Android

Google Announces October 6th Event To Launch the Pixel Watch, Pixel 7 (theverge.com) 10

Google has started sending out invites for its fall hardware event, which is set to take place on Thursday, October 6th, at 10AM ET. The Verge reports: The event will launch the upcoming Pixel 7 phones, as well as the Pixel Watch -- the company showed off both devices at its I/O event earlier this year, announcing they're coming in the fall. Since Google's last event, purported leaks have revealed even more about the devices, with both the Watch and phones seemingly making their way into people's hands.

The Pixel 7 seems like it'll be a pretty straightforward continuation of the previous generation of phones, but there's a bit of pressure with the Watch as the "first smartwatch built by Google, inside and out," as its product page on Google's online store says. Google's competitors (namely Samsung and Apple) have been making wearables for years, so the company's entry has to be competent and at least somewhat competitive right out of the gate. So far, details about it are scant -- we don't even know what chip it'll use -- but we should get a clearer picture come October 6th.

Android

Google Launches Third-Party Play Store Billing Pilot, But Only Cuts Fees By 4% (arstechnica.com) 16

An anonymous reader quotes a report from Ars Technica: Google is slowly opening up the Play Store's billing policies. The "user choice billing" pilot program that was announced in March is now accepting sign-ups. Google describes the program in a support article, saying, "This pilot is designed to test offering an alternative billing option next to Google Play's billing system and to help us explore offering this choice to users. We are looking to gain feedback in different countries and ensure we can maintain a positive user experience." Developers interested in billing through an alternative provider can fill out Google's sign-up form, and it sounds like Google will manually review each application. Google won't let developers use the pilot program for games -- the biggest money makers -- but only for apps.

Barring a few promotional tiers, Google and Apple both take around 30 percent not just for purchases of newly downloaded apps but also for digital purchases inside already downloaded apps. Many developers view these fees as excessive, and the push inside both ecosystems to allow third-party billing was originally pitched as a solution to high app store fees. Various regulatory bodies have forced the Google/Apple app store duopoly to open up payments, but Google and Apple have each done so without fixing the core problem of high app store fees. Apple takes a 27 percent cut of purchases processed outside the app store -- basically the original 30 percent fee minus the typical 3 percent processing fee charged by credit card companies. Google is doing something similar with this new program and will only reduce its fees by 4 percent. You'll still need to pay some kind of fee to your third-party payment processor, so with only a 4 percent reduction from Google, developers won't really save money.

Hardware

Lenovo Announces Consumer AR Glasses That Can Tether To iPhones (arstechnica.com) 17

Lenovo is finally selling AR glasses for consumers with the recently-announced Lenovo Glasses T1, which Ars Technica's Scharon Harding got to demo. Here's an excerpt from her report: With their Micro OLED displays and required tether to Windows, macOS, Android, or iOS devices, they bring some notable features to a space that has piqued industry-wide interest but is still likely far from becoming ubiquitous. The early version of the T1 I tried had limited features; I was mostly only able to view a homepage with basic menu options and a desktop with icons for apps, like web browsing. Although the glasses weren't ready for me to watch a movie or hop around apps, I was impressed at how clear text and menu items were. This was in a sunny room with exceedingly tall windows. Even when facing sunlight, the few colors on display seemed vibrant and the text legible.

Lenovo specs the displays with 10,000:1 contrast and 1920x1080 pixels per eye. The glasses are also TUV-certified for low blue light and flicker reduction, according to Lenovo. Much more time is needed to explore and challenge the Micro OLED displays before I pass final judgment. But the combination of smaller pixels and, from what I saw thus far, strong colors, should accommodate screens so close to the eyes. More broadly speaking, brightness can be a concern with OLED technologies, but the small demo I saw fared well in a sun-flushed room.

I used the Glasses T1 while it was connected to an Android smartphone via its USB-C cable, but it's also supposed to work with PCs, macOS devices, and, via an adapter sold separately, iPhones. [...] With no processor or battery, it's easier for the glasses to stay trim. There are also no sensors or cameras like the Lenovo ThinkReality A3, announced last year, has. Other T1 features include a pair of speakers (one near each temple) and the ability to add prescription lenses. [...] The Glasses T1 are expected to be available in select markets in 2023 after debuting in China (as the Lenovo Yoga Glasses) this year. Lenovo didn't set a price, but I was told it's hoping to keep the glasses under $500.

Android

Google Play To Ban Android VPN Apps From Interfering With Ads (theregister.com) 36

An anonymous reader quotes a report from The Register: Google in November will prohibit Android VPN apps in its Play store from interfering with or blocking advertising, a change that may pose problems for some privacy applications. The updated Google Play policy, announced last month, will take effect on November 1. It states that only apps using the Android VPNService base class, and that function primarily as VPNs, can open a secure device-level tunnel to a remote service. Such VPNs, however, cannot "manipulate ads that can impact apps monetization."

The rules appear to be intended to deter data-grabbing VPN services, such as Facebook's discontinued Onavo, and to prevent ad fraud. The T&Cs spell out that developers must declare the use of VPNservice in their apps' Google Play listing, must encrypt data from the device to the VPN endpoint, and must comply with Developer Program Policies, particularly those related to ad fraud, permissions, and malware.

Blokada, a Sweden-based maker of an ad-blocking VPN app, worries this rule will hinder at least the previous iteration of its software, v5, and other privacy-oriented software. "Google claims to be cracking down on apps that are using the VPN service to track user data or rerouting user traffic to earn money through ads," Reda Labdaoui, marketing and sales manager at Blokada, wrote last week in a a forum post. "However, these policy changes also apply to apps that use the service to filter traffic locally on the device." Labdaoui suggests Blokada v6, which launched in June, should not be affected because it does filtering in the cloud without violating Google's device policies. But other apps may not be so fortunate.

Facebook

Facebook is Shutting Down Its Standalone Gaming App in October (techcrunch.com) 6

Just over two years after its launch, Facebook is shutting down the Facebook Gaming app on October 28, 2022. Now, when you open the app, you'll see a banner stating that the app will no longer be available on iOS and Android after that date. The app also won't be available on the Google Play Store or the Apple App Store. From a report: "Despite this news, our mission to connect players, fans and creators with the games they love hasn't changed, and you'll still be able to find your games, streamers and groups when you visit Gaming in the Facebook app," the notice reads. "We want to extend our heartfelt thanks to all of you for everything that you've done to build a thriving community for gamers and fans since this app first launched."

If you've been using the app, you can download your search data before the app is discontinued. The app launched in April 2020 toward the start of the COVID-19 pandemic as a way for users to watch their favorite streamers, play instant games and take part in gaming groups. Facebook experienced some hurdles trying to launch the app, as Apple rejected the app numerous times, citing its rules that prohibit apps with the main purpose of distributing casual games. Apple's rules forced Facebook to remove actual gameplay functionality from the app.

Android

Truth Social's Google Play Store Holdup (axios.com) 158

Google hasn't yet approved Truth Social's Android app for distribution via its Play Store because of insufficient content moderation, a Google spokesperson tells Axios. From the report: Truth Social CEO Devin Nunes last week claimed the decision about when the app would be available on Android "is up to Google," but Google insists that the ball is in Truth Social's court. What Nunes is saying: "I don't know what's taking them so long."

What Google is saying: "On Aug. 19, we notified Truth Social of several violations of standard policies in their current app submission and reiterated that having effective systems for moderating user-generated content is a condition of our terms of service for any app to go live on Google Play." "Last week Truth Social wrote back acknowledging our feedback and saying that they are working on addressing these issues." A source says that Google's concerns relate to content such as physical threats and incitements to violence.

Displays

Germany Orders Shutdown of Digital Ad Displays To Save Gas (theregister.com) 117

An anonymous reader quotes a report from The Register: Germany has ordered overnight shutdowns for non-essential digital signage, to save its reserves of natural gas for more important purposes. Like many European nations, Germany relies on natural gas imported from Russia. And thanks to Russia's illegal invasion of Ukraine, that gas is currently in short supply. The European Union has therefore implemented an energy saving plan. One of Germany's tactics is requiring digital signage in shop windows and other non-essential locations to be turned off between 10:00PM and 6:00AM. Germany will also stop external lighting of some public buildings and implement many other power-saving measures. The plan [PDF] requiring the switch-off was published on August 12, with a deadline of September 1.

