25

Caution! This message was sent from outside the University of Manitoba. ‌ Confirm your subscription Yes, I want to subscribe<https://manage.kmail-lists.com/subscriptions/subscribed?opt=6d379708b0342e8…> If you didn't subscribe to this list or you're not sure why you received this email, you can delete it. You will not be subscribed if you don't click on the link above. If you have any questions, you can reply to this email.

1 0

Confirm Your Subscription
by KALONJI 16 May '25

16 May '25

‌ Confirm your subscription [Yes, I want to subscribe](https://manage.kmail-lists.com/subscriptions/subscribed?opt=801e… If you didn't subscribe to this list or you're not sure why you received this email, you can delete it. You will not be subscribed if you don't click on the link above. If you have any questions, you can reply to this email.

1 0

FYI: Apple updates MacBook Pro with faster performance and new features for pros
by Doug Hamilton 12 Jul '18

12 Jul '18

Apple updates MacBook Pro with faster performance and new features for pros. https://www.apple.com/newsroom/2018/07/apple-updates-macbook-pro-with-faste…

1 0

FYI: Apple press event, October 27
by Doug Hamilton 21 Oct '16

21 Oct '16

Apple has officially announced their October press event. http://www.apple.com/apple-events/october-2016/

1 0

INTEREST: "Smartphones Won't Make Your Kids Dumb. We Think" (long)
by Wayne Billing 07 Jun '16

