Category: Uncategorised

Reusing four-year old passwords from MySpace for GitHub? (credit: ABC Photo Archives / Getty Images)

On June 14, someone using what appears to have been a list of e-mail addresses and passwords obtained from the breach of "other online services" made a massive number of login attempts to GitHub's repository service. A review of logins by GitHub's administrators found that the attacker had gained access to a number of accounts, according to a blog post by Shawn Davenport, Vice President of Security at GitHub.

It’s not clear what the source of the e-mail/password combinations was, but there are certainly plenty of them out there right now—the recent bounty of "megabreaches," consisting of aged passwords from MySpace, Tumblr, LinkedIn and the dating site Fling, totaled more than 642 million accounts in all. And though they date back more than three years, there may have still been some that were being re-used by their owners on GitHub.

Davenport said that the passwords of the accounts accessed successfully by the attacker have all been reset. GitHub has begun contacting each affected user individually with instructions on how to get back into their account. He also urged GitHub users to enable two-factor authentication for the service and to "practice good password hygiene"—providing a link to an xkcd comic on password strength to explain.

(credit: Dennis Skley)

A federal appeals court ruled Thursday that ISP's such as video-sharing sites like Vimeo are protected by the Digital Millennium Copyright Act for pre-1972 musical recordings uploaded by their users.

The record labels had sued the YouTube-like site and successfully convinced a district court judge that, because pre-1972 recordings fell under state laws and not federal copyright law, the DMCA didn't apply. The 2nd US Circuit Court of Appeals reversed that decision, and also overturned the lower court that ruled the DMCA didn't grant so-called safe-harbor passage to ISPs whose employees saw infringements on their platforms uploaded by their users.

The decision once again affirms that the DMCA extends immunity to Internet Service Providers for the infringement of their customers if an ISP removes material at the request of the right holder. The decision was akin to an earlier and popular decision called Viacom v. YouTube, which the record labels said was off base in the case against Vimeo.

Andrew Cunningham

Is it the fall yet?

4 more images in gallery

I make it a point not to install early betas of software on hardware that I use every day, but of all the software Apple announced at WWDC on Monday, the one that's tempting me the most is WatchOS 3. As many new things as iOS 10 and macOS Sierra both include, the next version of WatchOS is easily the biggest and most obvious improvement over the current one, and now that I've actually seen it in action on real hardware, it’s going to be hard to wait for.

A couple of months ago, I wrote about my first year with the Apple Watch. I've come to enjoy wearing the device even though I remain firmly convinced that most people don't really need one. The things I complained the most about were performance (in general) and consistency (in general). And some of the complaints I had in the original review, namely about the steep learning curve for new users and poor usage of the watch's physical buttons, still stood in WatchOS 2.0.

Let's start with the stuff that Apple has actually gotten rid of: Pressing the side button no longer brings up a Friends view, and swiping up from the bottom no longer brings up Glances. Glances were a decent idea in theory—fast access to snippets of information—but in practice they were hampered both by the watch’s speed and the way that its apps worked. The pauses while your watch and your phone communicated with each other to refresh the Glances made them frustrating and inconsistent, and it turns out that there's not really a need for a simpler, quicker version of a WatchOS app. WatchOS apps are already simple, so why make developers do the extra work?

(credit: Arnold Nijhuis)

We still don't know who he is or whether he works for the Russian government, but one thing is for sure: Guccifer 2.0—the nom de guerre of the person claiming he hacked the Democratic National Committee and published hundreds of pages that appeared to prove it—left behind fingerprints implicating a Russian-speaking person with a nostalgia for the country's lost Soviet era.

Exhibit A in the case is this document created and later edited in the ubiquitous Microsoft Word format. Metadata left inside the file shows it was last edited by someone using the computer name "Феликс Эдмундович." That means the computer was configured to use the Russian language and that it was connected to a Russian-language keyboard. More intriguing still, "Феликс Эдмундович" is the colloquial name that translates to Felix Dzerzhinsky, the 19th Century Russian statesman who is best known for founding the Soviet secret police. (The metadata also shows that the purported DNC strategy memo was originally created by someone named Warren Flood, which happens to be the name of a LinkedIn user claiming to provide strategy and data analytics services to Democratic candidates.)

Quantum Break: not available on Steam.

While some of Microsoft's older game titles, such as Age of Empires II HD (a 2013 update of a 1999 game) are found on Valve's Steam platform, its latest high-profile titles, such as Forza 6 Apex and Quantum Break, are exclusive to the Windows Store. But this is going to change, with Microsoft planning to release more titles on the popular store.

Phil Spencer, head of the Xbox team at Microsoft, was talking on Giant Bomb's E3 stream, via GameSpot. When it comes to PC gaming, the Windows Store is very much an also-ran, with Steam the dominant force. As Spencer noted, "I don't think Valve's hurt by not having [Microsoft's] first-party games in their store right now. They're doing incredibly well." Accordingly, Spencer said that Microsoft "will ship games on Steam again."

Meanwhile, Microsoft's own experience had been more inconsistent. While some games have done well in the Windows Store, with Spencer naming both Forza 6 Apex and Killer Instinct as successful titles, he said that "Quantum Break wasn't our best PC release" and that Gears of War Ultimate Edition was merely "OK."

(credit: Getty Images | chargerv8)

Cable companies still oppose the Federal Communications Commission's attempt to open up the set-top box market but seem to have resigned themselves to accepting some form of regulation.

Industry representatives met with FCC commissioners and staff yesterday to say they are willing to comply with a requirement to deploy applications for third-party set-top boxes using open standards. The apps would have to include all linear and on-demand TV content, but apparently they would not have to allow recording.

This isn't quite what the FCC says it wants. The commission proposed rules that would force pay-TV providers to make video programming—and the right to record video—available to the makers of third-party devices and software. Under the FCC's model, makers of third-party software and equipment could create their own user interfaces through which cable TV subscribers could access their programming. The solution would be similar to CableCard, but it wouldn't require a physical card.

This post was done in partnership with The Wirecutter, a buyer's guide to the best technology. Read the full article with more details and background information here.

(credit: The Wirecutter)

Surge protectors don't last forever. Like lightbulbs, they need to be replaced every few years when they wear out. Just because your old surge protector passes power to your devices doesn't mean it's still actively protecting them—in fact, you probably need a new one. After assessing more than 30 hours of research, and 32 hours of testing by an electrical engineer, we found that most surge protectors that cost just above $20 will provide adequate protection from surges. Our extensive research and testing showed that more-expensive units didn't provide enough additional benefit to be worth their higher cost. And of the units we tested, our top pick is the 10-outlet Tripp Lite TLP1008TEL, because it stops passing power when it's no longer effective at blocking surges.

Most surge protectors rely on an easily ignored LED indicator to tell you when they've ceased protecting your gear. We picked the TLP1008TEL because when its ability to block surges wears out, it cuts the power off entirely. So long as your devices are energized, you know that surge protection remains in place and have no ambiguity as to when it needs to be replaced.