But as German outlet Invidis reports, the regulation was unhelpfully vague. For starters an updated ordinance [PDF] appears to have made the simple mistake of substituting 06:00 and 16:00 -- meaning digital signage could only run from 4PM to 10PM. Invidis also pointed out that digital signage at bus stops and train stations can do double duty displaying ads and timetable information. Exceptions for such dual-purpose signs have been arranged. Those errors and ambiguities have reportedly left those who run digital signs unsure of what they needed to do and worried they might miss the deadline.

Further complicating matters is a requirement to turn off the screens altogether rather than leaving the displays blank. Digital signage is seldom switched off, and retail staff will have to learn how to do that. Many digital signs also include a computer -- some are Android machines, others use compute sticks, the Intel NUC and even the Raspberry Pi. Admins will therefore need to cope with extra reboots. And then there's the matter of content updates, which are often scheduled overnight. All of which adds up to a stressful moment for admins of digital signage, and not much time to get things right.

Android

Will Google's 'Cross-Device' Development Kit Bring Android Apps to Non-Android Devices? (theverge.com) 20

Google is trying "to make it easier for developers to create Android apps that connect in some way across a range of devices," reports the Verge. Documentation for the software development kit says it will simplify development for "multi-device experiences."

"The Cross device SDK is open-source and will be available for different Android surfaces and non-Android ecosystem devices (Chrome OS, Windows, iOS)," explains the documentation, though the current developer preview only works with Android phones and tablets, according to the Verge.

But they report that Google's new SDK "contains the tools developers need to make their apps play nice across Android devices, and, eventually non-Android phones, tablets, TVs, cars, and more." The SDK is supposed to let developers do three key things with their apps: discover nearby devices, establish secure connections between devices, and host an app's experience across multiple devices. According to Google, its cross-device SDK uses Wi-Fi, Bluetooth, and ultra-wideband to deliver multi-device connectivity.... [I]t could let multiple users on separate devices choose items from a menu when creating a group food order, saving you from passing your phone around the room. It could also let you pick up where you left off in an article when swapping from your phone to a tablet, or even allow the passengers in a car to share a specific map location with the vehicle's navigation system.

It almost sounds like an expansion of Nearby Share, which enables users on Android to transfer files to devices that use Chrome OS and other Androids. In April, Esper's Mishaal Rahman spotted an upcoming Nearby Share update that could let you quickly share files across the devices that you're signed into Google with. Google also said during a CES 2022 keynote that it will bring Nearby Share to Windows devices later this year.

"This SDK abstracts away the intricacies involved with working with device discovery, authentication, and connection protocols," argues Google's blog post, "allowing you to focus on what matters most — building delightful user experiences and connecting these experiences across a variety of form factors and platforms."
Privacy

DuckDuckGo Opens Up Its Free Email Privacy Service To Everyone (engadget.com) 41

Last year, DuckDuckGo announced a free service designed to fend off email trackers and help people protect their privacy. The Email Protection beta was initially available through a waitlist. Now, it's now in open beta, meaning everyone can try it without having to wait for access. From a report: Email Protection is a forwarding service that removes trackers from messages. DuckDuckGo will tell you which trackers it scrubs as well. During the waitlist beta, DuckDuckGo says it found trackers in 85 percent of testers' emails. Anyone can now sign up for an @duck.com email address, which will work across desktop, iOS and Android. DuckDuckGo says you can create unlimited private email addresses, including a throwaway one for every website, if you prefer. You can also deactivate an address at any time.
Operating Systems

Google's Fuchsia OS is Taking Over Smart Displays, Now on Its Second Device (arstechnica.com) 23

The kingdom of Google's third major operating system, Fuchsia, is growing a little wider today. ArsTechnica: 9to5Google reports Google completed the rollout of Fuchsia to the Google Nest Hub Max. Along with the original Nest Hub/Google Home Hub, that puts two of Google's three smart displays on the new OS, with the one holdout being the 2nd Gen Nest Hub. The Nest Hub Max is the first device running Fuchsia that Google is currently selling -- the Home Hub only got Fuchsia after it had been discontinued. The Google smart display user interface is written in Flutter, a Google programming language designed for portability, which runs on Android, iOS, Fuchsia, and the weird cast platform Nest Hubs typically use. So it's not right to describe the user interface as "similar" after the OS swap -- it's the exact same code because Flutter runs on nearly everything.