07 Jun '16

…from: http://digg.com/2016/smartphone-toddler-studies Smartphones Won't Make Your Kids Dumb. We Think [cid:F79B9758-0216-42BD-988B-9A916BD9116E] Sandy, like many parents, is concerned about how much time her 18-month-old spends in front of screens. Weighing up the available evidence, Olivia Solon explains that she might be worrying too much. Jessica’s tiny fingers dart around the iPad, swiping through photos to get to a particularly entertaining video: a 12-second clip of her dancing clumsily to Beyoncé’s Single Ladies. The 18-month-old taps “play” and emits a squeal of delight. After watching the video twice, she navigates back to the home screen and opens up the YouTube app to watch an episode of the colorful animation Billy Bam Bam. Halfway through, she moves onto a Yo Gabba Gabba! game, which involves anthropomorphized fruits making their way into a character’s belly. When Jessica’s mom, Sandy, tries to take away the iPad, there’s a tantrum that threatens to go nuclear: wobbly lip, tears, hands balled into fists and a high-pitched wail. “She does this a lot,” says Sandy. “She seems to prefer the iPad to everything else. Sometimes it’s the only thing that will keep her quiet,” she adds, frantically waving a pink fluffy unicorn in an attempt to appease her daughter. Like many parents, she’s worried about her child’s obsession with screens. She wants to know which activities are best, and how much time spent on screens is too much. It’s six years since the launch of the iPad<http://www.apple.com/pr/library/2010/01/27Apple-Launches-iPad.html> and, with it, the rebirth of tablet computers. The academic research simply hasn’t been able to catch up, which means it’s hard to know the long-term impact on young brains of being exposed to tablets and smartphones. The concern among some experts is that these devices, if used in particular ways, could be changing children’s brains for the worse – potentially affecting their attention, motor control, language skills and eyesight, especially in under-fives, for whom so much brain development is taking place. Technology companies and app developers are throwing their marketing prowess at the problem, slapping words like “educational” and “e-learning” on their products, often without any scientific basis. So what are parents to do? *** People have always feared new media. Almost 2,500 years ago Socrates was decrying the spread of written language, arguing that it would erode memory and knowledge. In the 15th century it was the printing press that brought about moral panic. Benedictine monks, who profited from hand-copying reading materials, petitioned against the mechanized printers, saying: “They shamelessly print, at negligible cost, material which may, alas, inflame impressionable youths.” When radio arrived, it too was deemed a menace, blamed for distracting children from their homework. A 1936 article in Gramophone magazine reported that youngsters had “developed the habit of dividing attention between the humdrum preparation of their school assignments and the compelling excitement of the loudspeaker”. [cid:4579D4A8-D2BE-4EAA-9644-298C902C7051] Leon Elder<http://leillo.com/> Few technologies, however, have invaded our lives – and those of our children – as stealthily as the mobile computer, most commonly the smartphone or tablet. These devices are the right size for little hands to handle them, and the touchscreens easy for tiny fingers to manipulate. Plus there’s so much you can do on these devices: watch videos, play games, draw pictures and talk to relatives thousands of miles away. In 2011, a year after the iPad launched, just 10 per cent of US children under the age of two were found to have used tablets or smartphones, but by 2013 that figure had nearly quadrupled. A 2015 study in France found that 58 per cent of under-twos had used a tablet or mobile phone. There’s little clarity around the consequences of long-term use of such devices. The American Academy of Pediatrics<https://www.aap.org/en-us/Pages/Default.aspx> (AAP) has erred on the side of caution, recommending absolutely no screen time for children under the age of two, and a two-hour daily limit for those older. These restrictions simply don’t tally with how many people are integrating these devices into their children’s lives, nor do they reflect the fact that some interactions with screens might actually be beneficial. “If your child is under two and is exposed to a screen it’s not going to be toxic to their brain: they won’t be turned into idiots,” says Michael Rich, associate professor of pediatrics at Harvard Medical School and an AAP member. “But there are potential downsides… and parents need to make a series of risk–benefit analyses.” The AAP is now in the process of revising its guidelines, and they are due to be published in late 2016. *** So why don’t we know more about the risks of children using screens? There’s a fundamental problem at the basis of all the research in this area – what do we even mean by “screen time?” Firstly, it’s important to distinguish between types of screen: do we mean a television screen, a tablet, a smartphone or an e-reader? Secondly, the nature of the content matters: is it an interactive drawing game, an e-book, a Skype call with Grandma or a stream of Netflix Kids videos? Thirdly, there’s the context: is there a caregiver in the room talking to the child as they interact with the screen or are they left on their own? To date, we have comprehensive research about children and television exposure, but we don’t yet know how much of it applies to interactive screens like tablets and smartphones. There are a few things we do know. Most child development experts agree that while passive screen time – such as putting your child in front of a device for a Peppa Pig marathon – might be entertaining, it isn’t going to provide a rich learning experience. In this case, it doesn’t make a difference whether they’re watching on TV or a tablet: the experience is broadly the same. Having a video or TV on when a child is doing something else can distract them from play and learning, negatively affecting their development. Hours of background TV has also been found to reduce child–parent interaction, which has an adverse impact on language development. This displacement is a big concern: if kids are left with screen-based babysitters then they are not interacting with caregivers and the physical world. There are only so many hours in a day, and the time spent with screens comes at the expense of other, potentially better, activities. Few technologies have invaded our lives as stealthily as the mobile computer. Under-threes, in particular, need a balance of activities, including instructed play, exploring the natural environment, manipulating physical toys and socializing with other children and grown-ups. The rise in screen use means less of all of these things. “Parents need to think strategically,” says pediatrician Dimitri Christakis<http://www.seattlechildrens.org/research/child-health-behavior-and-developm…>, director of the Center for Child Health, Behavior and Development at the Seattle Children’s Research Institute. “If your child has 12 hours awake and two of those are spent eating, how will you allocate the rest of the time?” The problem is that tablets are extremely appealing to children and adults alike. Thanks to their design, versatility and intuitive interfaces, tablets are a perfect way for children to draw, solve puzzles and be entertained on the move. Combine that with marketing efforts of digital media companies and app developers – whose measure of success tends to be the amount of time people are glued to their creation – and you have a toy that’s difficult to prize out of tiny hands. Many apps are designed to be stimulus-driven, with exciting audiovisual rewards for completing tasks. Christakis refers to this as the “I did it!” response, which triggers the reward pathway in the brain. “The delight a child gets from touching a screen and making something happen is both edifying and potentially addictive,” he says. Because of this, tablets and smartphones make for excellent pacifiers, particularly on long plane journeys and in restaurants. “The device itself is seen as a pleasurable source of comfort and parents play into that,” says Christakis. “It’s pretty common,” says Jenny Radesky<http://www.uofmhealth.org/profile/4195/jenny-stillwaggon-radesky-md>, assistant professor of pediatrics at University of Michigan. “It becomes the go-to, easiest tool the parent is using.” Although helpful in the short term, it’s important for young children to be able to develop internal mechanisms of self-regulation, whether that’s learning without constant rewards or being able to sit patiently without constant digital stimulation. Christakis says that, anecdotally, he and others are starting to see younger and younger patients using these devices compulsively. “We know there’s such a thing as problematic internet use in older children and adolescents, and it stands to reason that the same would happen with infants,” he says. And he’s doing research to find out more about this. *** In Seattle’s Center for Integrative Brain Research<http://www.seattlechildrens.org/research/integrative-brain-research/>, a cluster of tiny pink mouse pups wriggle in a mass behind their mother. The rodent family home is a sawdust-filled clear plastic container, one of hundreds stacked up in a rotating system of shelves. These are the “control” mice used by Christakis and neuroscientist Nino Ramirez, and their team, trying to understand the impact on young brains of being exposed to fast-paced media. [cid:79265BDF-B61F-4B8C-96C9-AC93198FCFCB] Leon Elder<http://leillo.com/> Across the corridor an experiment is underway. One of the mouse containers is surrounded by bright lights and speakers. For 42 days, six hours every day, baby mice are exposed to the high-octane soundtrack of Cartoon Network shows accompanied by synchronized flashing lights in red, blue and green. The apparatus has been designed to find out what happens to the rodents’ brains when they are overstimulated by media during a critical window for their development. The results are startling. “Overstimulating them as babies primes [them] to become hyperactive for the rest of their life,” says Ramirez. The overstimulated mice take more risks and find it harder to learn and stay attentive. They get confused by objects they’ve seen before, for example, and find it more difficult to navigate through a maze. When given the option to dose themselves with cocaine, the overstimulated mice were much more prone to addiction than the control group. These behavioral changes are matched by changes in the mice’s brains. The theory is that the same applies to children: overstimulating them with media – particularly in an age of tablets with endlessly streaming, hard-to-ration videos and flashy interactive games – may cause an imbalance in part of the cerebral cortex called the basal ganglia. It’s this part of the brain that allows us to pay attention to critical tasks and ignore distractions. Such overstimulation could lead to problems in later life, particularly with focus, memory and impulsivity. “It seems that you can overstimulate young brains to the point that day-to-day life won’t excite to the same extent,” says Ramirez. Before we trigger mass panic about a generation of hyperactive, inattentive, cocaine-using post-millennials, it’s important to note that these experiments have attracted criticism for a number of reasons. Six hours of any activity per day is a huge amount of time, particularly when it involves nocturnal mammals like mice (although the researchers say the mice show no signs of stress). Furthermore, Christakis, Ramirez and colleagues don’t actually show the mice a real screen with any meaningful content – it is just a flashing proxy for a screen. The rodent research being carried out in Seattle is unique in its scope and approach, which explains why it’s frequently used as evidence of the evils of screen time. While mouse models are by no means perfect, they are useful for studying the underlying mechanisms relating to basic cognitive processes, which are fairly constant throughout mammals. As mice have relatively short lifespans, it’s possible to examine developmental trajectories over much shorter timeframes and get real insight into what’s going on inside their brains. All of this can be done in a controlled environment that simply would not be possible with human subjects. If, as suggested, cognitive development is affected by exposure to media, then this kind of research could inform the types of screen-based interactions we allow young children to have. Should parents be concerned? “They should be vigilant and careful about the amount of time and the content their children have access to,” says Christakis. Thanks to their design, versatility and intuitive interfaces, tablets are a perfect way for children to draw, solve puzzles and be entertained on the move. Although it’s a challenge to conduct controlled experiments with babies, it is possible to observe what happens with children ‘in the wild’. From this, we can draw possible links to their habits with mobile devices. In California, Maria Liu<http://optometry.berkeley.edu/faculty/maria-liu-od-phd> heads up the Myopia Control Clinic at UC Berkeley’s School of Optometry. She’s seen a sharp increase in young children with myopia (shortsightedness). “It’s increasing at an alarming rate worldwide and a well-accepted contributing factor is the early introduction of handheld devices to kids.” In our early years, our eyeballs are very adaptive and plastic, so spending lots of time focusing on objects close-up will make the eyes more likely to be near-sighted. “The eyeball will grow longer to compensate for the prolonged near stress,” Liu says. She doesn’t have any evidence-based recommendations for a time limit on use of devices, but says “frequent breaks from near work” are very important. Tablets and smartphones are typically viewed much closer to the face than things like televisions or desktop computers. Although books are also read up close, studies have shown that children tend to hold them further away than they do screens. The other problematic aspect of screens is that they have been shown to disrupt sleep. The blue light emitted by the super-sharp displays can interfere with our natural bodily rhythms, preventing melatonin, an important sleep hormone, from being released. This in turn can lead to sleep impairments in adults and children alike. Sandy says that if Jessica uses the tablet before bed she gets “noticeably riled up”. So, she says, they try to use books instead. This issue is why the latest version of Apple’s software for iPads and iPhones comes with “Night Shift<http://www.cnet.com/how-to/how-to-enable-night-shift-in-ios-9-3/>”, which automatically swaps the blueish light for a warmer hue before bedtime. *** In London, Max, who is 12 months old, is sitting on his mother Helen’s lap in a small, darkened room. On his head is a rubbery cap covered in electrodes. They are measuring the electrical activity in his brain as he looks at physical objects and at digital representations of those objects on an iPad screen. On each of Max’s ankles is a smartwatch of sorts, one measuring his movements and the other his heart rate. The cap uses electroencephalography (EEG) to record his brain’s electrical activity, to understand whether real and virtual objects trigger different brain responses and how that relates to subsequent learning. [cid:E4F22067-FB5C-4977-8C0E-75A04F1791C3] Leon Elder<http://leillo.com/> The experiment is part of the TABLET<http://www.bbk.ac.uk/tablet_project/main> project in the Babylab at Birkbeck, University of London. It’s the first ever scientific study investigating how children aged six months to three years are using touchscreen devices and how this influences their cognitive, brain and social development. In a second experiment, Max sits in a curtained-off booth facing a screen that displays a 15-minute loop of video that includes trippy abstract animations and sounds, as well as still pictures and videos starring PhD students as stand-in children’s TV presenters. He’s completely mesmerized, and his eyes dart from object to object on the screen. Eye-tracking cameras capture the dance of his gaze, and outside the booth research fellow Celeste Chung keeps track of how his eye movements match up with the items on screen. “All the child is doing is looking at the screen, but their gaze behavior tells us about their learning and anticipations,” says Tim Smith, a cognitive scientist who heads up the Babylab. The team is trying to understand how easily Max, and dozens of other babies like him, can focus attention and block out distractions when working on a particular task. In one of the tests, an object appears at the centre of the screen and then a second object appears, near the edge of the screen, shortly after. In order to look at the second object, the child needs to disengage from the central one, which requires self-control. This is a very important measure of executive function, the brain’s ‘air traffic control system’, which helps a child analyze tasks, break them into steps and focus on them until they are done – a key predictor of success in later life. Like Christakis, Smith is interested in finding out whether there really is a link between the reward learning found in many apps and a child’s ability to focus. “We might find that if tablets are being used for a lot of reward learning and the child becomes driven by an external stimulus then they might develop an impairment in executive function because they aren’t used to controlling their own attention,” he says. Smith isn’t entirely convinced by the mouse model used by Christakis and Ramirez in Seattle, although he agrees that their six hours of media stimulation a day could be reflective of a small number of children’s home environments where there are multiple devices and televisions that can contribute to sensory overload. “Some of the parents in our study are reporting three hours of tablet use a day [for their children],” says Smith. “That is a large proportion of their waking hours using a screen that doesn’t conform to the laws of physical reality.” Regardless of our feelings towards tablets and smartphones, these devices are here to stay. As for the effects on language and motor development, he hypothesizes that there could be displacement going on. “The technology may be used as a nanny in place of face-to-face learning. Babies always learn better from people, but we don’t always have time.” Devices like iPads may give lots of stimulation but lack the nuanced real-time social feedback that helps develop language, says Smith. Similarly, tablets and phones may make children dexterous at fine motor control with all the tapping and swiping, but they may have less motivation to get up and explore the world around them. After around an hour of assessment, Max’s patience for screen-touching, eye-tracking, brain-monitoring and other distractions from his busy schedule of rampaging around and eating bread sticks wanes. He starts to grizzle and wriggle and claw at the EEG cap. These movements corrupt the brain activity data. “That’s the interesting challenge with infants,” says Smith. “They’re completely non-compliant to instructions.” *** What about the educational potential of devices? There are thousands of apps, e-books and videos purporting to have educational value for children, yet very few have been able to support this claim with solid research. “The app marketplace is a digital Wild West,” says Mike Levine<http://www.joanganzcooneycenter.org/author/michael-h-levine/>, chief executive of the Joan Ganz Cooney Center in New York, which has analysed hundreds of children’s literacy apps in a series of reports. “Most of the apps labelled as educational provide no research-based advice or guidance… Less than 10 per cent of the apps we looked at had any stated evidence of efficacy [in the descriptions in the app store].” [cid:775D297F-6123-4F22-A369-5900D7B37DC8] Leon Elder<http://leillo.com/> Unintentionally, some interactive “enhancements” to stories (such as animations, sounds and features that let kids tap and swipe) might actually be decreasing the overall educational value. While enhancements might be appear to be engaging children, they could, in fact, be distracting them from the educational content. This idea was put to the test by Adriana Bus<http://www.universiteitleiden.nl/en/staffmembers/adriana-bus> and colleagues, at Leiden University in the Netherlands, who tracked children’s eyes while they read interactive e-books. They found that when there were animated parts of the picture not directly relevant to the narrative – for example, trees moving in the wind in the background – the children’s eyes were diverted to those points of motion rather than taking in the story. Relevant animations, on the other hand, can be beneficial, particularly for children who struggle with language and reading comprehension. Even if apps are found to have educational value, toddlers still learn better from experiences in the real world than they do from equivalent two-dimensional representations on screen. Studies in the US have shown that when dealing with visual–spatial problems, such as finding hidden objects or solving puzzles, toddlers (under around 30 months) perform much better when the problem is presented in real life rather than on screen. “It is thought that the cognitive load of transferring information from two dimensions… to three dimensions… is too great for children prior to age 30 months,” write Jenny Radesky and her colleague Barry Zuckerman in their study of digital play. Children this young are still developing the ability to choose what to pay attention to and what to ignore, and they have trouble generalizing from symbolic representations to the real world. Preschool-aged children need to interact with actual physical objects in order to develop their parietal cortex, which controls visual–spatial processing and helps develop maths and science skills in later life. To address this, some app developers are introducing companion toys that can be manipulated by little hands alongside the apps. What we don’t yet fully understand is how much value there is to the tactile element of touching interactive screens, something that requires a connection between the eyes, fingers and brain, and that passive viewing lacks. Does manipulating a digital object on screen enhance the learning process and make it easier to transfer knowledge into the physical world? And can understanding this mechanism help us develop better digital learning tools? Instead of banning devices, we should be demanding better apps built on solid research. Regardless of our feelings towards tablets and smartphones, these devices are here to stay. So how do we get the most out of them? Thanks to some 100 years of research into how children learn, we can make educated guesses about what sort of interactions, in what sort of circumstances, are best. Devices such as tablets and smartphones can make the most impact in lower-income households. In these households, people tend to have less access to developmental resources – such as music lessons, extra tuition or just extra hours of social interaction – and so spend more time with digital media. Provided the content is high-quality, tablets and smartphones can have a big impact. For example, a study from Stanford University in the US found that, by 18 months, toddlers from disadvantaged families are already several months behind their more advantaged peers on language proficiency. With the right content and context, digital devices can help bridge the divide. “It’s a bit privileged and unrealistic to say no to technology,” says Levine. “I worry that we are seeing people wagging their fingers at others because they do not have the privileges of time and resources that other families might have. “There’s no way we’re going to improve the educational performance of young children without using technologies.” Instead of banning devices, we should be demanding better apps built on solid research. For children aged between three and five, it’s entirely possible that a well-designed app can help improve vocabulary and basic maths skills. “My youngest is speech-delayed, and the videos he watches have definitely helped him learn new words,” says Lisa, a mother of four- and six-year-old sons who have been using mobile technology since they were 18 months old. All of the pediatricians, child development and education specialists I spoke to agreed that, for children under 30 months, there is no substitute for human interaction. So why not develop apps that act as mediators between infant and caregiver? BedTime Math<http://bedtimemath.org/apps/> is one example. The app delivers engaging maths story problems for parents and their children. It is one of the few tools that have been shown to make kids smarter; children who used the app even just once a week for a year improved their maths by more than a control group did. The impact was particularly strong for children whose parents were anxious about maths. *** With so much focus on what children are doing, it’s easy for parents to forget about their own screen use. “Tech is designed to really suck you in,” says Radesky, “and digital products are there to promote maximal engagement. It makes it hard to disengage, and leads to a lot of bleed-over into the family routine.” One approach that has been shown to help under-threes learn better is to build tools that use “nudge technologies” geared at the parents. This could be text messages or emails that remind parents to sing or talk with their baby, to help both parents and child disengage from technology and apply learnings to the real world. Children’s tablet maker LeapFrog does something similar with its LeapPad devices. Parents receive emails about what their child has learned from the touchscreen, along with ideas of how they could apply this new knowledge away from the screen. With so much focus on what children are doing, it’s easy for parents to forget about their own screen use. “The extent to which parents are tied up with these devices in ways that disrupt the interactions with the child has potential for a far bigger impact,” says Heather Kirkorian<https://sohe.wisc.edu/staff/heather-kirkorian>, who heads up the Cognitive Development & Media Lab at the University of Wisconsin-Madison. “If I’m on the floor with a child but checking my phone every five minutes, what message does that send?” How much parents play with and talk to their kids is a very powerful predictor of how the kids will develop, she adds. Radesky has studied the use of mobile phones and tablets at mealtimes by giving mother–child pairs a food-testing exercise. She found that mothers who used devices during the exercise started 20 per cent fewer verbal and 39 per cent fewer nonverbal interactions with their children. During a separate observation of 55 caregivers eating with one child or more, she saw that phones became a source of tension in the family. Parents would be looking at their emails while the children would be making excited bids for their attention. “You would see parents losing it and raising their voices because it’s extremely irritating to be focusing on something and have a child escalate their requests for attention,” she explains, adding that some parents would do things like shove their child’s hand away. Restricting the use of devices at critical family moments such as mealtimes and before bed can help reduce these frictions and encourage more face-to-face conversations. Infants are wired to look at parents’ faces to try to understand their world, and if those faces are blank and unresponsive – as they often are when absorbed in a device – it can be extremely disconcerting for the children. Radesky cites the “still face experiment”, which was devised by developmental psychologist Ed Tronick in the 1970s. In it, a mother is asked to interact with her child in a normal way before putting on a blank expression and not giving them any visual social feedback. As the video shows, the child becomes increasingly distressed as she tries to capture her mother’s attention. “Parents don’t have to be exquisitely present at all times, but there needs to a balance and parents need to be responsive and sensitive to a child’s verbal or nonverbal expressions of an emotional need,” says Radesky. *** Although we are still in the early days of understanding the impact that mobile computers are having on young children, the key piece of advice from the child experts I spoke to was to make sure that device use is just one part of a rich diet of activities, particularly for under-threes, who seem to struggle to learn from screens. Interactive, creative touchscreen experiences should be preferred over passive TV-like viewing. Parents should take educational claims from app developers with a hefty pinch of salt. Where possible, a device should be used as a tool to enhance interactions with the child, whether that’s as a launchpad for discussion (“What’s the cow doing over there?” “What sound does the duck make?”) or as a way to inspire educational conversations that spill into the rest of the day, as appears to happen with BedTime Math. Tronick’s still face experiment did not involve screens, but a number of researchers have cited it as evidence that parents shouldn’t be distracted by their smartphones when they are around their babies. This is true to an extent, but Tronick himself underplays its significance. “It’s all a bit exaggerated,” he says, adding that most children do plenty of activities every day that don’t involve screens. Where possible, a device should be used as a tool to enhance interactions with the child. He is concerned that the worries about kids’ use of screens is born out of an “oppressive ideology that demands that parents should always be interacting with their child”. “It’s based on a somewhat fantasized, very white, very upper-middle-class ideology – tiger moms and helicopter parents – that says if you’re failing to expose your child to 30,000 words you are neglecting them.” Tronick believes that just because a child isn’t learning from the screen doesn’t mean there’s no value to it – particularly if it gives parents time to have a shower, do housework or simply have a break from their child. “Many parents, particularly low-income parents, are horrifically stressed and concerned they don’t get the support they need and find parenting really lonely. Those are the big problems,” he says. Parents can get a lot out of using their devices to speak to a friend or get some work out of the way. This can make them feel happier, which lets them be more available to their child the rest of the time. For Sandy, this is a relief to hear. “Sometimes I’m at the end of my tether,” she says, adding that she shouldn’t have to feel guilty about giving her child the iPad so she can have some “me time”. With some parents, there’s a lot of snobbery about screen use, she says. “As a mum, I put my 18-month-old in front of an HBO baby poetry video,” says Radesky. “It’s cute and calm and I can wash the dishes or do something that’s a reset for me. That’s a benefit, but it’s something parents need to be very honest about. The video is not educating my 18-month-old. It’s a break for me as a parent.” This piece was co-commissioned by Mosaic and Digg. With thanks to Joy Victory for the initial story idea. ________________________________ [cid:4833D7AF-3B45-4136-B4CF-B64C843746BC]<https://twitter.com/Mosaicscience> Mosaic is dedicated to exploring the science of life. Each week, we publish a feature on an aspect of biology or medicine that affects our lives, our health or our society; we tell stories with real depth about the ideas, trends and people that drive contemporary life sciences. [cid:AD74D7BB-73F2-4913-AFBD-4FB729099916]<https://twitter.com/oliviasolon> Olivia Solon is a San Francisco-based journalist interested in technology, science, startups and digital culture. She has held senior editorial roles at Wired UK, Mirror.co.uk<http://mirror.co.uk> and Bloomberg, and has had work published in the Guardian, New Scientist, Business Life, the Telegraph, Wired.com<http://wired.com>, FT.com<http://ft.com>, Elle, Glamour, Marketing Week and Music Week.

