The Almighty Buck

Apple Makes Another Concession On App Store Fees (cnbc.com) 19

Apple said on Monday that companies that offer digital classes or virtual events through iPhone apps won't have to use Apple's App Store in-app purchases through June 2021, enabling them to charge their customers directly without Apple's 30% commission fee. CNBC reports: Apple said the extension was to help businesses by giving them more time to transition in-person events to digital events during the Covid-19 pandemic. "Although apps are required to offer any paid online group event experiences (one-to-few and one-to-many realtime experiences) through in-app purchase in accordance with App Store Review guideline 3.1.1, we temporarily deferred this requirement with an original deadline of December 2020," Apple wrote on its developer blog. "To allow additional time for developing in-app purchase solutions, this deadline has been extended to June 30, 2021." Last week, Apple announced that it planned to reduce its commission to 15% for app developers making under $1 million on Apple's platforms in 2021.
The Courts

Indian Coding Startup WhiteHat Jr Sues Critics (techcrunch.com) 32

Karan Bajaj, an Indian entrepreneur who teaches meditation and in his recent book invites others to live a life away from the noise, is going after the most vocal critics of his startup. From a report: Bajaj, founder of coding platform WhiteHat Jr, has filed a defamation case against Pradeep Poonia, an engineer who has publicly criticized the firm for its marketing tactics, the quality of the courses on the platform, and aggressive takedowns of such feedback. On Monday, WhiteHat Jr, filed a similar case against Aniruddha Malpani, an investor who has shared unflattering feedback about the startup. Most of the customers of WhiteHat Jr, which is aimed at kids, live in America, and demand for its one-to-one classes has surged nearly 90% this year, according to the startup. In the lawsuit against Poonia -- in which Bajaj is seeking $2.7 million in damages -- Poonia has been accused of infringing trademarks and copyright of properties owned by WhiteHat Jr, defaming and spreading misleading information about the startup and its founder, and accessing the company's private communications app.

[...] The lawsuit, riddled with spelling and grammatical errors, appears to be also indicative of just how little criticism WhiteHat Jr, owned by India's second most valuable startup Byju's, is willing to accept. According to internal posts of a Slack channel of WhiteHat Jr shared by Poonia, the startup has aggressively used copyright protection to take down numerous unflattering feedback about the startup in recent months. The suit also raises concern with Poonia accusing WhiteHat Jr of "murdering" an imaginary kid that featured in one of its earlier ads. A 12-year-old child named "Wolf Gupta" appeared in earlier ads of WhiteHat Jr, which claimed that the kid had landed a lucrative job at Google. The kid does not exist, the lawyers of Bajaj say in the suit. Ironically that was also the argument Poonia, who spent a long time trying to unearth more information about this supposed poster child of WhiteHat Jr, was making in his tweets.

Communications

'Code is Sourdough' (increment.com) 70

Romello Goodman, a software engineer at The New York Times, writing at Increment: Like a sourdough starter passed through the hands of many bakers -- some novices, some experienced -- a codebase reflects how teammates communicate with one another. It's a snapshot of our thinking and our best attempts at codifying norms and assumptions. It's a conversation in which each person contributes and is in conversation with those who came before them. With each new feature or bug report, we understand our code better. We identify areas where new logic doesn't quite fit with existing logic. We're constantly in touch with our own past decisions and those of our coworkers. We're working together, trying to harmonize and match one another's thinking patterns and assumptions. We trust one another to make decisions for the good of the team and the organization. Every piece of new code adds to the culture and cultivates our shared understanding.

If code is sourdough, we have an opportunity to better appreciate the histories and context that have gone into it. In software, we tend to think of legacy code as something that should be thrown away or rewritten, often conflating a codebase's age with its health and viability. But code doesn't age in a vacuum. If sourdough can be passed down from person to person over decades, then so can code. The preservation of decisions and experience is tied to the preservation of our codebase. Even when the code itself is no longer being updated, documentation around the logic or the underlying platform and adjacent technologies can keep a codebase and its culture vibrant. You can then pass that culture on for another team to bake with. It might just taste better than you'd expect.