You are getting a slightly newer code version, though, and it comes with a Bluetooth menu. If you dive into the settings and hit "about device," you'll see a "Fuchsia Version" field that will say something like "6.20211109.1.3166243." It's a bit weird to do an entire OS switch to the futuristic, secretive Fuchsia project and then have basically nothing to show (or say) for it in terms of obvious improvements in performance or security. You can dive into the minutia of the Fuchsia source code, but it continues to be a mystery in terms of what practical benefits it offers consumers. Google never talks about Fuchsia, so not much is known about what, exactly, Google is accomplishing here.

China

TikTok Owner ByteDance Quietly Launches Search App in China (scmp.com) 3

ByteDance, owner of the hit short video app TikTok, has quietly launched a new search engine that promises no advertisements in a cyberspace where Google has not been available for more than a decade. From a report: Without any announcement, ByteDance subsidiary Beijing Infinite Dimension Technology launched the Wukong search app this month, within days of Tencent Holdings shutting down on August 8 its Sogou search app. Sogou, which Tencent bought last year, still maintains its web-based search engine. Wukong, currently available on Apple's App Store in China and various Chinese Android app stores, brings ByteDance into closer competition with Baidu, China's dominant search engine. The new app promotes itself as providing "quality information and search without ads." The line could be interpreted as an indirect jab at Baidu, which has long faced criticism for its paid listings in search results. In 2016, 21-year-old college student Wei Zexi died of a rare cancer after he received experimental treatments recommended by Baidu.
Google

Google Pixel Sees Huge Sales Growth, Has 2% of North American Market (arstechnica.com) 29

Canalys' North American smartphone market share numbers are out, and the big mover for Q2 2022 is once again Google, which is seeing huge growth numbers thanks to the Pixel 6. Last quarter, Canalys had Google up 380 percent year over year, and this quarter, the company is up 230 percent! ArsTechnica adds: That sounds incredibly successful, but this is Google's tiny hardware division we're talking about, so it's all relative success. The company is now at 2 percent North American market share, having shipped 800,000 devices for Q2 2022. Along with last quarter, Google is now regularly hitting whole-digit market share numbers. That's good enough for fifth place, behind Apple (52 percent), Samsung (26 percent), Lenovo/Motorola (9 percent), and TCL (5 percent). Canalys also has a list of the best-selling models. The top five are all iPhones, of course, with the base model iPhone 13 taking the top spot, followed by the super-cheap iPhone SE. The iPhone 13 Mini, which is rumored to be selling so poorly that there won't be an iPhone 14 Mini, took the ninth spot. The first Android phone on the list, the flagship Galaxy S22 Ultra, clocks in at No. 6.
Youtube

YouTube Launches a Dedicated 'Explore' Page For Podcasts (9to5google.com) 7

The first fruit of YouTube's new podcast strategy has taken shape with a new "Explore" page "Podcasts." 9to5Google reports: youtube.com/podcasts is now live and is linked to on the existing Explore page alongside: Trending, Music, Movies & Shows, Live, Gaming, News, Sports, Learning, and Fashion & Beauty. It appears to have first gone live in late July, and is slowly becoming more widely available as it's not showing up for all users we checked with today. Available on desktop web and mobile, it's very rudimentary at this point. There are carousels, which can be expanded via "Show all," for "Popular episodes," "Popular podcast playlists," "Recommended," and "Popular podcast creators." The rest of this page links to various categories: Comedy, True Crime, Sports, Music, and TV & Film.

You're just browsing through regular video thumbnails rather than anything more optimized. Meanwhile, tapping one just opens the regular player on Android, and doesn't even default to the "Listening controls" available for YouTube Premium subscribers. You get large buttons and shortcuts to like, save, and quickly adjust playback speed. The podcast experience for end users will presumably get more optimized over time, while it remains to be seen what the UI in YouTube Music is going to be.