1 0

FYI: If MacBook Pro (Retina, 13-inch, Early 2015) becomes unresponsive when a web browser is running.....
by Wayne Billing 06 Jun '16

06 Jun '16

…from: https://support.apple.com/en-us/ht206594 If MacBook Pro (Retina, 13-inch, Early 2015) becomes unresponsive when a web browser is running Install the latest updates for OS X and the Adobe Flash Player web plug-in. If your MacBook Pro (Retina, 13-inch, Early 2015) stops responding when Safari or another web browser is running, make sure that your software is up to date: 1. Use the Mac App Store<https://support.apple.com/kb/HT201541> to find and install any updates for OS X and other software. 2. If you're using the Adobe Flash Player web plug-in, make sure that you have the latest version. Contact Adobe if you need help downloading, installing, or using Adobe Flash Player. Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Risks are inherent in the use of the Internet. Contact the vendor<https://support.apple.com/kb/HT201777> for additional information. Other company and product names may be trademarks of their respective owners. Last Modified: Jun 3, 2016

1 0

INTEREST: Apple's "Back To School" offer started
by Wayne Billing 02 Jun '16

02 Jun '16

Hi Apple has announced their “Back to School” offer” [cid:99FF3212-A311-46B1-B44E-228E80B2D008] You’ll get wireless Beats headphones when you buy an eligible Mac, iPad or iPhone for college or university. And save on a Mac or iPad with Apple education pricing.* [Sorry for the dense text…] * Buy an iMac, MacBook, MacBook Pro, MacBook Air and Mac Pro (each, an “Eligible Mac”), and receive one pair of Beats Solo2 Wireless Headphones (in Black, Blue, Red, White, Gold, Rose Gold, Silver, Space Grey, Blue Active, Red Active or Yellow Active), for which an instant credit in the amount of $329.95 will be applied to your order; or buy an iPhone 6, iPhone 6 Plus, iPhone 6s, iPhone 6s Plus (each, an “Eligible iPhone”), or iPad Pro (an “Eligible iPad”), and elect to receive either: (i) one pair of Powerbeats2 Wireless Headphones (in Red, Black, Black Sport, White Sport, Red Active, Yellow Active or Blue Active), for which an instant credit in the amount of $219.95 will be applied to your order; or (ii) one pair of Beats Solo2 Wireless Headphones, for which an instant credit in the amount of $219.95 will be applied to the order, and you must pay the remaining balance ($110) following application of the instant credit. Refurbished Apple products are not eligible for this promotion. Purchases must be made from Canada Apple Store locations, the Canadian Apple Online Store for Education Individuals or by calling 1-800-MY-APPLE from June 2, 2016, through September 5, 2016. If the Eligible Mac, Eligible iPhone or Eligible iPad (each, an “Eligible Product”) is returned for any reason without the promotional headphones, or is exchanged for a product other than an Eligible Product, your refund will be reduced by the amount of the instant credit applied to your initial purchase. Promotional headphones may be exchanged only for another pair of promotional headphones, and you shall be responsible for any difference in price. Any promotional headphones returned for a refund must be returned with the Eligible Product in order to receive a full refund. Must meet educational eligibility requirements. Only one pair of promotional headphones per Eligible Product category. Offer subject to availability. While supplies last. Terms and conditions apply. Visit www.apple.com/ca/promo<http://www.apple.com/ca/promo> for full details. Terms and quantity limits apply for education pricing. Quantity limits apply. Visit Sales & Refund Policy for full terms and conditions. Start at the apple.ca<http://apple.ca> web site. Scroll to the bottom for the link to “Apple and Education”; then the top-right link "Purchasing and Support”. Finally, scroll down to "Special pricing on Apple products for education” > " Education pricing for individuals”.

1 0

FYI: Apple is blocking all versions of FLASH prior to 21.0.0.242 and 18.0.0.352
by Wayne Billing 20 May '16

20 May '16

…from Apple Mailing: Date: Wed, 18 May 2016 15:34:13 -0700 From: Apple Product Security Subject: APPLE-SA-2016-05-18-1 OS X: Flash Player plug-in blocked Message-ID: <199D3B09-9CFE-45F9-B832-EE0998BB2ACF(a)lists.apple.com<mailto:199D3B09-9CFE-45F9-B832-EE0998BB2ACF@lists.apple.com>> Content-Type: text/plain; charset=us-ascii -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-05-18-1 OS X: Flash Player plug-in blocked Due to security issues in older versions, Apple has updated the web plug-in blocking mechanism to disable all versions prior to Flash Player 21.0.0.242 and 18.0.0.352. Information on blocked web plug-ins will be posted to: http://support.apple.com/en-us/HT202681 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJXPO2nAAoJEIOj74w0bLRG1yYP/3I1Tuxm7/iCrYQVeMSgU22e EqjHjb/Exy6/rWNzXJc4gBB0OhZpRpLm1sboDDj+QFqx//PcfwHiITJw3WyhSude lbxr9JWKGYL0stPluC5fpNmM7xJjrrM0yhHohPxAHXgIiVOLK6jJFvJy3XA8MMw3 /jlErFVKy9ddGpcue7IEfbrY+Ol+azoSA7YcJI55EwFVuY4y8+icJVi/LZn5whcK aO2l7IRGcV2QcksmddHrraMwjSE3bSfaEbyGFqI8bDJkMoUORbmKjEm6YO818TOI Yln4ncRD2+0DXD1eXrUU5qjRNN+NNKmdM7ZNv2AMUCoP6M4OvP8JSRbKdhvqxzs4 EDiL8P23DYheUxi0zGdqsHYg7GykYZWgR5h2O0srCBEJP8c9vfjnTPvdNAkcZVES 6NV1QvibGdXx2BfT+rUI5DsBQIyuixIkrZSys3N52ErBRKB2qUzQ5HlpPcWTyE1Q RlBq0hpp+nw0SoHDHmBMJjaP2S3jtagLOBFxGvr+CFzxl3Acg4g/9D8t6UL6iaCN dxvTtHuJvA2V1+3YvQSslTH8fcZ72QoYhPvoc/FBYMYXkkERxXuWCILrQ+ijLPe4 aw+w4BwZq1nJl+UnELoXNs6596Pt3NKPD+mubh/L/E6M0ozIvGoBaJ2Sgc6hCPXu HYeXlplv5GixZUqNmFmk =ZPSE -----END PGP SIGNATURE-----

1 0

FYI: older FLASH blocked on OS X: prior to 21.0.0.226
by Wayne Billing 30 Apr '16

30 Apr '16

You can check your version of FLASH at: http://www.adobe.com/software/flash/about/ …from Apple Date: Thu, 28 Apr 2016 15:05:32 -0700 From: Apple Product Security Subject: APPLE-SA-2016-04-28-1 OS X: Flash Player plug-in blocked -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-04-28-1 OS X: Flash Player plug-in blocked Due to security and stability issues in older versions, Apple has updated the web plug-in blocking mechanism to disable all versions prior to Flash Player 21.0.0.226 and 18.0.0.343. Information on blocked web plug-ins will be posted to: http://support.apple.com/en-us/HT202681 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJXIoe5AAoJEBcWfLTuOo7tmKYP/iAiKPfjfX/CtKqPBS+oW4qa rrHETk3f5BODOfc9qFXUPCw6/IfFQ5hEaOJnes1gUWLW9b3Xy7Wn56fgrvUd6vep lBeZbnx3wKfFGgERiXqxqGL+UNC5sepTTUXMX3NsS1LCq9MaLIGQxuuwi0RQR6r7 hTd+xcv5YGD+iVgzHeFUqRZbMqWWo57tAPKALPa7aufUuAirrN814Rif5cgZqP6/ gXv9zgBiZUwe2sdlIWAglxQFbewaghcHMfm8kozVU1oEdbkU72Mfy/Izi6Bj4b1o vLf3bJgYYDiS33ofUYn+k/6T0iUNPsVnRaVVQqJA2giLOZy50McSib7HCp5xcBdD BzLcFWfhY3IzUvHDHMPG+8lygQQ37g/tEkYW66kQAFgXJPVczQXWTXt2Dm93D7w4 kc/g5HxvTaD36GtT7UabgbPWVox7ljIDB1XWKJgviME/Cyh4wGR7DdOUEmFBEUsx ++DXpZSmmoj7FHH9D+P+y44vwasPLZoXJwRHs68UwPd/WmJ96vNG8H9MtiqpWFul QUBCBsbXn+wGDw3RM71kZhG7NovZOUh4UoVR65RfOgwFwB+Poww+AERttYx9uxbW gqAYgOvdOdvb0R/b/f5kKw4hL7sB9Og1FSjuB+VZrjK4pBk0IGRJDN/c16PMRO/z qtB0Zzs5ZisL4zZE8ABx =MBzl -----END PGP SIGNATURE-----

1 0

FYI: CERN OpenData: 300 TB
by Wayne Billing 23 Apr '16

23 Apr '16

…from: http://opendata.cern.ch/about http://www.engadget.com/2016/04/23/cern-300tb-large-hadron-collider-data/ http://techcrunch.com/2016/04/22/cern-releases-300tb-of-large-hadron-collid… CERN Open Data Portal The CERN Open Data portal is the access point to a growing range of data produced through the research performed at CERN. It disseminates the preserved output from various research activities, including accompanying software and documentation which is needed to understand and analyse the data being shared. The portal adheres to established global standards in data preservation and Open Science: the products are shared under open licenses; they are issued with a digital object identifier (DOI) to make them citable objects in the scientific discourse (see details below on how to do this). LHC Data Data produced by the LHC experiments are usually categorised in four different levels (DPHEP Study Group (2009)<http://arxiv.org/abs/0912.0255>). The Open Data portal focuses on the release of data from level 2 and 3. * Level 1 data comprises data that is directly related to publications which provide documentation for the published results * Level 2 data includes simplified data formats for analysis in outreach and training exercises * Level 3 data comprises reconstructed data and simulations as well as the analysis level software to allow a full scientific analysis * Level 4 covers basic raw level data (if not yet covered as level 3 data) and their associated software and allows access to the full potential of the experimental data CERN releases 300TB of Large Hadron Collider data into open access [cid:00733CC4-8A47-4E42-BB67-66F6A2A47C38] CERN just dropped 300 terabytes of collider data on the world. Kati Lassila-Perini, a physicist who works on the Compact Muon Solenoid<http://home.cern/about/experiments/cms> (!) detector, gave a refreshingly straightforward explanation for this huge release. “Once we’ve exhausted our exploration of the data, we see no reason not to make them available publicly,” she said in a news release accompanying the data<http://cms.web.cern.ch/news/cms-releases-new-batch-research-data-lhc>. “The benefits are numerous, from inspiring high school students to the training of the particle physicists of tomorrow. And personally, as CMS’s data preservation coordinator, this is a crucial part of ensuring the long-term availability of our research data.” Amazing that this perspective is not more widely held — though I suspect it is, by the scientists at least, if not the publishers and department heads who must think of the bottom line. The data itself is from 2011, much of it from protons colliding at 7 TeV (teraelectronvolts, you know) and producing those wonderful fountains of rare particles we all love to fail to understand. All told, it’s about half the total data collected by the CMS detector, and makes up about 2.5 inverse femtobarns. But who’s counting? [cmsgiffy]<https://tctechcrunch2011.files.wordpress.com/2016/04/cmsgiffy.gif> There’s both the raw data from the detectors (so you can verify the results) and also “derived” datasets that are more easy to work with — and don’t worry, CERN is providing the tools to do so<http://opendata.cern.ch/search?p=Run2011A%20collection%3ACMS-Tools>, as well. There’s a whole CERN Linux environment ready for booting up in a virtual machine, and a bunch of scripts and apps (some are on GitHub<https://github.com/cms-outreach/ispy-webgl>, too). Just messing around in the same computing environment used by researchers plumbing the depths of the universe would be an interesting way to spend a few labs in a college physics course. There are even “masterclasses,” data sets and tools specially curated for high school kids. This is only the latest of several data dumps, but it’s also by far the largest. A more detailed explanation of the types of data and how they can be accessed is right here<http://opendata.cern.ch/about/CMS>.

1 0

FYI: QuickTime for Windows; iTunes unaffected
by Wayne Billing 14 Apr '16

14 Apr '16

…from: https://www.us-cert.gov/ncas/alerts/TA16-105A http://www.macrumors.com/2016/04/14/apple-ending-quicktime-windows-support/ http://9to5mac.com/2016/04/14/quicktime-for-windows-update/ …others For Windows users who want to uninstall QuickTime, Apple has published a support document<https://support.apple.com/en-us/HT205771> that outlines all of the necessary steps. QuickTime for Mac is not affected. The retirement of QuickTime for Windows has been in the planning stages for at least a few months. Apple has not yet supported QuickTime for Windows 8 or 10, although some users found ways to work around the restriction. The January update removed the browser plugin for QuickTime, making it impossible for video on websites to seamlessly play in a user's browser. As a result, there's little chance QuickTime vulnerabilities could be harnessed into a drive-by download exploit. Instead, exploits would have to rely on social engineering that convinces a user to download a video and open it in QuickTime. For those wondering, iTunes and QuickTime were separated out a couple of years ago and iTunes no longer requires QuickTime to run properly. Alert (TA16-105A) Apple Ends Support for QuickTime for Windows; New Vulnerabilities Announced Original release date: April 14, 2016 Print Document Tweet<https://twitter.com/share?url=https%3A%2F%2Fwww.us-cert.gov%2Fncas%2Falerts…> Like Me<https://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.us-cert.gov%2Fncas%…> Share<http://www.addthis.com/bookmark.php?url=https%3A%2F%2Fwww.us-cert.gov%2Fnca…> Systems Affected Microsoft Windows with Apple QuickTime installed Overview According to Trend Micro, Apple will no longer be providing security updates for QuickTime for Windows, leaving this software vulnerable to exploitation. [1](link is external)<http://blog.trendmicro.com/urgent-call-action-uninstall-quicktime-windows-t…> Description All software products have a lifecycle. Apple will no longer be providing security updates for QuickTime for Windows. [1](link is external)<http://blog.trendmicro.com/urgent-call-action-uninstall-quicktime-windows-t…> The Zero Day Initiative has issued advisories for two vulnerabilities found in QuickTime for Windows. [2](link is external)<http://zerodayinitiative.com/advisories/ZDI-16-241/> [3](link is external)<http://www.zerodayinitiative.com/advisories/ZDI-16-242/> Impact Computer systems running unsupported software are exposed to elevated cybersecurity dangers, such as increased risks of malicious attacks or electronic data loss. Exploitation of QuickTime for Windows vulnerabilities could allow remote attackers to take control of affected systems. Solution Computers running QuickTime for Windows will continue to work after support ends. However, using unsupported software may increase the risks from viruses and other security threats. Potential negative consequences include loss of confidentiality, integrity, or availability of data, as well as damage to system resources or business assets. The only mitigation available is to uninstall QuickTime for Windows. Users can find instructions for uninstalling QuickTime for Windows on the Apple Uninstall QuickTime(link is external)<https://support.apple.com/en-us/HT205771> page. [4] References * [1] Trend Micro - Urgent Call to Action: Uninstall QuickTime for Windows Today(link is external)<http://blog.trendmicro.com/urgent-call-action-uninstall-quicktime-windows-t…> * [2] Zero Day Initiative Advisory ZDI 16-241: (0Day) Apple QuickTime moov Atom Heap Corruption Remote Code Execution Vulnerabilit(link is external)<http://zerodayinitiative.com/advisories/ZDI-16-241/> * [3] Zero Day Initiative Advisory ZDI 16-242: (0Day) Apple QuickTime Atom Processing Heap Corruption Remote Code Execution Vulner(link is external)<http://www.zerodayinitiative.com/advisories/ZDI-16-242/> * [4] Apple - Uninstall QuickTime 7 for Windows(link is external)<https://support.apple.com/en-us/HT205771> Revisions * April 14, 2016: Initial Release

1 0

FYI: Critical Security updates available for Adobe Flash Player
by Wayne Billing 08 Apr '16