Programming

Will 'Vision AI' Be The Next Frontier for Developers? (venturebeat.com) 44

A partner at an early-stage investment firm argues that "in the 2000s everyone was learning HTML and making a website. In the 2010s everyone was learning to develop mobile apps. In the 2020s all the developers are going to build Vision AI." Where the web had its impact was by digitizing manual paper-based processes... I believe the next big wave is Vision AI, and for the same reason: It offers the opportunity to digitize the next massive trove of information in the world, that which is not on paper but which can be seen through a camera... Why use a temperature sensor when a camera can see reflected light frequencies and determine the temperature? The latest cellphones are integrating LIDAR sensors into their cameras, and I believe the camera sensing suite will become even more sophisticated. Combine this with emerging computer vision technology powered by AI, and together you have Vision AI.

Vision AI has the power to unlock the future of automation in a way not seen since the Web Revolution where every form and phone call was turned into a site, and we unlocked all the resulting searches, analytics, and automated processing that is now commonplace. Just like there are web boot camps, there will soon be computer vision boot camps to enlarge the circle of access to this new technology. Anything you want to count, record, analyze, or store can be obtained by teaching Vision AI to look for it. And that's just capturing the data, the way web forms did. After that unfolds everything we can do with that data. Provide reports, comparisons, and analysis. Make predictions. Profile and advertise. Learn and educate...

The real changes come when computers start measuring and counting things that are either too vast for humans to count — every dead oak tree in California — or too expensive for humans to count — every yeast cell in a culture — or too difficult for humans to perceive — the change in gait that suggests a medical condition.

During this decade we will see boot camps teaching hundreds of thousands of developers to utilize Vision AI tools, just the way we taught millions to code the web. After that, we will see our world for the next level of data that it presents and be able to act on that.

A disclaimer at the end of the article acknowledges that "I currently have a vested interest in eight Vision AI companies."
Open Source

After Restoring YouTube-dl, GitHub Revamps Its Copyright Takedown Policy (engadget.com) 24

On October 23rd GitHub initially complied with a takedown request for the open-source project youtube-dl — and then after 24 days, reinstated it.

"If there's a silver lining to the episode, it's that GitHub is implementing new policies to avoid a repeat of a repeat situation moving forward," reports Engadget: First, it says a team of both technical and legal experts will manually evaluate every single section 1201 claim. In instances where there's any ambiguity to a claim, the company says it will err on the side of developers and leave their repository online. If the company's technical and legal teams ultimately find any issues with a project, GitHub will give its owners the chance to address those problems before it takes down their work. Following a takedown, it will continue to give people the chance to recover their data — provided it doesn't include any offending code.

GitHub is also establishing a $1 million defense fund to provide legal aid to developers against suspect section 1201 claims, as well as doubling down on its lobbying work to amend the DMCA and other similar copyright laws across the world.

Open Source

The Few, the Tired, the Open Source Coders (wired.com) 71

Reader shanen shares a report (and offers this commentary): When the open source concept emerged in the '90s, it was conceived as a bold new form of communal labor: digital barn raisings. If you made your code open source, dozens or even hundreds of programmers would chip in to improve it. Many hands would make light work. Everyone would feel ownership. Now, it's true that open source has, overall, been a wild success. Every startup, when creating its own software services or products, relies on open source software from folks like Jacob Thornton: open source web-server code, open source neural-net code. But, with the exception of some big projects -- like Linux -- the labor involved isn't particularly communal. Most are like Bootstrap, where the majority of the work landed on a tiny team of people. Recently, Nadia Eghbal -- the head of writer experience at the email newsletter platform Substack -- published Working in Public, a fascinating book for which she spoke to hundreds of open source coders. She pinpointed the change I'm describing here. No matter how hard the programmers worked, most "still felt underwater in some shape or form," Eghbal told me.

