Month: August 2019

Enlarge / Android Development: It can be a messy process. (credit: Google)

We are quickly approaching launch day for Android Q, Google's 29th release of Android. At some point in the near future we should see a statue-unveiling, official confirmation that this is "Android 10," and the highly anticipated "Q" snack name [Editor's suggestion]. First though, we have to see the sixth-and-final beta release out the door, which is happening today. Android Q Beta 6 is rolling out to Pixel phones now and participating third-party devices in the coming weeks.

Final APIs for developers were locked down in Beta 4, so Beta 5 and 6 are mostly about squishing bugs and polishing up the final interface. Fully gestural navigation is a major feature of Android Q, and with the Beta 5 launch came the announcement that gesture navigation would not work with third-party home apps at launch, presumably due to a lack of time to work out the pile of bugs that have been reported.

Even with third-party home screen compatibility off the table, it seems like Google will be working on gesture navigation down to the wire. Beta 5 came with a new gesture for the Google Assistant and new rules for developers. In Beta 6, Google says it has "made further refinements to Gesture Navigation in Beta 6 based on user feedback" and now has a sensitivity setting for the back gesture. The back gesture involves swiping in from the edge of the screen, which can interfere with apps that require horizontal scrolling. Newly updated apps are supposed to design around the new back gesture; the sensitivity setting should help find a balance for older apps with conflicting swipe areas.

Enlarge / No need to knock, Electron left the code unlocked. (credit: Getty Images)

LAS VEGAS—The Electron development platform is a key part of many applications, thanks to its cross-platform capabilities. Based on JavaScript and Node.js, Electron has been used to create client applications for Internet communications tools (including Skype, WhatsApp, and Slack) and even Microsoft's Visual Studio Code development tool. But Electron can also pose a significant security risk because of how easily Electron-based applications can be modified without triggering warnings.

At the BSides LV security conference on Tuesday, Pavel Tsakalidis demonstrated a tool he created called BEEMKA, a Python-based tool that allows someone to unpack Electron ASAR archive files and inject new code into Electron's JavaScript libraries and built-in Chrome browser extensions. The vulnerability is not part of the applications themselves but of the underlying Electron framework—and that vulnerability allows malicious activities to be hidden within processes that appear to be benign. Tsakalidis said that he had contacted Electron about the vulnerability but that he had gotten no response—and the vulnerability remains.

Those modifications can create new event-based "features" that can access the file system, activate a Web cam, and exfiltrate information from systems using the functionality of trusted applications—including user credentials and sensitive data. In his demonstration, Tsakalidis showed a backdoored version of Microsoft Visual Studio Code that sent the contents of every code tab opened to a remote website.

Enlarge / There's about a 50% chance your Amazon deliveries will come in a Prime van... and soon, a 0% chance they'll come in a FedEx truck. (credit: Amazon)

Venerable shipper FedEx is cutting one of its few remaining ties with Amazon, saying it won't renew its ground delivery contract with the retail behemoth when the agreement expires at the end of the month.

Bloomberg News first reported the company's decision. FedEx said in a statement that the decision "is consistent with our strategy to focus on the broader e-commerce market."

FedEx ended its US air shipping arrangement with Amazon in June when it declined to renew that contract, but it does still have an agreement with Amazon for international deliveries.

Enlarge (credit: Yuki Shimazu / Flickr)

Nintendo, Microsoft, and Sony will start requiring new and updated games that sell randomized loot boxes on their consoles to reveal the relative odds of getting individual in-game items through those loot boxes.

The announcement came during an FTC panel on loot boxes taking place in Washington, DC today. Entertainment Software Association Chief Counsel Michael Warnecke said that the three major console makers "have indicated to ESA a commitment to new platform policies with respect to the use of paid loot boxes in games that are developed for their platforms."

"Specifically, this would apply to new games and game updates that add loot box features," Warnecke continued. "And it would require the disclosure of the relative rarity or probabilities of obtaining randomized virtual items on their platforms." In a press release, the ESA said the console makers "are targeting 2020 for the implementation of the policy."

Yeeeeeehawwwww! (credit: Psyonix)

Players looking for specific cosmetic items in Rocket League will have an easier time buying them directly in the near future. That's because developer Psyonix has announced that later this year, it will "remove all paid, randomized Crates from Rocket League, replacing them with a system that shows the exact items you’re buying in advance." The company added that "Rocket Pass Premium, DLC Cars, and Esports Shop items will continue to be offered for direct purchase alongside our new system."

The announcement comes a few months after Psyonix was purchased by Epic, a company that announced a similar loot box phaseout for Fortnite: Save the World back in January. Psyonix cites that Fortnite decision explicitly in its announcement, which suggests that the new ownership may have played into the move.

Rocket League has used sales of randomized Crates to distribute cosmetic customization items for in-game cars since 2016. A year ago, the company revealed the rarities and odds for these Crates, showing that the rarest "Black Market" items appear in 1% of Crate purchases. Getting such items with "Painted, Certified, [or] Special Edition" modifiers was even rarer.