08 Apr '16

tl;dr: New version of FLASH to prevent an attacker to take control of the affected system. …from: https://helpx.adobe.com/security/products/flash-player/apsb16-10.html Adobe Security Bulletin Security updates available for Adobe Flash Player Release date: April 7, 2016 Vulnerability identifier: APSB16-10 Priority: See table below<https://helpx.adobe.com/security/products/flash-player/apsb16-10.html#table> CVE number: CVE-2016-1006, CVE-2016-1011, CVE-2016-1012, CVE-2016-1013, CVE-2016-1014, CVE-2016-1015, CVE-2016-1016, CVE-2016-1017, CVE-2016-1018, CVE-2016-1019, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1030, CVE-2016-1031, CVE-2016-1032, CVE-2016-1033 Platform: Windows, Macintosh, Linux and ChromeOS Summary Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and ChromeOS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of reports that CVE-2016-1019 is being actively exploited on systems running Windows 10 and earlier with Flash Player version 20.0.0.306 and earlier. Please refer to APSA16-01<https://helpx.adobe.com/security/products/flash-player/apsa16-01.html>for details. Affected Versions Product Affected Versions Platform Adobe Flash Player Desktop Runtime 21.0.0.197 and earlier Windows and Macintosh Adobe Flash Player Extended Support Release 18.0.0.333 and earlier Windows and Macintosh Adobe Flash Player for Google Chrome 21.0.0.197 and earlier Windows, Macintosh, Linux and ChromeOS Adobe Flash Player for Microsoft Edge and Internet Explorer 11 21.0.0.197 and earlier Windows 10 Adobe Flash Player for Internet Explorer 11 21.0.0.197 and earlier Windows 8.1 Adobe Flash Player for Linux 11.2.202.577 and earlier Linux * To verify the version of Adobe Flash Player installed on your system, access the About Flash Player page<http://www.adobe.com/products/flash/about/>, or right-click on content running in Flash Player and select "About Adobe (or Macromedia) Flash Player" from the menu. If you use multiple browsers, perform the check for each browser you have installed on your system. Solution Adobe categorizes these updates with the following priority ratings<https://helpx.adobe.com/content/help/en/security/severity-ratings.html> and recommends users update their installation to the newest version: Product Updated Versions Platform Priority rating Availability Adobe Flash Player Desktop Runtime 21.0.0.213 Windows and Macintosh 1 Flash Player Download Center<http://www.adobe.com/go/getflash> Flash Player Distribution<http://www.adobe.com/products/players/flash-player-distribution.html> Adobe Flash Player Extended Support Release 18.0.0.343 Windows and Macintosh 1 Extended Support<http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html> Adobe Flash Player for Google Chrome 21.0.0.213 Windows, Macintosh, Linux and ChromeOS 1 Google Chrome Releases<http://googlechromereleases.blogspot.com/> Adobe Flash Player for Microsoft Edge and Internet Explorer 11 21.0.0.213 Windows 10 1 Microsoft Security Advisory Adobe Flash Player for Internet Explorer 11 21.0.0.213 Windows 8.1 1 Microsoft Security Advisory Adobe Flash Player for Linux 11.2.202.616 Linux 3 Flash Player Download Center<http://www.adobe.com/go/getflash> * Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 21.0.0.213 via the update mechanism within the product when prompted [1], or by visiting the Adobe Flash Player Download Center<http://www.adobe.com/go/getflash>. * Adobe recommends users of the Adobe Flash Player Extended Support Release should update to version 18.0.0.343 by visiting http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html. * Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.616 by visiting the Adobe Flash Player Download Center<http://www.adobe.com/go/getflash>. * Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 21.0.0.213 for Windows, Macintosh, Linux and Chrome OS. * Adobe Flash Player installed with Microsoft Edge and Internet Explorer for Windows 10 will be automatically updated to the latest version, which will include Adobe Flash Player 21.0.0.213. * Adobe Flash Player installed with Internet Explorer for Windows 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 21.0.0.213. * Please visit the Flash Player Help<https://helpx.adobe.com/flash-player.html> page for assistance in installing Flash Player. [1] Users of Flash Player 11.2.x or later for Windows, or Flash Player 11.3.x or later for Macintosh, who have selected the option to 'Allow Adobe to install updates' will receive the update automatically. Users who do not have the 'Allow Adobe to install updates' option enabled can install the update via the update mechanism within the product when prompted. Vulnerability Details * These updates harden a mitigation against JIT spraying attacks that could be used to bypass memory layout randomization mitigations (CVE-2016-1006). * These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2016-1015, CVE-2016-1019). * These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-1011, CVE-2016-1013, CVE-2016-1016, CVE-2016-1017, CVE-2016-1031). * These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, CVE-2016-1033). * These updates resolve a stack overflow vulnerability that could lead to code execution (CVE-2016-1018). * These updates resolve a security bypass vulnerability (CVE-2016-1030). * These updates resolve a vulnerability in the directory search path used to find resources that could lead to code execution (CVE-2016-1014). Acknowledgments * Yuki Chen of Qihoo 360 Vulcan Team working with Trend Micro's ZDI (CVE-2016-1015, CVE-2016-1016, CVE-2016-1017) * Tencent PC Manager<http://www.pcmgr-global.com/> working with Trend Micro's ZDI (CVE-2016-1018) * Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero (CVE-2016-1011, CVE-2016-1013) * willj of Tencent PC Manager<http://www.pcmgr-global.com/> (CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1031, CVE-2016-1032, CVE-2016-1033) * Stefan Kanthak (CVE-2016-1014) * bo13oy of CloverSec Labs (CVE-2016-1012) * Kang Yang of Qihoo 360 (CVE-2016-1006) * Nicolas Joly of Microsoft's security team (CVE-2016-1030) * Kafeine (EmergingThreats/Proofpoint) and Genwei Jiang (FireEye, Inc.), as well as Clement Lecigne of Google (CVE-2016-1019)

1 0

FYI: Apple Temporarily Pulls iOS 9.3 Update for Older iOS Devices
by Wayne Billing 26 Mar '16

26 Mar '16

…from: http://www.macrumors.com/2016/03/24/apple-pulls-ios-9-3-older-devices/ [Update: Apple has released a new build of iOS 9.3 for the iPad 2 and may be planning to roll out updates for additional devices. Apple has not yet resumed signing iOS 9.3 for affected devices. ] Apple Temporarily Pulls iOS 9.3 Update for Older iOS Devices Thursday March 24, 2016 5:01 pm PDT by Juli Clover<http://www.macrumors.com/author/juli-clover/> Apple has temporarily stopped offering the iOS 9.3<http://www.macrumors.com/roundup/ios-9> update for older devices like the iPad Air and earlier and the iPhone 5s<http://www.macrumors.com/roundup/iphone-5s> and earlier due to installation issues some users have experienced. On older devices, iOS 9.3 requires users to input the Apple ID and password originally used to set up the device, which can lead to the device becoming stuck at the Activation Lock screen if the original account information can't be recalled. In a statement given to iMore<http://www.imore.com/apple-working-ios-93-fix-ipad-2>, Apple says it is working on a fix and plans to issue a new version of iOS 9.3 in the next few days. Customers with an affected device who attempt to download iOS 9.3 during this time will not be able to install the update as Apple has stopped signing it. [activateiphoneerror] Updating some iOS devices (iPhone 5s and earlier and iPad Air and earlier) to iOS 9.3 can require entering the Apple ID and password used to set up the device in order to complete the software update," an Apple spokesperson told iMore. "In some cases, if customers do not recall their password, their device will remain in an inactivated state until they can recover or reset their password. For these older devices, we have temporarily pulled back the update and will release an updated version of iOS 9.3 in the next few days that does not require this step." For customers who have already installed iOS 9.3 and have gotten stuck at the Activation Lock, Apple has published a support document<https://support.apple.com/en-us/HT206203> with steps on how to solve the issue. Apple recommends removing Activation Lock via iCloud<http://www.macrumors.com/roundup/icloud> or attempting to enter an Apple ID or password through iTunes.

1 0

FYI: Bank of Canada warns of email scam using its name and logo
by Wayne Billing 20 Mar '16

20 Mar '16

I had expected to see this on some news casts but it doesn’t seem to have made it: …from: http://www.cbc.ca/news/business/email-scam-bank-canada-1.3470840?cmp=rss Bank of Canada warns of email scam using its name and logo The Bank of Canada is warning Canadians about an email and social media scam using its name and logos. (Reuters) The Bank of Canada is warning Canadians not to fall for an email scam that tries to extort money or personal information using its name. In a press release Tuesday, it says the scams on email and social media are using its name, logos and letterhead without authorization. It is warning consumers that it does not: * Accept deposits from individuals. * Collect personal or financial information via email. * Request personal or financial information through social media. People should not follow any links included in social media or email messages purported to be from the Bank of Canada, the bank said. Anyone who receives such a message should delete it and contact local authorities. The Bank of Canada is the country's central bank, meaning it sets monetary policy, issues currency and works to keep the financial system stable. The only deposits it handles are from government and financial institutions. The real Bank of Canada can be contacted at www.bankofcanada.ca<http://www.bankofcanada.ca> or at its Public Information Office at 1-800-303-1282, Last year, some Canadians were taken in by fraudsters who pretended to be from the Canada Revenue Agenc<http://www.cbc.ca/news/canada/windsor/canada-revenue-agency-scam-targeting-…>y and demanded "back taxes." Cyber-criminals are increasingly sophisticated in trying to dupe users to extort money or give up personal information that can help them break into bank accounts or credit cards.

1 0

INTEREST: Older Kindle? You Should Update It Immediately
by Wayne Billing 20 Mar '16

20 Mar '16

…from: http://gizmodo.com/if-you-want-to-keep-using-your-kindle-you-need-to-upda-1… If You Want To Keep Using Your Kindle, You Should Update It Immediately If you own one of Amazon’s pre-2012 Kindles, listen up: there’s a critical update that you need to install if you want to keep using it, and you must do so before March 22nd. According to an update on the company’s help community<https://www.amazon.com/gp/help/customer/forums/kindleqna/ref=cs_hc_k_anmt?i…>, a new update is required for anyone using a pre-2012 device that has not connected it to the internet since October 5th, 2015. Customers using an outdated software version on Kindle e-readers, or that have not connected wirelessly since October 5, 2015, require an important software update by March 22, 2016, in order to continue to download Kindle books and use Kindle services. Failure to do so, the company warns, and you won’t be able to connect to Amazon’s Cloud, access the Kindle Store, or use any other services through the device. After March 22nd, you will also have to update the device manually, by downloading the patch and updating it through your computer. Fortunately, Amazon has provided a chart<http://www.amazon.com/gp/help/customer/display.html?nodeId=201994710&tag=gi…> that outlines which Kindles need which updates, and how to go about doing it: Device and Year Software Version Your Device Needs Update via Wireless (2G/3G) or Wi-Fi Kindle 1st Generation (2007) 1.2.1 Use Wireless Kindle 2nd Generation (2009) * 2.5.8 Use Wireless Kindle DX 2nd Generation (2009) * 2.5.8 Use Wireless Kindle Keyboard 3rd Generation (2010) ** 3.4.2 or higher Use Wi-Fi Kindle 4th Generation (2011) 4.1.3 or higher Use Wi-Fi Kindle 5th Generation (2012) 4.1.3 or higher Use Wi-Fi Kindle Touch 4th Generation (2011) ** 5.3.7.3 or higher Use Wi-Fi Kindle Paperwhite 5th Generation (2012) ** 5.6.1.1 or higher Use Wi-Fi Kindle Paperwhite 6th Generation (2013) No Update Needed No Update Needed Kindle 7th Generation (2014) No Update Needed No Update Needed Kindle Voyage 7th Generation (2014) No Update Needed No Update Needed Kindle Paperwhite 7th Generation (2015) No Update Needed No Update Needed The update provides a really good reminder to keep your device up to date, but also the fact that even if your books and purchases are on the cloud, you won’t always be able to reach them. [Amazon<https://www.amazon.com/gp/help/customer/forums/kindleqna/ref=cs_hc_k_anmt?i…>, Engadget<http://www.engadget.com/2016/03/20/amazon-kindle-crucial-update/>]

1 0

INTEREST: accused confirms he did not use security flaws in Gmail or iCloud
by Wayne Billing 16 Mar '16

16 Mar '16

…from: http://www.engadget.com/2016/03/16/celeb-photo-hacker-charged/ Man pleads guilty to hacking celebrity accounts for photos He admitted to phishing users for access to Gmail and iCloud accounts. Mariella Moon , @mariella_moon The celebrities affected by the massive nude photo leak in 2014 got some answers today. A 36-year-old man from Pennsylvania named Ryan Collins has been charged with computer hacking felony for infiltrating over 50 iCloud and 72 Gmail accounts. He has also agreed to plead guilty to one count of unauthorized access to a protected computer, according to the US Attorney's Office of the Central District of California. In his plea deal, Collins admitted to executing a phishing scheme to obtain celebs' usernames and passwords from November 2012 to September 2014. Once he got access to their accounts, he searched for and stole explicit images. In some cases, he even downloaded people's entire iCloud backups. If you'll recall, Apple denied that the hacker exploited an iCloud flaw to access its users' accounts back then. Based on Collins' statement, the company was telling the truth. The hacker didn't take advantage of a security vulnerability: he phished his victims (who include Jennifer Lawrence, Kate Upton and many other female celebrities) or tried to guess their passwords. That's why FBI Assistant Director David Bowdich warns: "We continue to see both celebrities and victims from all walks of life suffer the consequences of this crime and strongly encourage users of Internet-connected devices to strengthen passwords and to be skeptical when replying to emails asking for personal information." The feds aren't done investigating the case yet, but so far, they haven't found any evidence that Collins himself shared or uploaded the images and videos he stole. He's now facing a maximum sentence of five years in prison. If the judge agrees to both sides' recommendations, though, he could be out within 18 months.