Why didn't the barn-raising model pan out? As Eghbal notes, it's partly that the random folks who pitch in make only very small contributions, like fixing a bug. Making and remaking code requires a lot of high-level synthesis -- which, as it turns out, is hard to break into little pieces. It lives best in the heads of a small number of people. Yet those poor top-level coders still need to respond to the smaller contributions (to say nothing of requests for help or reams of abuse). Their burdens, Eghbal realized, felt like those of YouTubers or Instagram influencers who feel overwhelmed by their ardent fan bases -- but without the huge, ad-based remuneration. Sometimes open source coders simply walk away: Let someone else deal with this crap. Studies suggest that about 9.5 percent of all open source code is abandoned, and a quarter is probably close to being so. This can be dangerous: If code isn't regularly updated, it risks causing havoc if someone later relies on it. Worse, abandoned code can be hijacked for ill use. Two years ago, the pseudonymous coder right9ctrl took over a piece of open source code that was used by bitcoin firms -- and then rewrote it to try to steal cryptocurrency.

Businesses

Apple To Reduce App Store Fees For Small Businesses With Under $1 Million in Revenues (techcrunch.com) 49

Amid increased regulatory scrutiny over how it runs its App Store, Apple today announced it will reduce the App Store commissions for smaller businesses. Under the new guidelines of the "App Store Small Business Program," as it's called, developers earning up to $1 million per year will only have to pay a 15% commission on in-app purchases, rather than the standard 30% commission. From a report: The new program will launch on Jan. 1, 2021, and will be based on the business's revenues in the previous calendar year -- meaning 2020. This $1 million threshold will be based on how much existing developers made across all their applications on a post-commission basis, Apple notes. That means the businesses could actually earn up to $1.3 million in gross revenues. The reduced fee will also apply to new developers launching their apps for the first time. If, during the course of the year, the developer's apps surpass the $1 million threshold, they'll be moved to the standard commission rate, generally 30%, for the remainder of the year. They'll also then enter the following year at that standard rate, as well. Depending on the developers' business, however, the "standard" rate may not always be 30%. For developers running an auto-renewing subscription business, for example, the standard commission drops to 15% in year two on a per-user basis, based on Apple's existing guidelines. This will not change.
Businesses

Unity Will Groom 80,000 Game Developers With Education Initiative (venturebeat.com) 54

Unity Technologies hopes to groom 80,000 people for game jobs over three years with an education initiative aimed at helping people learn how to program and develop games. From a report: Unity is paying for this program with help from its initial public offering, in which it raised $1.3 billion at a $13.6 billion valuation in September. At the time, it set aside 750,000 shares for the Unity Social Impact fund. That is valued at $83.6 million today, and part of it will be used for the education goal. I think of this as enlightened self-interest. By training people how to use its tools, Unity creates new customers for its game engine, which is the most popular tool for building games. Unity's Jessica Lindl said in an interview with GamesBeat that the company will create learning experiences to help people create a game portfolio, get Unity Certified, and prepare for a new job. "We've formalized a long company philosophy that the world is a better place with more creators in it," Lindl said. "This strategy is around how we are empowering our employees and our creators to foster a more inclusive and sustainable world." The COVID-19 pandemic has created a global recession that has left millions of people around the world out of work. So Unity hopes to address that with an alternative, no-cost path to employment with the launch of "career pathways."
Programming

Why Apple Silicon Needs an Open Source Fortran Compiler (walkingrandomly.com) 113

"Earlier this week Apple announced their new, ARM-based 'Apple Silicon' machines to the world in a slick marketing event that had many of us reaching for our credit cards," writes Mike Croucher, technical evangelist at The Numerical Algorithms Group.

"Simultaneously, The Numerical Algorithms Group announced that they had ported their Fortran Compiler to the new platform. At the time of writing this is the only Fortran compiler publicly available for Apple Silicon although that will likely change soon as open source Fortran compilers get updated."

An anonymous Slashdot reader offers this analysis: Apple Silicon currently has no open source Fortran compiler and Apple themselves are one of the few silicon manufacturers who don't have their own Fortran compiler. You could be forgiven for thinking that this doesn't matter to most users... if it wasn't for the fact that sizeable percentages of foundational data science platforms such as R and SciPy are written in Fortran.
Croucher argues that "More modern systems, such as R, make direct use of a lot of this code because it is highly performant and, perhaps more importantly, has been battle tested in production for decades. Numerical computing is hard (even when all of your instincts suggest otherwise) and when someone demonstrably does it right, it makes good sense to reuse rather than reinvent..."