Cellphones

Erik Prince Wants To Sell You a 'Secure' Smartphone That's Too Good To Be True (technologyreview.com) 86

MIT Technology Review obtained Prince's investor presentation for the "RedPill Phone," which promises more than it could possibly deliver. From the report: Erik Prince's pitch to investors was simple -- but certainly ambitious: pay just 5 million euros and cure the biggest cybersecurity and privacy plagues of our day. The American billionaire -- best known for founding the notorious private military firm Blackwater, which became globally infamous for killing Iraqi civilians and threatening US government investigators -- was pushing Unplugged, a smartphone startup promising "free speech, privacy, and security" untethered from dominant tech giants like Apple and Google. In June, Prince publicly revealed the new phone, priced at $850. But before that, beginning in 2021, he was privately hawking the device to investors -- using a previously unreported pitch deck that has been obtained by MIT Technology Review. It boldly claims that the phone and its operating system are "impenetrable" to surveillance, interception, and tampering, and its messenger service is marketed as "impossible to intercept or decrypt."

Boasting falsely that Unplugged has built "the first operating system free of big tech monetization and analytics," Prince bragged that the device is protected by "government-grade encryption." Better yet, the pitch added, Unplugged is to be hosted on a global array of server farms so that it "can never be taken offline." One option is said to be a server farm "on a vessel" located in an "undisclosed location on international waters, connected via satellite to Elon Musk's StarLink." An Unplugged spokesperson explained that "they benefit in having servers not be subject to any governmental law." The Unplugged investor pitch deck is a messy mix of these impossible claims, meaningless buzzwords, and outright fiction. While none of the experts I spoke with had yet been able to test the phone or read its code, because the company hasn't provided access, the evidence available suggests Unplugged will fall wildly short of what's promised.

[...] The UP Phone's operating system, called LibertOS, is a proprietary version of Google's Android, according to an Unplugged spokesperson. It's running on an unclear mix of hardware that a company spokesperson says they've designed on their own. Even just maintaining a unique Android "fork" -- a version of the operating system that departs from the original, like a fork in the road -- is a difficult endeavor that can cost massive money and resources, experts warn. For a small startup, that can be an insurmountable challenge. [...] Another key issue is life span. Apple's iPhones are considered the most secure consumer device on the market due in part to the fact that the company offers security updates to some of its older phones for six years, longer than virtually all competitors. When support for a phone ends, security vulnerabilities go unaddressed, and the phone is no longer secure. There is no information available on how long UP Phones will receive security support.
"There are two things happening here," says Allan Liska, a cyberintelligence analyst at the cybersecurity firm Recorded Future. "There are the actual attempts to make real secure phones, and then there is the marketing BS. Distinguishing between those two can be really hard."

"When I worked in US intelligence, we [penetrated] a number of phone companies overseas," says Liska. "We were inside those phone companies. We could easily track people based on where they connected to the towers. So when you talk about being impenetrable, that's wrong. This is a phone, and the way that phones work is they triangulate to cell towers, and there is always latitude and longitude for exactly where you're sitting," he adds. "Nothing you do to the phone is going to change that."

The UP Phone is due out in November 2022.
Google

Five Years Later, Google is Still All-in on Kotlin (techcrunch.com) 40

An anonymous reader shares a report: It's been just over five years since Google announced at Google I/O 2017 that it would make Kotlin, the statically typed language for the Java Virtual Machine first developed by JetBrains, a first-class language for writing Android apps. Since then, Google took this a step further by making Kotlin its preferred language for writing Android apps in 2019 -- and while plenty of developers still use Java, Kotlin is quickly becoming the default way to build apps for Google's mobile operating system. Back in 2018, Google and JetBrains also teamed up to launch the Kotlin Foundation.

Earlier this week, I sat down with Google's James Ward, the company's product manager for Kotlin, to talk about the language's role in the Android ecosystem and beyond, as well as the company's future plans for it. It's no surprise that Google's hope is that over time, all Android developers will switch over to Kotlin. "There is still quite a bit of Java still happening on Android," Ward said. "We know that developers are generally more satisfied with Kotlin than with Java. We know that they're more productive, the quality of applications is higher and so getting more of those people to move more of their code over has been a focus for us. The interoperability of Kotlin ... with Java has made it that people can kind of progressively move code bases over and it would be great to get to the point down the road, where just everything is all Kotlin."