1 0

FYI: Adobe issues emergency patch for actively exploited code-execution bug
by Wayne Billing 10 Mar '16

10 Mar '16

[NOTE: if you do not have FLASH installed, you’re finished already] You can check your FLASH version at: https://helpx.adobe.com/flash-player.html …you may see a message similar to this: [cid:4876458E-FF32-41F7-87FE-8CED9BDEC423] …after the upgrade you should see the following on the FLASH test page: [cid:E97F04F3-F084-4F88-9F30-CB47D6EC50F1] ….from: http://arstechnica.com/security/2016/03/adobe-issues-emergency-patch-for-ac… Adobe issues emergency patch for actively exploited code-execution bug Adobe has issued an emergency update for its Flash media player that patches almost two dozen critical vulnerabilities, including one that's being maliciously exploited in the wild. "These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system," Adobe officials wrote in an advisory published Thursday<https://helpx.adobe.com/security/products/flash-player/apsb16-08.html>. "Adobe is aware of a report that an exploit for CVE-2016-1010 is being used in limited, targeted attacks." The notice advises Flash users to install the update as soon as possible. CVE-2016-1010 is the common vulnerabilities and exposures designation for an integer overflow vulnerability that allows attackers to remotely execute malicious code on vulnerable computers. Adobe credited Anton Ivanov of Kaspersky Lab with discovering the zero-day vulnerability but provided no additional details. In an e-mail, a Kaspersky representative wrote: Today Adobe released the security bulletin APSB16-08, crediting Kaspersky Lab for reporting CVE-2016-1010. The vulnerability could potentially allow an attacker to take control of the affected system. Kaspersky Lab researchers observed the usage of this vulnerability in a very limited number of targeted attacks. At this time, we do not have any additional details to share on these attacks as the investigation is still ongoing. Even though these attacks are rare, we recommend that everyone get the update from the Adobe site as soon as possible. The patch brings the latest version of Flash to 21.0.0.182 for Windows and Mac and 11.2.202.577 for Linux. Google Chrome and some versions of Microsoft Internet Explorer and Edge browsers bundle their own version of Flash and will update automatically. Windows 7 users who use Flash must still update manually. Once again, readers are advised to uninstall the Flash, Java, and Silverlight browser extensions to see if they're really necessary. For many people, they aren't, and the significantly decreased attack surface greatly lowers the chances of being visited by remote code-execution attacks. People who rely on Flash to access a company intranet or other site should consider using a dedicated browser for that purpose.

1 0

INTEREST: New York: Apple prevails in forced iPhone unlock case in New York court
by Wayne Billing 29 Feb '16

29 Feb '16

…from: http://arstechnica.com/tech-policy/2016/02/apple-prevails-in-forced-iphone-… http://www.macworld.com/article/3039452/security/judge-strikes-down-order-f… ….others Apple prevails in forced iPhone unlock case in New York court Ruling: All Writs Act can't be used to achieve goal that Congress hasn't granted. by Cyrus Farivar<http://arstechnica.com/author/cyrus-farivar/> - Feb 29, 2016 5:23pm CST A judge in New York ruled Monday<https://www.documentcloud.org/documents/2728314-Orenstein-Order.html> in favor of Apple in a case where investigators wanted the court to compel the company to unlock a seized iPhone 5S running iOS 7, which the company does have the ability to unlock. This case involves a drug dealer who has already pleaded guilty. It pre-dates Apple's current battle with the government over a locked iPhone 5C<http://arstechnica.com/tech-policy/2016/02/apple-fires-back-at-doj-this-is-…> that belonged to one of the shooters in the December 2015 terrorist attack in San Bernardino—that case is due to be heard in court next month in nearby Riverside, California. By contrast, the San Bernardino case involves an iPhone 5c, running iOS 9, which Apple says it cannot unlock. In the California case, federal investigators asked for and received an unprecedented court order compelling Apple to create a new firmware to unlock the device. Last week, Apple formally challenged<http://arstechnica.com/tech-policy/2016/02/apple-fires-back-at-doj-this-is-…> that order, and the outcome is pending. However, on both coasts, Apple is fighting the government's attempt to use the same law, known as the All Writs Act—an obscure catchall statute that dates back to the 18th Century. There are several related AWA cases involving unlocking Apple devices that remain pending nationwide. US Magistrate Judge James Orenstein ruled that what the government was asking for went too far. The ruling, the first of its kind on the topic, has no legal bearing on the outcome of the California case as they are proceeding in different federal judicial districts. Apple hopes, however, that that Riverside judge will be "persuaded" by the decision, according to a company executive who was granted anonymity on a call with reporters. As the judge wrote in his Monday ruling: In short, whatever else the AWA's "usages and principles" clause may be intended to accomplish, it cannot be a means for the executive branch to achieve a legislative goal that Congress has considered and rejected. But because such rejection can take many forms, only one of which (and arguably the least likely in most circumstances) is outright prohibition, the government's argument here is manifestly irreconcilable with the statute. The New York case began back in October 2015, when Judge Orenstein invited Apple to tell the court why it felt that the government<http://arstechnica.com/tech-policy/2015/10/feds-since-apple-can-unlock-ipho…> could not compel it to unlock a seized phone. At the time, bringing Apple into a case like this was new. Nine days later, defendant Jun Feng pleaded guilty<https://www.documentcloud.org/documents/2499370-jun-feng-guilty-plea.html> to one count of conspiracy to distribute and possess with intent to distribute methamphetamine. Judge Orenstein then asked the government why the issue of Apple's compliance was not pointless given the guilty plea. In the government's own filing<https://www.documentcloud.org/documents/2711972-123111286409.html#document/…>, dated October 30, 2015, prosecutors said that the investigation was not over and that it still needed data from Feng's phone. If Feng's phone had iOS 8 or later installed—as 90 percent of iPhones do—this entire issue would likely be moot. Apple now enables full encryption by default, and the company specifically said the move happened<http://arstechnica.com/apple/2014/09/apple-expands-data-encryption-under-io…> "so it's not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8." How far can you go? Another key portion of the ruling showed that Judge Orenstein is particularly concerned with the government’s expansive view of this law, and addressed head-on the government’s assertion that because Apple licenses, rather than sells its software means that the company retains some amount of control over it. As he wrote<https://www.documentcloud.org/documents/2728314-Orenstein-Order.html#docume…>: In a world in which so many devices, not just smartphones, will be connected to the Internet of Things, the government's theory that a licensing agreement allows it to compel the manufacturers of such products to help it surveil the products' users will result in a virtually limitless expansion of the government's legal authority to surreptitiously intrude on personal privacy. … But the concern about whether the AWA, as construed by the government, would confer on the judiciary an overbroad authority to override individual autonomy cannot be so easily avoided in this case. Nothing in the government's arguments suggests any principled limit on how far a court may go in requiring a person or company to violate the most deeply-rooted values to provide assistance to the government the court deems necessary. Judge Orenstein also noted that he "deliberately" asked the government during oral arguments how far its interpretation of the All Writs Act could go. Could federal authorities, for example, compel the manufacturer of lethal injection drugs to make them over corporate moral objections? The government didn’t answer during oral arguments, but said in a later filing that it would simply depend on the circumstances, which Judge Orenstein found unsatisfying. "If the government cannot explain why the authority it seeks here cannot be used, based on the same arguments before this court, to force private citizens to commit what they believe to be the moral equivalent of murder at the government's behest, that in itself suggests a reason to conclude that the government cannot establish a lack of unreasonable burden," he concluded. Orenstein’s opinion parallels arguments that Apple made in its San Bernardino filing<https://www.documentcloud.org/documents/2722196-Motion-to-Vacate-Brief-and-…>just last week. As its lawyers wrote then: Finally, given the government’s boundless interpretation of the All Writs Act, it is hard to conceive of any limits on the orders the government could obtain in the future. For example, if Apple can be forced to write code in this case to bypass security features and create new accessibility, what is to stop the government from demanding that Apple write code to turn on the microphone in aid of government surveillance, activate the video camera, surreptitiously record conversations, or turn on location services to track the phone’s user? Nothing. Headed for the Supreme Court? Similarly, privacy law scholars roundly hoped that this case would exert some influence over the case pending before the court in California. "It's a meticulous and scholarly opinion," Alex Abdo<https://www.aclu.org/bio/alex-abdo>, an attorney for the American Civil Liberties Union, told Ars. "It should be a roadmap for any court considering one of these requests from the government." Rep. Ted Lieu<https://lieu.house.gov/> (D-Calif.), one of just four congressmen to hold a computer science degree, also applauded the ruling. "I am very pleased with the decision, because it validates what I and others have been saying which is that Congress specifically rejected the FBI's proposal to put in backdoors to weaken encryption and now they're trying to do it through a 1789 law that is not appropriate for the situation," he told Ars. The New York case could be appealed up to the 2nd Circuit Court of Appeals, and similarly, the California case could move up to the 9th Circuit Court of Appeals. If those appellate courts disagree with each other as to the limits of the All Writs Act, constituting a "circuit split," that probably would set the stage for a ruling at the nation's highest court. "Ultimately, if the federal courts in California and New York disagree about how much authority the AWA gives the government to force Apple to unlock iPhones, the conflict could only be resolved by Congress clarifying the law or the Supreme Court settling it," Neil Richards<https://law.wustl.edu/faculty/pages.aspx?id=314>, a law professor at Washington University in St. Louis, told Ars.

1 0

FYI: Ethernet stopped working for you?
by Wayne Billing 28 Feb '16

28 Feb '16

Hi. Seems a few Apple machines have been affected by security update ""Incompatible Kernel Extension Configuration Data version 3.28.1”. Apple has repaired the problem so new updates should not be affected but some people are reporting that they’ve received the “broken Configuration Data update”. This configuration file/version can interfere with the working of your Ethernet card. If the Ethernet connection on your Mac stopped working recently, you can follow these steps to restore it. …from: https://support.apple.com/en-us/HT6672 If the Ethernet connection on your Mac stopped working recently If the Ethernet connection on your Mac stopped working recently, check System Information to find out which version of "Incompatible Kernel Extension Configuration Data” is installed. If you have version 3.28.1, you need an update. If you can connect to WiFi, your Mac will update to version 3.28.2 automatically, or you can follow the steps below to restore it manually. First, check your version number: 1. While pressing the Option key, select System Information from the Apple menu. 2. Expand the Software section and select Installations. 3. Click on the Software Name column header to sort the list alphabetically. 4. Look for “Incompatible Kernel Extension Configuration Data.” 5. If the most recent version installed is 3.28.1, then follow the steps below. If you can connect to WiFi, follow these steps to update to version 3.28.2: 1. Open the Terminal app. 2. Type this command to update to the current version of the “Incompatible Kernel Extension Configuration Data” kernel extension: sudo softwareupdate --background 3. Quit Terminal and restart your Mac. If you can't connect to WiFi, follow these steps to update to version 3.28.2: 1. Follow the instructions<https://support.apple.com/kb/HT201314> to restart your Mac in OS X Recovery. After your Mac restarts, go to step 2. 2. Select Disk Utility from the list of OS X Utilities. 3. Select your drive from the list of internal drives in the sidebar. The default name is "Macintosh HD." Your drive might have a different name or location, if you renamed or moved it. 4. If the drive name is gray, then your drive might be protected by FileVault. Select File > Unlock from the Disk Utility menu, and enter your FileVault password. 5. Select File > Mount in Disk Utility to mount your drive, if it's not already mounted. 6. Quit Disk Utility. If you'd like to be able to copy and paste the command required in Step 8, select Get Help Online from the OS X Utilities list to open Safari and view this article on Apple's support site at support.apple.com/kb/HT6672<http://support.apple.com/kb/HT6672>. Quit Safari before you go to the next step. 7. Launch the Terminal app from Utilities > Terminal. 8. Type (or copy and paste) this command as one line in Terminal. In the example below, the drive name is “Macintosh HD," and there's a space between Macintosh and HD. If your Mac's drive name is different, adjust the text: rm -rf “/Volumes/Macintosh HD/System/Library/Extensions/AppleKextExcludeList.kext” 9. Quit the Terminal app. 10. Select Restart from the Apple menu. 11. After your Mac restarts, your Ethernet connection should work. 12. Open the Terminal app and type this command to update to the current version of the “Incompatible Kernel Extension Configuration Data” kernel extension: sudo softwareupdate --background 13. Quit Terminal and restart your Mac. Alternatively, if you confirmed that your Mac has Incompatible Kernel Extension Configuration Data version 3.28.1, you can also follow the instructions<https://support.apple.com/kb/HT201314> to restart your Mac into OS X Recovery mode, and then select Reinstall OS X. You can reinstall OS X on your drive without reformatting it.