"The community needs and will demand open source (or at least free) Fortran compilers if data scientists are ever going to realise the full potential of Apple's new hardware and I have no doubt that these are on the way. Other major silicon providers (e.g. Intel, AMD, NEC and NVIDIA/PGI) have their own Fortran compiler that co-exist with the open ones. Perhaps Apple should join the club..."
Microsoft

What Will Happen After Python Creator Guido Van Rossum Joins Microsoft? (thenewstack.io) 108

Programming columnist Mike Melanson assesses the news that Guido Van Rossum, the creator of the Python programming language, has come out of retirement to join Microsoft's developer division: The news brought a flurry of congratulations and feature requests, though a few of the suggested features indeed, already exist. Others still were met with informative responses that make the resulting threads worth a perusal, especially if you're looking for a quick "who's who" on Twitter for the world of programming languages. Microsoft's Miguel de Icaza pointed out that this addition adds to the company's now growing list of language designers and contributors:

"The developer division at Microsoft now employs the language designers and contributors to Python, Java, JavaScript, Typescript, F# C#, C++. We just need some PHP, Rust and Swift magic to complete the picture."

[Microsoft senior software engineer Kat Marchán added "We actually have some early ex-moz Rust people too!"]

So, what can we expect from all of this? Is it a corporate takeover of open source, as some further down in the long list of replies always seem to suggest? Or is Microsoft planning the Frankenstein of all languages, with a little bit of this, a little bit of that? In all likelihood, you Python developers using Microsoft products probably have some good features to look forward to in the near future, and that's that, but there's always lingering fears...especially when it comes to Microsoft. As van Rossum suggests, stay tuned.

After Slashdot's earlier story, long-time reader alexgieg posted his own theory: "Several months ago the Excel folk within Microsoft asked users whether they'd like to have Python as an alternative scripting language in Office. Support for that was overwhelming, but nothing more was said on the matter since then. I guess this is Microsoft's answer."
Programming

How C++ Programming Language Became the Invisible Foundation For Everything, and What's Next (techrepublic.com) 107

The origins of C++ date back 40 years, yet it remains one of the most widely used programming languages today. TechRepublic spoke to C++ creator, Bjarne Stroustrup, to find out why. An excerpt from the interview: Today, Stroustrup is a Technical Fellow at Morgan Stanley. His work with the International Organization for Standardization (ISO) for the C++ standard and on the C++ Core Guidelines are considered part of his role with the finance giant, and he remains very much involved in the development of C++. Most notably, Stroustrup forms part of the direction group, which presents and discusses recommendation about the future of the programming language. He also follows the evolution group, and takes part in discussions about new language features. When it comes to the day-to-day running of C++, however, Stroustrup is happy to take more of a backseat role. "I follow administrative activities but try to do as little as possible there. I am not a great administrator," he admits. Before the pandemic, Stroustrup would travel a lot to teach, and to explain C++ to the world at large through his books, articles, and interviews -- though much like the rest of the world, 2020 has put a temporary end to this.

"For my work, I depend critically on talking with people to learn about their problems and hear how my ideas might help them," Stroustrup says. "In this time of the pandemic, I am deprived of much-needed feedback. Virtual talks and interviews are not the same, and the dynamic of Zoom meetings are inferior to real face-to-face meetings when it comes to discussing design and ideas." The COVID-19 pandemic has also hindered progress with the next two iterations of the language, C++20 and C++23, though Stroustrup affirms that "almost all" of C++20 will ship in 2020. "Beyond that, there is work on Unicode, numerics, game development and low latency, tooling, AI, and much more," he says. "We ship a feature (language and library) when it is ready, and we issue a revised standard every three years. C++14, C++17, and C++20 shipped on time. It is worth noting that the standards effort and the major implementors are very much in sync. "It is crucial that C++ remains coherent and is a stable platform for development."

Python

Python Creator Guido van Rossum Joins Microsoft (techcrunch.com) 77

Guido van Rossum, the creator of the Python programming language, today announced that he has unretired and joined Microsoft's Developer Division. From a report: Van Rossum, who was last employed by Dropbox, retired last October after six and a half years at the company. Clearly, that retirement wasn't meant to last. At Microsoft, van Rossum says, he'll work to "make using Python better for sure (and not just on Windows)." A Microsoft spokesperson told us that the company also doesn't have any additional details to share but confirmed that van Rossum has indeed joined Microsoft. "We're excited to have him as part of the Developer Division. Microsoft is committed to contributing to and growing with the Python community, and Guido's on-boarding is a reflection of that commitment," the spokesperson said.
Programming

On Apple's Piss-Poor Documentation (caseyliss.com) 123

Casey Liss: For the last year or two, I've come to realize that the number one thing that makes it harder for me to do my job is documentation. Or, more specifically, the utter dearth of documentation that Apple provides for its platforms. As a developer, Apple provides us a series of tools -- APIs -- that allow us to make apps on iOS, iPadOS, macOS, and tvOS. In many cases, it's fairly straightforward to figure out how to use these APIs. There's only so many ways you can use a screwdriver, and similarly, in many cases there's only one obvious way to use an API. However, as users rightly demand more complicated and fancy apps, the APIs often need to get more fancy and complicated as well. Suddenly you look up and, instead of only using screwdrivers and hammers, you're using power tools and complicated saws, and everything is much more fiddly than it once was. With real tools, you'd expect to receive an owner's manual, which explains how to use the tool you've just purchased. A rough analogy exists for APIs, insofar as most platform vendors will provide documentation. This is basically the "owner's manual" for that API.

Apple's documentation has, for years, been pretty bad. Over the last couple years, it has gone from bad to awful to despicable to embarrassing. All too often, I go to research how to do something new, and use an API I'm not familiar with, only to be stymied by those three dreaded words:

No overview available.

This is Apple's way of saying "Fuck you, figure it out." No overview available is so bad that a popular Apple resource -- itself something that probably shouldn't have to exist -- used it as its namesake for a single-serving site to highlight how bad Apple's documentation is. The march of progress doesn't help, either. As my friend Adam Swinden pointed out to me on Twitter, as old APIs get deprecated, often times the new ones can't be bothered to include documentation. Check out the difference between this API and the one that replaces it. No overview available. Fuck you, figure it out.

Education

Microsoft: Make 11-Year-Olds 'Future Ready' With Minecraft Python Hour of Code 51

theodp writes: The upcoming "Hack the Classroom: STEM Edition," Microsoft explains, "is a [3-day] free virtual event series designed for K-12 educators, parents, and guardians. The sessions will feature resources and tutorials to help educators support students in learning future-ready skills. These lessons can be easily incorporated into classroom curriculum while preparing for this year's Hour of Code event -- a global effort to teach and demystify coding, during Computer Science Education Week, December 7-13."

Microsoft has boasted that the Hour of Code enabled it to reach tens of millions of schoolchildren each year with its drag-and-drop Minecraft-themed tutorials. New for middle and high schoolers this year is the Minecraft Python Hour of Code, which presumably taps into the just-released Python Content for Minecraft: Education Edition (sample Python 101 Lesson). The Hour of Code is run by Microsoft-funded Code.org, whose Board of Directors include Microsoft President Brad Smith.
Education

Should Retraining Programs for Laid-Off Retail Workers Include Computer Programming? 233

Appearing on ABC, former Chicago Mayor and Obama White House Chief of Staff Rahm Emanuel on Friday volunteered some suggestions for an economic recovery plan that America's next president could implement. "One of the things we've got to do to rebuild, mainly on infrastructure," he begins, before switching to additional ideas for also offering a more promising future to laid-off retail workers by trying to train them for better jobs. "There's going to be people like at JCPenney and other retail — those jobs aren't coming back. Give them the tools..."

One such possible job he offered as an example? Computer programming. "Six months, you're going to become a computer coder. We'll pay for it.... we need to give them a lifeline to what's the next chapter." He believes lots of people would be interested. Although before any of that, Rahm stressed, "The first part of the stimulus is creating a floor so the economy doesn't sink any more. You can't get an economy growing if states and companies are laying people off."

While computer programming was apparently meant as just one example of possible jobs training programs, this appears to have been twisted into claims that Rahm Emanuel believes millions of laid off retail workers should become computer programmers.