Android

The Upcoming Pixel Tablet Could Ship With a 64-Bit Only Version of Android 13 (xda-developers.com) 32

An anonymous reader quotes a report from XDA Developers: While Apple switched to 64-bit-only support with iOS 11 in 2017, Android still supports legacy 32-bit applications. However, Google is in the process of switching to 64-bit-only support, and last year's Android 12 was the first version of the OS to support 64-bit-only builds. While the company did not make the switch with the recently released Android 13, it is reportedly working on a 64-bit-only version of the OS for the upcoming Pixel Tablet. According to Mishaal Rahman, Google is currently testing a 64-bit-only build of Android 13 for a device codenamed 'Tangor.' For the unaware, that codename refers to the upcoming Pixel Tablet, which the company showcased during its I/O keynote earlier this year. If the Pixel Tablet launches with a 64-bit-only version of Android 13, it will be among the first Android devices to drop 32-bit support. "Dropping 32-bit support on the Pixel Tablet will likely reduce RAM usage, but the tablet won't be able to run 32-bit applications," notes the report. "But that shouldn't be a problem for most users, as all recently updated apps on the Google Play Store offer 64-bit support due to the mandate Google put in place in 2019."
Android

Google Releases Android 13, Rolling Out First To Pixel Phones (theverge.com) 23

This year's major Android update, Android 13, is officially releasing today for Google's Pixel phones, the search giant has announced. From a report: The annual update is getting an official release a little earlier than usual, following Android 12's release last October and Android 11's release in September 2020. The list of updates arriving with this year's version of Android is likely to be familiar if you've been keeping up with Android 13's beta releases. There's the ability to customize non-Google app icons to match your homescreen wallpaper that we saw in Android 13's first developer preview, a new permission to cut down on notification spam, and a new option to limit which of your photos and videos an app can access.

Back in January, we wrote that Google planned to spend this year catching up with Apple's ecosystem integrations, and there's more evidence of this in Android 13's official release. The update includes support for spatial audio with head tracking, which is designed to make sounds appear as though they're coming from a fixed point in space when you move your head while wearing compatible headphones, similar to a feature Apple offers for its AirPods. Today's post doesn't say exactly which headphones this will work with, but Google previously announced it would be updating its Pixel Buds Pro to offer support for spatial audio. Secondly, there's the ability to stream messages from apps including Google Messages directly to a Chromebook, similar to iMessage on the Mac.

Bug

Google's New Bug Bounties Include Their Custom Linux Kernel's Experimental Security Mitigations (theregister.com) 5

Google uses Linux "in almost everything," according to the leader of Google's "product security response" team — including Chromebooks, Android smartphones, and even Google Cloud.

"Because of this, we have heavily invested in Linux's security — and today, we're announcing how we're building on those investments and increasing our rewards." In 2020, we launched an open-source Kubernetes-based Capture-the-Flag (CTF) project called, kCTF. The kCTF Vulnerability Rewards Program lets researchers connect to our Google Kubernetes Engine (GKE) instances, and if they can hack it, they get a flag, and are potentially rewarded.

All of GKE and its dependencies are in scope, but every flag caught so far has been a container breakout through a Linux kernel vulnerability.

We've learned that finding and exploiting heap memory corruption vulnerabilities in the Linux kernel could be made a lot harder. Unfortunately, security mitigations are often hard to quantify, however, we think we've found a way to do so concretely going forward....

First, we are indefinitely extending the increased reward amounts we announced earlier this year, meaning we'll continue to pay $20,000 — $91,337 USD for vulnerabilities on our lab kCTF deployment to reward the important work being done to understand and improve kernel security. This is in addition to our existing patch rewards for proactive security improvements.

Second, we're launching new instances with additional rewards to evaluate the latest Linux kernel stable image as well as new experimental mitigations in a custom kernel we've built. Rather than simply learning about the current state of the stable kernels, the new instances will be used to ask the community to help us evaluate the value of both our latest and more experimental security mitigations. Today, we are starting with a set of mitigations we believe will make most of the vulnerabilities (9/10 vulns and 10/13 exploits) we received this past year more difficult to exploit. For new exploits of vulnerabilities submitted which also compromise the latest Linux kernel, we will pay an additional $21,000 USD. For those which compromise our custom Linux kernel with our experimental mitigations, the reward will be another $21,000 USD (if they are clearly bypassing the mitigations we are testing). This brings the total rewards up to a maximum of $133,337 USD.

We hope this will allow us to learn more about how hard (or easy) it is to bypass our experimental mitigations.....

With the kCTF VRP program, we are building a pipeline to analyze, experiment, measure and build security mitigations to make the Linux kernel as safe as we can with the help of the security community. We hope that, over time, we will be able to make security mitigations that make exploitation of Linux kernel vulnerabilities as hard as possible.

