As a matter of fact, our privacy is getting much worse in 2018

To start, after net neutrality, our real time location data is getting sold to anyone

 Brian Krebs: Why Is Your Location Data No Longer Private?

My favorite part - (so far - I haven't read the whole thing)

"This month, it emerged that the major mobile providers have been giving commercial third-parties the ability to instantly look up the precise location of any mobile subscriber in real time. KrebsOnSecurity broke the news that one of these third parties — LocationSmart — leaked this ability for years to anyone via a buggy component on its Web site.

... 

We also learned that another California company — Securus Technologies — was selling real-time location lookups to a number of state and local law enforcement agencies, and that accounts for dozens of those law enforcement officers were obtained by hackers.  Securus, it turned out, was ultimately getting its data from LocationSmart.

This week, researchers discovered that a bug in T-Mobile’s Web site let anyone access the personal account details of any customer with just their cell phone number, including full name, address, account number and some cases tax ID numbers.

Not to be outdone, Comcast was revealed to have exposed sensitive information on customers through a buggy component of its Web site that could be tricked into displaying the home address where the company’s wireless router is located, as well as the router’s Wi-Fi name and password."

 

How about Uber kicking off the new year?

Happy New Year Everybody

I have to kick off the new year with Uber for obvious reasons, and now, they're leading off the Ars Technica deadpool, and probly others.   Unfortunately Twitter is on there too, and HTC ( which has a geuninely kick-ass VR rig, I think :-( )

We'll see what happens

Until then, I'll be listening to Kara Swisher's podcast for her take on the Uber ( and other ) situations, and her other awesome guests.

Perry

Adobe has completely gone to the dark side - new lightroom is completely on the cloud!

I kid you not.

According to Peter Bright at ARS:

New cloud-imprisoned Lightroom has 1TB of photo storage, same UI across desktop and mobile

You can read it yourself, but I'll pull out the best bits (further emphasis mine):

For the time being, the desktop-based Lightroom Classic will continue to be developed.

The current Lightroom CC is being renamed to Lightroom Classic CC, and a new product with an old name, Lightroom CC, will take its place.

The new Lightroom CC offers most of the photo processing features of Lightroom Classic

"likely" contentious feature: it uploads *ALL* your photos to cloud storage.

Adobe is using that cloud storage to perform object detection (and more!) on your pictures

Umm -  WHAT.  THE.  HUCK. ?

Well, CyberReason is one of the good guys!

Their claim to my respect is that they got an actual "legal" threat from a malware company's "lawyers"!  The company is "TargetingEdge", the malware is "OSX.Pirrit", and it runs on Macs.

Nice, this will tell the FBI exactly who to chase :-)

TargetingEdge claims the software isn't malware, but based on the following, this is like claiming Wilbur in Charlottes Web isn't a pig. According to Amit Serper, who wrote the analysis of the code: Maker of Sneaky Mac Adware Sends Security Researcher Cease-and-Desist Letters

As for OSX.Pirrit malware, it runs under root privileges, creates autoruns and generates random names for itself on each install. Plus, there are no removal instructions and some of its components mask themselves to appear like they’re legitimate and from Apple. And don’t forget that TargetingEdge used domains that appeared to be generated by some sort of DGA and made many attempts to hide any link between the domains and TargetingEdge.

Slashdot starts a good thread: Maker of Sneaky Mac Adware Sends Security Researcher Cease-and-Desist Letters (zdnet.com)

CyberReason's  analysis of the code can be found here

Amit - If I run into you in Boston area, let me buy you a beer!

Even the AP and the New York Times understand that the FCC is lying about Net Neutrality

Here's the AP article making a point-by-point case why Ajit Pai released "his own incomplete and misleading talking points when he suggested that internet providers had never influenced content available to their customers before neutrality rules took effect in 2015."


The New York times has even weighed in to tell us "The F.C.C. Wants to Let Telecoms Cash In on the Internet"
From Slashdot and Ars Technica - As the FCC builds barricades, they won't delay the vote in spite of outstanding court cases that would affect it stating: 

This is just evidence that supporters of heavy-handed Internet regulations are becoming more desperate by the day as their effort to defeat Chairman Pai's plan to restore Internet freedom has stalled. The vote will proceed as scheduled on December 14.

 [ If the opponents are getting so desperate, why did the FCC wait until Thanksgiving week  to announce that the vote killing net neutrality would be in mid December ?

For those who think that the ISP's ( Along with the politicians they bought and paid for, the only beneficiaries of this mess ), won't abuse their monopoly/duopoly in killing the internet,  here's "A brief history"  of ISP internet abuse from Freepress.net ]

Are the days of the C programming language (finally) ending?

Some would argue that the C language is the biggest cause of data security problems, I disagree, since we all know it's people who are the problem.

That said, the fast and loose nature of C is definitely a big contributer to the vulnerabilities, and  I do think that modern programming environments can fix more of that than they do.

In this Slashdot article, open source guru Eric S Raymond posits that C and specifically C++ are way more trouble than they're worth, and being replaced by languages with Garbage collection, like Java sorta, but more like Go, since it scales way better, and not Rust since it's not complete yet.

Really good read, he has a good style and you don't need to be a foll time developer to understand it

Krebs explains how to block leaking of your salary and employment data

Brian Krebs, consumer privacy and cyber security warrior, writes a series of blog posts exposing more privacy-violating practices of the credit reporting agencies, including Experian and Equifax here: https://krebsonsecurity.com/2017/11/how-to-opt-out-of-equifax-revealing-your-salary-history/#more-41495