Long-time Slashdot reader theodp does point out that Emanuel has held a long-standing faith in the potential of computer science education. ("Before leaving office, Emanuel worked to make Computer Science a high school graduation requirement beginning with the Class of 2020, although the Chicago Public Schools waived the requirement this year, citing the pandemic.") But is that also one possible solution for older generations who didn't receive computer science training in high school?

What do Slashdot's readers think? Leave your own thoughts in the comments. Should the retraining programs offered to laid-off retail workers include computer programming?
Java

Python Overtakes Java To Become The Second-Most Popular Programming Language (techrepublic.com) 103

For the first time in the history of TIOBE's index, Java has slipped out of the top two, leaving Python to occupy the spot behind reigning champion, C. TechRepublic reports: October's TIOBE index had C at No. 1 and Java at No. 2, and historically those two languages have simply traded spaces while the rest of the competition battled it out for the privilege to fall in behind the two perennial leaders. With Python finally overtaking Java in popularity, the future could be one in which everything comes up Python. "In the past, most programming activities were performed by software engineers. But programming skills are needed everywhere nowadays and there is a lack of good software developers," TIOBE CEO Paul Jansen said. "As a consequence, we need something simple that can be handled by non-software engineers, something easy to learn with fast edit cycles and smooth deployment. Python meets all these needs."

Jansen said that he believes this is the case despite claims from others that Python's popularity is due to booms in data mining, AI, numerical computing, and other initiatives that commonly use Python's extensive data processing capabilities. As TechRepublic's R. Dallon Adams wrote in his piece on the October index, Python has been giving Java a run for its money for some time. October saw Python at No. 3 with the largest year-over-year growth percentage in the top 50 languages. Java, still at second place in October, had the largest negative year-over-year growth rate in the top 50 during the same period.
R, Perl, and Go are also all boasting positive growth. "R is in 9th place, the same it occupied last month," reports TechRepublic. "R has experienced explosive growth in 2020, which has led TIOBE to consider it a contender for programming language of the year."
Programming

Should Computer Programming Classes Focus on Projects Instead of 'Logic Puzzles'? (acm.org) 108

Long-time Slashdot reader theodp writes: Writing in the November Communications of the ACM, MIT's Mitchel Resnick and Natalie Rusk explain that the educational use of coding in schools is at a crossroads. The good news? "School systems and policymakers are embracing the idea that coding can and should be for everyone."

The bad news? "In many places, coding is being introduced in ways that undermine its potential and promise. If we do not think carefully about the educational strategies and pedagogies for introducing coding, there is a major risk of disappointment and backlash." To address this, Resnick and Rusk argue, the design of technologies, activities, curriculum, communities, and spaces to support coding and learning should be guided by the "Four Ps" of Creative Learning: Projects, Passion, Peers, and Play:

"To us, it seems natural to introduce coding to young people in a project-oriented way, so that they learn to express themselves creatively as they learn to code. But many introductions to coding take a very different approach, presenting students with a series of logic puzzles in which they need to program animated characters to move from one location to another. When students successfully solve one puzzle, they can move on to the next. Students undoubtedly learn some useful computational concepts while working on these puzzles. But learning to code by solving logic puzzles is somewhat like learning to write by solving crossword puzzles. That's not the way to become truly fluent. Just as students develop fluency with language by writing their own stories (not just playing word games), students develop fluency with coding by creating projects (not just solving puzzles)."

Putting the Four Ps into practice, the authors concede, is easier said than done. "From our observations of Scratch activities around the world over the past decade, we have seen the value of Projects, Passion, Peers, and Play in supporting the development of computational fluency. But we have also seen that it is not easy to put these four principles into practice within the realities of today's standards-based, assessment-driven classrooms."

Programming

After 3-Year Hiatus, 'Pyston' Runtime Returns to Make Python Code Faster (infoworld.com) 27

"Development of Pyston, a variant of the Python runtime that uses just-in-time compilation to speed up the execution of Python programs, is back on again," reports InfoWorld — after a hiatus that began in 2017: Picking up where Dropbox left off, a new development team has released Pyston 2.0. Pyston provides what is ultimately intended to be a drop-in replacement for the standard Python runtime, CPython. It's compatible with Python 3.8, so programs that runs with that version of Python should run as-is on Pyston...