"We don't care about vulnerabilities; we care about exploits," Vela told the Register. "We expect the vulnerabilities are there, they will get patched, and that's nice and all. But the whole idea is what do to beyond just patching a couple of vulnerabilities." In total, Google paid out $8.7 million in rewards to almost 700 researchers across its various VPRs last year. "We are just one actor in the whole community that happens to have economic resources, financial resources, but we need the community to help us make the Kernel better," Vela said.

"If the community is engaged and helps us validate the mitigations that we have, then, we will continue growing on top of that. But the whole idea is that we need to see where the community wants us to go with this...."

[I]t's not always about the cash payout, according to Vela, and different bug hunters have different motivations. Some want money, some want fame and some just want to solve an interesting problem, Vela said. "We are trying to find the right combination to captivate people."

Facebook

Facing Privacy Concerns, Facebook Begins Testing End-to-End Encrypted Chats, Secure Backups (cnbc.com) 19

Thursday Meta published a blog post by their "product management director of Messenger Trust," who emphasized that they've begun at least testing end-to-end encryption by default for Messenger chats. But Meta also announced plans "to test a new secure storage feature for backups of your end-to-end encrypted chats on Messenger...."

"As with end-to-end encrypted chats, secure storage means that we won't have access to your messages, unless you choose to report them to us."

CNBC provides some context: The announcement comes after Facebook turned over Messenger chat histories to Nebraska police as part of an investigation into an alleged illegal abortion. Meta spokesperson Andy Stone said the feature has been in the works for a while and is not related to the Nebraska case...

The feature is rolling out on Android and iOS devices this week, but it isn't yet available on the Messenger website. The company has been discussing full-scale deployment of end-to-end encryption since 2016, but critics have said the security measure would make it much more difficult for law enforcement to catch child predators....Meta said in the release that it is making progress toward the global rollout of default end-to-end encryption for personal messages and calls in 2023.

Other privacy enhancements announced Thursday by Meta:
  • "We plan to bring end-to-end encrypted calls to the Calls Tab on Messenger."
  • Meta announced that the deleting of messages will start syncing across your other devices "soon."
  • Messenger will continue offering the option of "Disappearing" messages, in which viewed messages in an end-to-end encrypted chat automatically then disappear after a pre-specified period of time.

And there's more, according to Meta's announcement:.

"This week, we'll begin testing default end-to-end encrypted chats between some people. If you're in the test group, some of your most frequent chats may be automatically end-to-end encrypted, which means you won't have to opt in to the feature. You'll still have access to your message history, but any new messages or calls with that person will be end-to-end encrypted. You can still report messages to us if you think they violate our policies, and we'll review them and take action as necessary....

"Last year, we started a limited test of opt-in end-to-end encrypted messages and calls on Instagram, and in February we broadened the test to include adults in Ukraine and Russia. Soon, we'll expand the test even further to include people in more countries and add more features like group chats....

"We will continue to provide updates as we make progress toward the global rollout of default end-to-end encryption for personal messages and calls in 2023."


Encryption

Facebook Will Begin Testing End-To-End Encryption As Default On Messenger App (theguardian.com) 13

Facebook announced on Thursday it will begin testing end-to-end encryption as the default option for some users of its Messenger app on Android and iOS. The Guardian reports: Facebook messenger users currently have to opt in to make their messages end-to-end encrypted (E2E), a mechanism that theoretically allows only the sender and recipient of a message to access its content. Facebook spokesperson Alex Dziedzan said on Thursday that E2E encryption is a complex feature to implement and that the test is limited to a couple of hundred users for now so that the company can ensure the system is working properly. Dziedzan also said the move was "not a response to any law enforcement requests." Meta, Facebook's parent company, said it had planned to roll out the test for months. The company had previously announced plans to make E2E encryption the default in 2022 but pushed the date back to 2023. "The only way for companies like Facebook to meaningfully protect people is for them to ensure that they do not have access to user data or communications when a law enforcement agency comes knocking," Evan Greer, the director of the digital rights group Fight for the Future, said. "Expanding end-to-end encryption by default is a part of that, but companies like Facebook also need to stop collecting and retaining so much intimate information about us in the first place."

Slashdot Top Deals