Month: May 2018

Enlarge (credit: g4ll4is / Flickr)

Notepad, the text editor that ships with Windows, is not a complicated application. For many, this is its major advantage—by having virtually no features, it cannot go wrong—but especially for software developers, it has often proven an annoyance.

That's because Notepad has traditionally only understood Windows line endings. Windows, Unix, and "classic" MacOS all use different conventions for indicating the end of a line of text. Windows does things correctly: it uses a pair of characters, the carriage return (CR) followed by the line feed (LF). Two characters are needed because they do different things: the CR moves the print head to the start of a line; the LF advances the paper by one line. Separating these is valuable, as it allows for effects such as underlining to be emulated: first print the text to be underlined, then issue a CR, and then print underscore characters.

Unix, however, uses a bare line feed to denote that a new line should be started. Classic MacOS (though not modern macOS) uses a bare carriage return for the same purpose. Given the meaning behind the CR and LF characters, these operating systems are both obviously wrong, but sometimes wrongness is allowed to prevail and persist.

Enlarge (credit: Lisa Brewster / Flickr)

Microsoft on Tuesday patched two Windows vulnerabilities that attackers are actively exploiting in the wild to install malicious apps on the computers of unwitting users.

The first vulnerability resides in the VBScript Engine included in all currently supported versions of Windows. A so-called use-after-free flaw involving the way the engine handles computer memory allows attackers to execute code of their choice that runs with the same system privileges chosen by the logged-in user. When targeted users are logged in with administrative rights, attackers who exploit the bug can take complete control of the system. In the event users are logged in with more limited rights, attackers may still be able to escalate privileges by exploiting a separate vulnerability.

CVE-2018-8174, as the flaw is formally indexed, is being actively exploited by attackers, Microsoft officials said. The vulnerability was discovered by antivirus provider Kaspersky Lab, which then reported it to Microsoft. In the exploits observed by Kaspersky Lab:

Enlarge / This Apple-made graph illustrates the dimensions of the iPhone X display for app developers. (credit: Apple)

Apple posted a note to developers this week saying that, soon, all new app updates in the iOS App Store must support both the iPhone X's display—that is, the notch and the phone's unique screen dimensions—and the iOS 11 SDK. The company will begin enforcing this rule in July.

This is the next phase in a series of announcements and changes from Apple to guide developers into supporting new hardware and software. In February, Apple said that all submissions of new apps must support these same features. In this case, it's not just new apps that have to comply: iOS 11 and iPhone X support will be required to submit updates for existing apps too.

This is the developer update Apple posted: