Month: March 2021

Enlarge (credit: Gab.com)

Over the weekend, word emerged that a hacker breached far-right social media website Gab and downloaded 70 gigabytes of data by exploiting a garden-variety security flaw known as an SQL injection. A quick review of Gab’s open source code shows that the critical vulnerability—or at least one very much like it—was introduced by the company’s chief technology officer.

The change, which in the parlance of software development is known as a “git commit,” was made sometime in February from the account of Fosco Marotto, a former Facebook software engineer who in November became Gab’s CTO. On Monday, Gab removed the git commit from its website. Below is an image showing the February software change, as shown from a site that provides saved commit snapshots.

(credit: Archive.vn)

The commit shows a software developer using the name Fosco Marotto introducing precisely the type of rookie mistake that could lead to the kind of breach reported this weekend. Specifically, line 23 strips the code of “reject” and “filter,” which are API functions that implement programming idioms that protect against SQL injection attacks.

Enlarge / At this time, we're unsure whether Mediatonic was paid by Epic in cash, stock options, or golden crowns. (credit: Mediatonic / Aurich Lawson)

On Tuesday, Epic Games, the maker of Unreal Engine and studio behind Fortnite, continued its push into owning a corner of the game- and software-development ecosystem by acquiring Mediatonic, the makers of popular video game series Fall Guys.

The studio, headquartered in London with satellite operations throughout Europe, was formed in 2005 and is mostly known for contract work on licensed games (along with a significant stint making "web" games for platforms like Facebook), only to explode last year with Fall Guys, a quirky, family-friendly twist on the burgeoning "battle royale" genre. The game's 2020 success was propelled in part by a PlayStation Plus giveaway and high viewership on Twitch.

Steam wiggle room?

This studio acquisition means Devolver Digital has been relieved as Fall Guys' publisher. In its stead, Epic Games' ownership of Unreal Engine will be leveraged, as per Mediatonic's announcement on Fall Guys' future:

• 

  The Galaxy S9 Plus with /e/ OS. [credit: e Foundation ]

/e/ OS, the "open-source, pro-privacy, and fully degoogled" fork of Android, is coming to Canada and the USA. Of course, you've always been able to download the software in any region, but now (as first spotted by It's Foss News) the e Foundation will start selling preloaded phones in North America. Previously, /e/ only did business in Europe.

Like normal, the e Foundation's smartphone strategy is to sell refurbished Samsung devices with /e/ pre-loaded. In the US, there are only two phones right now: the Galaxy S9 for $379.99 or a Galaxy S9+ for $429.99. North Americans still have reason to be jealous of Europe, where you can get /e/ preloaded on a Fairphone, which is also Europe-exclusive.

These Samsung phones are used devices, but the site says the devices have "been checked and reconditioned to be fully working at our partner's facilities." The phones have a one-year warranty and are described as "Good-as-New" with "no surprises." An /e/ device means you'll be getting a fork of Android 10, and for ongoing support, the e Foundation says, "We aim to support with at least 3 years of software updates and security patches."