An anonymous reader writes "Another Mac OS X Trojan has been spotted in the wild; this one exploits Java vulnerabilities just like the Flashback Trojan. Also just like Flashback, this new Trojan requires no user interaction to infect your Apple Mac. Kaspersky refers to it as 'Backdoor.OSX.SabPub.a' while Sophos calls it at 'SX/Sabpab-A.'"

pcritter writes "With the Oracle v. Google trial date set for next Monday, the Judge has asked Google and Oracle to take a position on whether a programming language is copyrightable. This presumably relates to whether Google violated copyright by using a variant of the Java language and its APIs in the Android framework. Oracle, who thinks it can be, has used J.R.R. Tolkein's Elvish language as an examples (PDF) of a language that can be copyrighted. Google disagrees (PDF)."

Trailrunner7 writes "Mozilla is developing a feature in Firefox that would require some user interaction in order for Flash ads, Java scripts and other content that uses plugins to play. In addition to easing system slowdowns, the opt-in for Web plugins is expected to reduce threats posed by exploiting security vulnerabilities in plugins, including zero-day attacks. 'Whether you hate them or love them, content accessed through plugins is still a sizable chunk of the web. So much so, that over 99% of internet users have Flash installed on their browser,' writes Mozilla's Jared Wein, the lead software engineer on the project, in a blog post."

Fluffeh writes "In the third update to Java that Apple has released this week, the update now identifies and removes the most common variants of the Flashback malware that has infected over half a million Apple machines. 'This Java security update removes the most common variants of the Flashback malware,' Apple wrote in the support document for the update. 'This update also configures the Java web plug-in to disable the automatic execution of Java applets. Users may re-enable automatic execution of Java applets using the Java Preferences application. If the Java web plug-in detects that no applets have been run for an extended period of time it will again disable Java applets.'"

An anonymous reader writes "Last year Slashdot ran a story on scientists from the Max-Planck-Institute for Physics of Complex Systems in Dresden, Germany developing a novel method to improve password security. A strong long password is split in two parts; the first part is memorized by a human, and the second part is stored as a CAPTCHA-like image of a chaotic lattice system. Today, after a year of work, the same group at Max Planck Institute released a working prototype online, where everybody can try this technology to encrypt files (Java plugin required)."

twoheadedboy writes "A Flashback variant dubbed Backdoor.Flashback.39 has infected over 600,000 Macs, according to Russian security firm Dr Web. The virulent Flashback trojan infecting Apple machines sparked interest earlier this week after it was seen exploiting a Java vulnerability, although it was actually first discovered back in September last year. The Trojan has a global reach after Dr Web found infected Macs in most countries. More than half of the Macs infected are in the US (56.6 percent), while another 19.8 percent are in Canada. The UK has 12.8 percent of infected Macs."

Trailrunner7 writes with this excerpt from Threatpost: "Mozilla has made a change in Firefox that will block all of the older versions of Java that contain a critical vulnerability that's being actively exploited. The decision to add these vulnerable versions of Java to the browser's blocklist is designed to protect users who may not be aware of the flaw and attacks. 'This vulnerability — present in the older versions of the JDK and JRE — is actively being exploited, and is a potential risk to users. To mitigate this risk, we have added affected versions of the Java plugin for Windows (Version 6 Update 30 and below as well as Version 7 Update 2 and below) to Firefox's blocklist. A blocklist entry for the Java plugin on OS X may be added at a future date. Mozilla strongly encourages anyone who requires the JDK and JRE to update to the current version as soon as possible on all platforms,' Mozilla's Kev Needham said."

Fluffeh writes "Recently, a Judge ordered Oracle and Google to have yet another sit down and chat, but these talks have come to an impasse: 'Despite their diligent efforts and those of their able counsel, the parties have reached an irreconcilable impasse in their settlement discussions,' Judge Paul Grewal of US District Court for the Northern California wrote Monday. 'No further conferences shall be convened. The parties should instead direct their entire attention to the preparation of their trial presentations. Good luck.'"

Reader Fluffeh snips from and links to Ars Technica with the latest chapter in the ongoing Google vs. Oracle fight involving patents, Java, and Android, writing that executives at both companies were "'ordered to hold one last round of settlement talks no later than April 9th, with the trial over Google's alleged use of Java technology in Android set to begin April 16,' though '[t]he last-ditch effort to avoid a trial seems unlikely to succeed. ... Oracle initially accused Google of violating seven patents, but has since dropped most of them. This is due to the U.S. Patent and Trademark Office ruling the patents described technology that was not patentable. Two patents assigned to the Oracle-owned Sun Microsystems remain: #6,061,520 which covers "an improvement over conventional systems for initializing static arrays by reducing the amount of code executed by the virtual machine to statically initialize an array," and #RE38,104 which covers a type of compiler and interpreter."