1 0

INTEREST: Apple: We tried to help FBI; iCloud password changed
by Wayne Billing 20 Feb '16

20 Feb '16

…from: http://arstechnica.com/tech-policy/2016/02/apple-we-tried-to-help-fbi-terro… Apple: We tried to help FBI terror probe, but someone changed iCloud password Exec: No other country has asked Apple for what US is asking for now. by Cyrus Farivar<http://arstechnica.com/author/cyrus-farivar/> - Feb 19, 2016 8:05pm CST On Friday, an Apple executive explicitly confirmed what was stated in a government court filing<https://www.documentcloud.org/documents/2715997-Apple-iPhone-Access-MOTION-…> earlier in the day: that in the early hours of the San Bernardino terrorism investigation, county officials may have inadvertently compromised their ability to access the data on the seized iPhone 5C. Earlier this week, Apple was given an unprecedented court order<http://arstechnica.com/tech-policy/2016/02/judge-apple-must-help-fbi-unlock…> to create custom firmware for the iPhone 5C that was used by Syed Rizwan Farook. That new firmware would remove a possible automatic wipe feature on the phone if a passcode is incorrectly entered 10 times and would remove a delay between passcode attempts intended to make brute-force entry more difficult. If Apple does comply, it would allow the government to enter PIN codes in rapid succession until it gained access to the phone. Apple CEO Tim Cook has publicly said it will resist this attempt, calling it a significant “overreach.” A court hearing has been scheduled<https://www.documentcloud.org/documents/2716342-Apple-iPhone-Access-Schedul…> for March 22, 2016, in nearby Riverside, California. During the Friday call, the unnamed Apple executive said the company has been diligently working with the FBI to try to aid the terrorism investigation. After days of working with the FBI, Apple proposed one final attempt to recover roughly six weeks of data that was locked on the phone. The idea was to force the iPhone 5C to auto-backup to Farook’s iCloud account. With a legal court order, Apple can and does turn over iCloud data. For some reason, Farook had not backed up the phone for roughly six weeks prior to the attack. The executive said Apple does not know whether the auto-backup was disabled or enabled, but he did say that the previous iCloud backups, which were handed over to investigators, were sporadic. Apple suggested that the FBI take the iPhone 5C, plug it into a wall, connect it to a known Wi-Fi network and leave it overnight. The FBI took the phone to the San Bernardino County Health Department, where Farook worked prior to the December 2, 2015 attack. When that attempt did not work, Apple was mystified, but soon found out that the Apple ID account password had been changed shortly after the phone was in the custody of law enforcement, possibly by someone from the county health department. With no way to enter the new password on the locked phone, even attempting an auto-backup was impossible. Had this iCloud auto-backup method actually functioned, Apple would have been easily able to assist the FBI with its investigation. The executive only revealed this detail to reporters now because it had thought it was under a confidentiality agreement with the government. Apple seems to believe this agreement is now void since the government brought it up in a public court filing. Given that this iCloud backup tactic could not even be attempted, the Department of Justice pulled out all the stops, and asked a judge to order that Apple re-write the firmware. The Apple executive also made a point of saying that no other government—not even China or Russia—has ever asked what American prosecutors have asked the company to do this week. On the call, Apple's press representative refused to articulate why the company would not go on the record with its call with journalists. Also on Friday, the House Committee on Commerce invited both FBI Director James Comey and Apple CEO Tim Cook to testify on the issue of encryption.

1 0

INTEREST: Why FBI's request can affect civil rights for a generation
by Wayne Billing 17 Feb '16

17 Feb '16

Rich Mogull has twenty years experience in information security, physical security, and risk management. He specializes in data security, application security, emerging security technologies, and security management. Prior to founding Securosis, Rich was a Research Vice President at Gartner Inc (garner.com<http://garner.com>) on the security team where he also served as research co-chair for the Gartner Security Summit. Prior to his seven years at Gartner, Rich worked as an independent consultant, web application developer, software development manager at the University of Colorado, and systems and network administrator. Rich is the Security Editor of TidBITS, a monthly columnist for Dark Reading, and a frequent contributor to publications ranging from Information Security Magazine to Macworld. He is a frequent industry speaker at events including the RSA Security Conference and DefCon. …from: http://www.macworld.com/article/3034355/ios/why-the-fbis-request-to-apple-w… Why the FBI's request to Apple will affect civil rights for a generation No legal case applies in a vacuum, and in this case the FBI needs the precedent more than the evidence. [Rich Mogull] Rich Mogull<http://www.macworld.com/author/Rich-Mogull/> | @rmogull<https://twitter.com/rmogull> Contributor, Macworld * Feb 17, 2016 11:14 AM * <http://www.facebook.com/sharer.php?u=http://www.macworld.com/article/303435…'s%20request%20to%20Apple%20will%20affect%20civil%20rights%20for%20a%20generation> * <https://twitter.com/intent/tweet?url=http%3A%2F%2Fwww.macworld.com%2Farticl…> * <https://plus.google.com/share?url=http%3A%2F%2Fwww.macworld.com%2Farticle%2…> * <https://pinterest.com/pin/create/bookmarklet/?url=http%3A%2F%2Fwww.macworld…> * <http://reddit.com/submit?url=http%3A%2F%2Fwww.macworld.com%2Farticle%2F3034…> * <http://www.macworld.com/article/3034355/ios/why-the-fbis-request-to-apple-w…> * 16 <http://www.macworld.com/article/3034355/ios/why-the-fbis-request-to-apple-w…> On Tuesday, the United States District Court of California issued an order requiring Apple to assist the FBI in accessing a locked iPhone<http://www.macworld.com/article/3034028/security/apple-ordered-to-assist-in…> (PDF<https://assets.documentcloud.org/documents/2714001/SB-Shooter-Order-Compell…>)—and not just any iPhone, but the iPhone 5c used by one of the San Bernardino shooters. The order is very clear: Build new firmware to enable the FBI to perform an unlimited, high speed brute force attack, and place that firmware on the device. Apple is not only fighting the request<http://www.macworld.com/article/3034214/security/tim-cook-says-apple-will-o…>, but posted a public letter signed by Tim Cook<http://aos.prf.hn/click/camref:1100laKZ/destination:http://www.apple.com/cu…>and linked on Apple’s front page. Make no mistake: This is unprecedented, and [in this author’s opinion] the situation was deliberately engineered by the FBI and Department of Justice to force a showdown. This is an issue with far-reaching implications well beyond a single phone, a single case, or even Apple itself. As a career security professional, this case has chilling implications. Why now? I’ve been writing about Apple’s role in our digital civil rights since 2014<http://tidbits.com/article/15137>, and specifically addressed why Apple is at the center of the battle over encryption<http://tidbits.com/article/16210> last month on TidBITS. The short version is that Apple is one of the only companies with the technologies, high profile, and business model to both find themselves in the cross hairs, and take a strong position. Apple has a long history of complying with court orders and assisting law enforcement. Previous to iOS 8, they could extract data off devices. Even today, data in most of their online services (iCloud, excluding iMessage and FaceTime) can be provided upon legal request. This case is different for multiple reasons: * Apple is being asked to specifically create new software to circumvent their security controls. They aren’t being asked to use existing capabilities, since those no longer work. The FBI wants a new version of the operating system designed to allow the FBI to brute force attack the phone. * The FBI is using a highly emotional, nationally infamous terrorism case as justification for the request. * The request refers to the All Writs Act, which is itself under scrutiny in a case in New York involving Apple<https://www.eff.org/cases/re-order-apple-all-writs>. Federal Magistrate Judge James Orenstein of the Eastern District of New York is currently evaluating if the Act applies in these cases. That’s why this is about far more than a single phone. Apple does not have the existing capability to assist the FBI. [In this author’s opinion] the FBI engineered a case where the perpetrators are already dead. And the law cited is under active legal debate within the federal courts. The crux of the issue is should companies be required to build security circumvention technologies to expose their own customers? Not “assist law enforcement with existing tools,” but “build new tools.” The FBI Director has been clear that the government wants back doors into our devices<https://www.fbi.gov/news/speeches/going-dark-are-technology-privacy-and-pub…>, even though the former head of the NSA disagrees and supports strong consumer encryption<http://money.cnn.com/2016/01/13/technology/nsa-michael-hayden-encryption/in…>. One reason Apple is likely fighting this case so publicly is that it is a small legal step from requiring new circumvention technology, to building such access into devices. The FBI wants the precedent far more than they need the evidence, and this particular case is incredibly high profile and emotional. The results will, without question, establish precedence beyond one killer’s iPhone. The technical details The court order is quite specific. It applies only to one iPhone [5c owned by San Bernardino shooters], and requests Apple create a new version of the firmware that eliminates the existing feature that erases the iPhone after 10 failed attempts at entering the passcode. It further asks Apple to allow passcode attempts to be performed as rapidly as possible. [passcodes iphone] Apple has been prompting users to choose longer and more complicated—and harder to crack—iPhone passcodes. Beginning with iOS 8, devices are encrypted using a key derived from your passcode. This is combined with a hardware key specific to the device. Apple has no way of knowing or circumventing that key. On newer devices, the hardware key is embedded in the device and is not recoverable. Thus the passcode must be combined with the device key in a chip on the phone, and that chip rate-limits passcode attempts to make a brute force attack slower. Reading through the order, it seems the FBI thinks that a modified version of the operating system would allow them to engage in high-speed attacks, if the 10-tries limit was removed. The request indicates they likely can’t image the device and perform all the attacks on their own super-fast computers, due to that hardware key. With a four-character passcode the device could probably be cracked in hours. A six-character code<http://www.macworld.com/article/3018152/security/switch-to-six-digits-for-y…> might take days or weeks, and anything longer could take months or years. Dan Guido over at Trail of Bits posted a great explanation<http://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-court-…>: As many jailbreakers are familiar, firmware can be loaded via Device Firmware Upgrade (DFU) Mode. Once an iPhone enters DFU mode, it will accept a new firmware image over a USB cable. Before any firmware image is loaded by an iPhone, the device first checks whether the firmware has a valid signature from Apple. This signature check is why the FBI cannot load new software onto an iPhone on their own—the FBI does not have the secret keys that Apple uses to sign firmware. This opens up a few questions. Could this work on newer devices with the enhanced encryption of the Secure Enclave<http://www.macworld.com/article/2999804/security/apple-cant-decrypt-your-ip…>? How can Apple pair the device and replace the firmware in the first place? Would they be using the shooter’s computer? An over-the-air update? Apple says that all devices (with or without the Secure Enclave) are vulnerable to this kind of attack, but declined to comment on the specific technical methods, a position I initially disagreed with, but on reflection is probably the right move for reasons we will get to in a moment. Thus the FBI wants a new version of iOS, signed by Apple and installed on the device, that removes limitations on their attempts to brute-force the password. Why this matters Legal precedent is like a glacier, slowly building over time until it becomes nigh unstoppable. Major issues like this are first, and sometimes ultimately, decided on a series of small steps that build on each other. It’s the reason the NRA fights any attempts at gun control, since they fear a slow build, not a single small law. The crux of this round of the encryption debate is if companies should be forced to build tools to circumvent their customers’ security. If the answer is “yes,” it could be a small step to “should they just build these tools into the OS from the start?” I have no doubt the FBI deliberately chose the highest-profile domestic terrorism case in possibly a decade. We, average citizens, want the FBI to stop this sort of evil. We don’t necessarily see this one case as applying to our lives and our rights. Why the big deal?<http://www.theverge.com/2016/2/17/11031910/donald-trump-apple-encryption-ba…> What if the FBI could find the terrorists’ contacts and stop other attacks? What matters is if we have a right to the security and privacy of our devices and communications. But the truth is, no legal case applies in a vacuum. If this goes through, if Apple is forced to assist, it will open a floodgate of law enforcement requests. Then what about civil cases? Opening a phone to support a messy divorce and child custody battle? Or what about requests from other nations, especially places like China and the UAE that already forced BlackBerry and others to compromise the security of their customers? And once the scale of these requests increases, as a security professional I guarantee the tools will leak, the techniques will be exploited by criminals, and our collective security will decline. It really doesn’t matter if it’s the iPhone 5c or 6s. It really doesn’t matter if this is about dead terrorists or a drug dealer. It doesn’t matter what specific circumvention Apple is being asked to create. What matters is if we have a right to the security and privacy of our devices, and of our communications, which are also under assault. If we have the right to tools to defend ourselves from the government and criminals alike. Yes, these tools will be sometimes used for the worst of crimes, but they’re also fundamental to our civil rights, freedom of discourse, and our ability to protect our digital lives from the less impactful, but far more frequent criminal attacks. [It is the author’s opinion that] this situation was engineered by the FBI and Department of Justice for the maximum impact and chances of success. Apple is fighting, and as a security professional it’s my obligation to support their position, and stronger security.