One of the goals of the project was to remain as close as possible to the original implementation of CPython, since many third-party projects make assumptions about CPython behavior. Thus Pyston 2.0 began with the existing CPython codebase and added features from Pyston 1.0 that worked well, such as caching attributes and JITting. Pyston's JIT no longer uses LLVM, but DynASM to emit assembly directly...

[U]nlike the original Pyston incarnation, the new version is closed-source for the time being, as its new stewards determine their business model.

Intel

Hackers Can Now Reverse Engineer Intel Updates Or Write Their Own Custom Firmware (arstechnica.com) 21

An anonymous reader quotes a report from Ars Technica: Researchers have extracted the secret key that encrypts updates to an assortment of Intel CPUs, a feat that could have wide-ranging consequences for the way the chips are used and, possibly, the way they're secured. The key makes it possible to decrypt the microcode updates Intel provides to fix security vulnerabilities and other types of bugs. Having a decrypted copy of an update may allow hackers to reverse engineer it and learn precisely how to exploit the hole it's patching. The key may also allow parties other than Intel -- say a malicious hacker or a hobbyist -- to update chips with their own microcode, although that customized version wouldn't survive a reboot.

"At the moment, it is quite difficult to assess the security impact," independent researcher Maxim Goryachy said in a direct message. "But in any case, this is the first time in the history of Intel processors when you can execute your microcode inside and analyze the updates." Goryachy and two other researchers -- Dmitry Sklyarov and Mark Ermolov, both with security firm Positive Technologies -- worked jointly on the project. The key can be extracted for any chip -- be it a Celeron, Pentium, or Atom -- that's based on Intel's Goldmont architecture.
In a statement, Intel officials wrote: "The issue described does not represent security exposure to customers, and we do not rely on obfuscation of information behind red unlock as a security measure. In addition to the INTEL-SA-00086 mitigation, OEMs following Intel's manufacturing guidance have mitigated the OEM specific unlock capabilities required for this research. The private key used to authenticate microcode does not reside in the silicon, and an attacker cannot load an unauthenticated patch on a remote system."
Youtube

RIAA's YouTube-DL Takedown Ticks Off Developers and GitHub's CEO (torrentfreak.com) 58

An RIAA takedown request, which removed the YouTube-DL repository from GitHub, has ticked off developers and GitHub's CEO. Numerous people responded by copying and republishing the contested code, including in some quite clever ways. Meanwhile, GitHub's CEO is "annoyed" as well, offering help to get the repo reinstated. TorrentFreak reports: Soon after the RIAA notice took YouTube-DL offline many developers spoke out in protest. They believe that the music industry group went too far and started to republish copies of the code everywhere. Over the past several days, we have seen hundreds of new forks and copies appear online. These were also posted to GitHub, where YouTube-DL forks remain easy to find and continue to be uploaded. The code was also posted in some places one wouldn't expect. For example, there's still a copy in GitHub's DMCA notice repository, which some people find quite amusing. And the list of pull requests can be quite entertaining in themselves.

One of the most creative responses we've seen was posted to Twitter by @GalacticFurball who encoded YouTube-DL into images that can be easily shared, encouraging others to share these as well. "I would also suggest that you save and repost the images, as one single source kind of defeats the point. Maybe start a hashtag trend or something. Make songs, and poetry. Get that data out there." This triggered even more creativity, with people finding alternative means to share the code online, all to counter the RIAA's takedown request.

Meanwhile, GitHub's CEO Nat Friedman wasn't sitting still either. While the Microsoft-owned developer platform had to respond to the takedown notice, Friedman himself actively reached out to YouTube-DL's developers to help them get their project reinstated. The CEO joined YouTube-DL's IRC channel hoping to connect with the owner of the repository so he can help to get it unsuspended. "GitHub exists to help developers. We never want to interfere with their work. We want to help the youtube-dl maintainers defeat the DMCA claim so that we can restore the repo," Friedman told TorrentFreak, explaining his actions. GitHub's CEO suggested that YouTube-DL won't be reinstated in its original form. But, the software may be able to return without the rolling cipher circumvention code and the examples of how to download copyrighted material.

Slashdot Top Deals