New submitter LordDCLXVI writes with a review at Tom's Hardware that starts out with some loaded questions about GNOME 3, as included in the newest version of Red Hat's Fedora: "While most other distros are passing up or postponing GNOME Shell, Fedora is full steam ahead. Does Red Hat know something the rest of us don't? Or is GNOME 3 really as bad as everyone says?" Writes LordDCLVXI: "This massive article amounts to a full-blown guide to Fedora 16 'Verne' and complete dissection of GNOME Shell. It begins with an installation guide, with instructions for enabling third-party repos, proprietary graphics drivers, Wi-Fi, Flash, Java, multimedia codecs, and 32-bit libs. Next up is a GNOME Shell tear-down, including customization options and methods to 'fix' the Shell or mimic GNOME 2. Finally, Fedora is benchmarked against Ubuntu 11.10 and Windows 7. [While the author] adds to the voices criticizing GNOME Shell, he also points out that the extensions can empower distributors to create unique, yet compatible layouts. One of the most fair and constructive critiques of GNOME 3 — definitely worth the read, and even makes GNOME 3 worth a second look."

snydeq writes "A hard-to-detect piece of malware that doesn't create any files on the affected systems was dropped onto the computers of visitors to popular news sites in Russia in a drive-by download attack, according to Kaspersky Lab. 'What's interesting about this particular attack is the type of malware that was installed in cases of successful exploitation: one that only lives in the computer's memory. ... It's ideal to stop the infection in its early stages, because once this type of "fileless" malware gets loaded into memory and attaches itself to a trusted process, it's much harder to detect by antivirus programs.'"

eldavojohn writes "A very lengthy and somewhat meandering essay from Crista Videira Lopes has sparked off some discussion of where new programming languages come from. She's writing from the viewpoint of academia, under the premise that new languages don't come from academia. And they've been steadily progressing outside of large companies (with the exception of Java and .NET) into the bedrooms and hobbies of people she identifies as 'designers' or 'lone programmers' instead of groups of 'researchers.' Examples include PHP by Rasmus Lerdorf, JavaScript by Brenden Eich, Python by Guido van Rossum and — of course — Ruby by Yukihiro Matsumoto. The author notes that, as we escape our computational and memory bounds that once plagued programming languages in the past and marred them with ultra efficient syntax in the name of hardware, our new languages are coming from designers with seemingly little worry about the budget CPU being able to handle a large project in the new language. The piece is littered with interesting assertions like 'one striking commonality in all modern programming languages, especially the popular ones, is how little innovation there is in them!' and 'We require scientific evidence for the claimed value of experimental drugs. Should we require scientific evidence for the value of experimental software?' Is she right? Is the answer to studying modern programming languages to quantify their design as she attempts in this post? Given the response of Slashdot to Google's Dart it would appear that something is indeed missing in coercing developers that a modern language has valid offerings worthy of their time."

New submitter mkwan writes "The open-source X Server for Android has hit beta and is now available for download through the Android Market. On Australian networks at least, smartphones are assigned publicly-accessible IP addresses, so it should be possible to display many Linux applications on an Android smartphone simply by setting the DISPLAY environment variable to the phone's IP address followed by :0" The source is available under the MIT license (or Apache; the project page and story disagree) over at Google Code. It doesn't support all of the X protocol and there's no Xlib implementation (i.e. no X11 apps on the device yet except via the NDK if you're lucky), but it is a reimplementation of the X server in Java for Android. You can run remote applications at least.

wiredmikey writes with this extract from Security Week: "On Friday, researchers from security firm Intego reported that a new variant of Flashback is targeting passwords and as a byproduct of infection, Flashback is crashing several notable applications. Flashback was first discovered by Intego in September of 2011. It targets Java vulnerabilities on OS X, two of them to be exact, in order to infect the system. Should Flashback find that Java is fully updated, it will attempt to social engineer the malware's installation, by presenting an applet with a self-signed certificate. The certificate claims to be signed by Apple, but is clearly marked as invalid. However, users are known to skip such warnings, thus allowing the malware to be installed. ... The newest variant will render programs such as Safari and Skype unstable, causing them to crash. Interestingly enough, normally these are stable programs, so if they start suddenly crashing might be a sign of larger issues."

jfruh writes "Hey, remember when Oracle decided to sue Google over claims that Android violated Oracle's Java patents and copyrights? How's that working out? Not so well, it seems! Oracle has been forced to take many of its patents out of the lawsuit due to lack of evidence, and the damages in play now are down to a little less than 4 percent of Oracle's original $6.1 billion claims."