1 0

FYI: Apple USB-C Charge Cable Replacement Program
by Wayne Billing 12 Feb '16

12 Feb '16

…from: http://www.apple.com/support/usbc-chargecable/ Apple USB-C Charge Cable Replacement Program [USB-C charge cable] Please select a Country Asia Australia België Belgique Brasil България Canada (English) Canada (Français) 中国 Česká republika Danmark Deutschland España Eesti Ελλάδα France Hong Kong (English) 香港 India Indonesia Ireland Italia 日本 대한민국 Κύπρος Latin America América Latina Latvija Lietuva Luxembourg (English) Luxembourg (Français) Luxemburg (Deutsch) Malaysia Magyarország Malta México Nederland New Zealand Norge Österreich Polska Portugal Россия România Saudi Arabia Singapore Slovensko Slovenija Schweiz Suisse Suomi Sverige 台灣 ไทย Türkiye United Arab Emirates United Kingdom United States A limited number of Apple USB-C charge cables that were included with MacBook computers through June 2015 may fail due to a design issue. As a result, your MacBook may not charge or only charge intermittently when it’s connected to a power adapter with an affected cable. Apple will provide a new, redesigned USB-C charge cable, free of charge, to all eligible customers. This program also covers Apple USB-C charge cables that were sold as a standalone accessory. For MacBook owners who provided a valid mailing address during the product registration process or Apple Online Store purchase, Apple will send you a new cable by the end of February 2016. All other eligible MacBook owners should use the replacement process below to receive a new USB-C charge cable. Identifying an affected cable Affected cables have “Designed by Apple in California. Assembled in China.” stamped on them. New, redesigned cables include a serial number after that text. See images below. Affected cable [Affected cable detail] Redesigned cable [Redesigned cable detail] Replacement Process Please choose one of the options below to receive a new USB-C charge cable. We will need your MacBook serial number to verify eligibility for this program. Learn how to find your serial number here<https://support.apple.com/en-us/HT204356>. * Find an Apple Retail Store. Genius Bar reservation recommended. * Find an Apple Authorized Service Provider<https://locate.apple.com/>. * Contact Apple Support. Additional Information This worldwide Apple program does not extend the standard warranty coverage of the MacBook. If you believe you have paid for a replacement due to this issue, contact Apple regarding a refund. The program covers the affected USB-C charge cables until June 8, 2018. Information as of 2016-02-12

1 0

FYI: Uninstalling Facebook app may save up to 15% of iPhone battery life
by Billing Wayne 08 Feb '16

08 Feb '16

….from: http://www.theguardian.com/technology/2016/feb/08/uninstalling-facebook-app… Uninstalling Facebook app saves up to 15% of iPhone battery life Facebook is one of the most downloaded apps on iOS but it has long been cited as a cause of fast-draining iPhone batteries <http://www.theguardian.com/technology/2015/oct/19/facebook-iphone-users-bat…>. Last year it was accused of using background tricks to stay active <https://www.reddit.com/r/iphone/comments/3kvfta/how_is_facebook_doing_so_mu…> even when it wasn’t being used. Facebook admitted bugs existed, and fixed them <https://www.facebook.com/arig/posts/10105815276466163>, but questions of the app’s impact on battery life remained. Similar concerns about Facebook’s Android app led to the discovery that deleting the app saves up to 20% of a phone’s battery <http://www.theguardian.com/technology/2016/feb/01/uninstalling-facebook-app…>. After that revelation, I set about seeing if the same was true for iPhone users. I discovered that uninstalling Facebook’s iOS app and switching to Safari can save up to 15% of iPhone battery life. Using an iPhone 6S Plus <http://www.theguardian.com/technology/2015/oct/02/iphone-6s-plus-review-bar…> for a week without the main Facebook app installed, I recorded the battery life at 10.30pm each day for a week comparing it to a daily average taken from a week with the app. I charged the phone overnight, taking it off the charger at 7.30am, and used it normally. I accessed Facebook for the same amount of time, and for the same purposes, using the social network’s excellent mobile site within Safari, as I had done using the app. I also left the Facebook Messenger app installed. On average I had 15% more battery left by 10.30pm each day. I had also saved space, because at the point I had deleted the Facebook app it had consumed around 500MB in total combining the 111MB of the app <https://itunes.apple.com/gb/app/facebook/id284882215?mt=8> itself and its cache on the iPhone. To make sure that this wasn’t an isolated incident, I also recruited several other Facebook-using iPhone owners to conduct a similar test. They all found similar results, with increased battery life when using Facebook in Safari having uninstalled the main Facebook <http://www.theguardian.com/technology/facebook> iOS app. <https://www.facebook.com/dialog/share?app_id=180444840287&href=http%3A%2F%2…> <https://twitter.com/intent/tweet?text=Uninstalling%20Facebook%20app%20saves…> <http://www.pinterest.com/pin/create/button/?description=Uninstalling+Facebo…> Spot the difference: one is the Facebook app, the other the Facebook mobile site. Photograph: Samuel Gibbs for the Guardian Using Facebook in Safari was almost as good as the app. You can even place a shortcut to Facebook in Safari on the homescreen that looks almost identical to the app’s icon (the white is a little less bright but you need eagle eyes to see). The only restriction was the Share-to function, which does not exist for websites, meaning that to share photos I had to manually hit the “post photos” button on the mobile site. Features of the app, such as Instant Articles, are also not available. Tapping a link on the Facebook mobile site opens a new Safari tab. The results will vary for the smaller iPhone 6S <http://www.theguardian.com/technology/iphone-6s>, as it has a smaller battery and shorter battery life overall, but judging by the 6S Plus experience, removing the Facebook app in preference of using the social network in Safari will extend the battery life of any iPhone. A Facebook spokesperson said the company was investigating the matter.

1 0

INTEREST: Oracle: JAVA's future: one side step
by Wayne Billing 31 Jan '16

31 Jan '16

…from: http://www.macworld.com/article/3027473/security/oracle-is-planning-to-kill… https://blogs.oracle.com/java-platform-group/entry/moving_to_a_plugin_free Migration options: http://www.oracle.com/technetwork/java/javase/migratingfromapplets-2872444.… Oracle's killing a favorite security hole for attackers: the Java browser plug-in Lucian Constantin<http://www.macworld.com/author/Lucian-Constantin/> IDG News Service * Jan 28, 2016 4:26 AM Oracle will retire the Java browser plug-in, frequently the target of Web-based exploits, about a year from now. Remnants, however, will likely linger long after that. “Oracle plans to deprecate the Java browser plugin in JDK 9,” the Java Platform Group said in a blog post<https://blogs.oracle.com/java-platform-group/entry/moving_to_a_plugin_free> Wednesday. “This technology will be removed from the Oracle JDK and JRE in a future Java SE release.” The Java Development Kit (JDK) 9, the reference implementation for the next version of Java SE, is expected to reach general availability<http://openjdk.java.net/projects/jdk9/> in March 2017. By then, however, most modern browsers will no longer accept the Java browser plug-in anyway. Mozilla announced in October that it plans to remove support for plug-ins<https://blog.mozilla.org/futurereleases/2015/10/08/npapi-plugins-in-firefox/> in Firefox by the end of 2016. Chrome disabled support in September for plug-ins that, like Java and Silverlight, use the old Netscape Plugin Application Programming Interface (NPAPI) standard. Microsoft’s Edge browser doesn’t support plug-ins either. With Internet Explorer and Safari the only browsers set to still accept traditional NPAPI plug-ins after 2016, Oracle is pretty much forced into this decision, even though Chrome does support a new plug-in technology called PPAPI (Pepper Plug-in API). “Oracle does not plan to provide additional browser-specific plugins as such plugins would require application developers to write browser-specific applets for each browser they wish to support,” the company said in a white paper<http://www.oracle.com/technetwork/java/javase/migratingfromapplets-2872444.…> that outlines migration options for developers. “Moreover, without a cross-browser API, Oracle would only be able to offer a subset of the required functionality, different from one browser to the next, impacting both application developers and users.” The main alternative proposed by the company is to switch from Java Applets to Java Web Start applications. This type of application can be launched from the Web without the need for a browser plug-in. From a security perspective though, Java Web Start applications can be used as an attack vector for exploiting vulnerabilities in the Java runtime, just like Applets. Even after the Java plug-in is retired, it’s likely that many computers will continue to have it installed for years to come. This is especially true in business environments where custom built Web-based Java applications are common and cannot be easily replaced or rewritten. Even now, for application compatibility reasons, there’s a large number of computers in business environments that continue to use Java 6 or Java 7, versions that no longer receive public security updates.

1 0