New submitter GrantRobertson writes with a question about quickly developing prototypes for new interface design concepts "My research/tinkering will be along two main lines: (1) Devising entirely new graphical user interface elements, mostly in 2D, though often in a true or simulated 3-D space. I am working on ways to visualize, navigate, and manipulate very, VERY large data-sets of academic research information. (2) Computer based education software, though of a type never seen before. This will combine some of the GUI elements invented in (1) as well as displaying standard HTML or HTML5 content via a browser engine My requirements are: (A) A decent IDE ecosystem; (B) A decent set of libraries, but ones that don't lock me in to a particular mind-set like Swing does in Java. (Boxes in boxes in boxes, Oh My!); (C) An ability to easily draw what I want, where I want and make any surface of that 3D object become a source for capturing events; (D) Ease of cross-platform use. (So others can easily look at my examples and run with them.); (E) No impediments to open-source licensing my code or for others to go commercial with it either (as I have seen when I looked into Qt). So, should I just stick with Java and start looking outside the box for GUI toolkits? Or is there something else out there I should be looking at?" I'm not sure what impediments Qt has to proprietization of software since it's LGPL nowadays; in any case, Qt Quick and GNOME's Clutter seem like they could be a useful. Read on for more context.

jkauzlar writes "The standard Oracle JVM has about sixty 'developer' (-XX) options which are directly related to performance monitoring or tuning. With names such as 'UseMPSS' or 'AllocatePrefetchStyle', it's clear that Joe Schmo Code Monkey was not meant to be touching them, at least until he/she learned how the forbidding inner recesses of the JVM work, particularly the garbage collectors and 'just-in-time' compiler. This dense, 600-page book will not only explain these developer options and the underlying JVM technology, but discusses performance, profiling, benchmarking and related tools in surprising breadth and detail. Not all developers will gain from this knowledge and a few will surrender to the book's side-effect of being an insomnia treatment, but for those responsible for maintaining production software, this will be essential reading and a useful long-term reference." Keep reading for the rest of jkauzlar's review.

DocDyson writes "I'm a dyed-in-the-wool C/C++/Java developer with over 20 years of experience. I'm making a good living and having fun doing back-end Java work right now, but I strongly believe in being a generalist, so I'm finally trying to learn the HTML5/CSS3/JavaScript future of the Web. However, I find JavaScript's weak typing and dynamic nature difficult to adapt to because I'm so used to strongly-typed, compiled languages with lots of compile-time error-checking and help from the IDE. Does anyone out there who has made this transition have any tips in terms of the best tools and libraries to use to make JavaScript more palatable to us old-school developers?"

First time accepted submitter Cara_Latham writes "Hoping to spur innovation and collaboration, Bloomberg LP is opening its market data interfaces to anyone, without cost or restriction. The market data provider's application programming interface (API), known as BLPAPI (Bloomberg LP API), is already used by Bloomberg, its clients and other technology providers to build connections between financial firms' applications and Bloomberg's market data and applications. Today any technology professional, or even students at a university, can access BLPAPI to quickly build connections to market data feeds. The BLPAPI interface works with a number of programming languages and operating systems, including Java, C, C++, .NET, COM and Perl."

waderoush writes "Right now, content publishers who want to reach readers through dedicated mobile apps have to hire a separate engineering team to build each app — one for iOS (based on Objective-C), another for Android (Java), a third for Windows Phone (C#), etc. Yahoo's Platform Technology Group is working on an alternative: a set of JavaScript and HTML-based tools that would handle core UI and data-management tasks inside mobile apps for any operating system, moving developers closer to the nirvana of 'write once, run everywhere.' The tools are gradually being open-sourced — starting with Mojito, a framework for running hybrid server/browser module-widgets ('mojits') — and Yahoo is showing off what they can do in the form of Livestand, the news reader app it released for the iPad in November. In his first extensive public interview about Mojito and the larger 'Cocktails' project, Bruno Fernandez-Ruiz, chief architect at Yahoo's Platform Technology Group, explains how the tools work and why the company is sharing them."