Dr. Bill | The Computer Curmudgeon

I hope it is a good release. Windows 8.x was not so much!

Microsoft Skips Windows 9, Heads Straight to Windows 10

re/code – By: Ina Fried -“Microsoft on Tuesday gave its first detailed look at the next major update to Windows, which it has decided to call Windows 10.

The software, expected to be released in final form next year, is designed to run across the broadest array of devices, with screens ranging from four inches to 80 inches, with some devices having no screens at all.

‘Windows 10 will be our most comprehensive platform ever,’ Windows chief Terry Myerson said at a briefing with reporters in San Francisco. ‘It wouldn’t be right to call it Windows 9.’

In addition to being the next version of Microsoft’s PC operating system, Windows 10 will also be the next major release for Windows Phone as Microsoft moves to a single OS for PCs, phones and tablets.

Visually, Windows 10 resembles Windows 7 as much as Windows 8. Many of Windows 8’s user interface features are still present, but they are tucked into a more traditional Windows interface. Both classic and new-style apps run side-by-side with a less jarring distinction between the two types of programs.

Phones will have a different user interface from the one shown Tuesday, but Microsoft declined to offer many details on that, saying only that it would be an evolutionary update to Windows Phone 8.1.

A technical preview version of the software will be made available starting on Wednesday, Myerson said. Consumers that don’t mind trying early, pre-release software can download the Windows 10 preview part of a new Windows Insider program.’

‘We’re planning to share more than we ever have before, frankly earlier than we have before,’ Myerson said. ‘We know there are these people that want to live on the edge with us.’

In demonstrating the new software, Windows VP Joe Belfiore demonstrated how the new Windows will work with a wide-range of interfaces, ranging from the very old-school command prompt, to the Windows 7-style task bar to modern touch screens.

Windows 10 represents a critical launch for Microsoft, which has seen exceptionally slow business take-up for Windows 8 during its two years on the market.

An added challenge for Microsoft is that it now has millions of users on touch-screen Windows 8 devices and hundreds of millions of people using older versions of the software with a mouse and keyboard.

Microsoft has a lot of different constituencies to please, not to mention trying to appeal to a generation of new computer buyers that have grown up with iPhones, iPads and Android devices.

While highlighting work that the company has done to appeal toward existing mouse-and-keyboard users, Belfiore said ‘We definitely see people moving towards touch.’

The company is also working on an approach called ‘continuum’ that would allow convertible laptops to switch between a standard view and a tablet-centric view more similar to Windows 8. Belfiore showed a video of how this could work, but said the feature is not yet far enough along to demonstrate publicly.

While Microsoft is previewing the code now it will be some time before the company reveals other details, such as exact timing and pricing.

Myerson declined to say whether Microsoft will sell Windows 10 differently, such as via subscription or other means. He also said it was too soon to say if Windows 10 would arrive sooner for some types of devices than for others.

Microsoft focused its pitch on Tuesday to business customers, with additional events expected in the coming months to tout features for other audiences.

Myerson said the company will talk more about the consumer features early next year, with plans to release it later in 2015, at some point following the company’s Build conference for developers.

‘Mid-next year would be a reasonable time to think about it,’ Myerson said.”

Some scientists are saying so!

Earth’s Water Is Older Than The Sun

Popular Science – By Sarah Fecht – “Since water is one of the vital ingredients for life on Earth, scientists want to know how it got here. One theory is that the water in our solar system was created in the chemical afterbirth of the Sun. If that were the case, it would suggest that water might only be common around certain stars that form in certain ways. But a new study, published today in Science, suggests that at least some of Earth’s water actually existed before the Sun was born — and that it came from interstellar space.

That’s certainly something to ponder the next time you drink a glass of water. But the discovery is also cool because it means water — and maybe life — may be ubiquitous throughout the galaxy.

“If water in the early Solar System was primarily inherited as ice from interstellar space, then it is likely that similar ices, along with the prebiotic organic matter that they contain, are abundant in most or all protoplanetary disks around forming stars,” study author Conel Alexander explained in a press release.

The researchers concluded that a significant portion of Earth’s water came from interstellar space by looking at the relative abundance of hydrogen and deuterium.

Deuterium is like hydrogen’s heavier brother. Both atoms have one proton in their nuclei, but deuterium contains an extra neutron, and it mostly forms under special conditions. In interstellar space, for example, water ice contains lots of deuterium, thanks to the freezing cold temperatures and ionizing radiation. Earthly water contains some deuterium, too, but in low quantities — up to 30 times less than interstellar water.

Looking at a water sample’s ratio of hydrogen to deuterium can tell you about what conditions were like when the water formed. But until now, scientists weren’t sure whether Earth’s deuterium came from space, or whether it was cooked up in the birth of the Sun.

To find out, researchers used mathematical models to virtually recreate the young solar system’s protoplanetary disk — the cloud around the newborn Sun. They found that, based on the temperature and radiation conditions that would have existed back then, it wasn’t possible for the young solar system to create the ratios of hydrogen and deuterium that scientists observe in Earth’s oceans and on comets. Because of that, the researchers estimate that anywhere between 7 and 50 percent of Earth’s water had to have come from the interstellar medium in which the solar system was born.

And since other solar systems would have formed in the same interstellar medium, the findings suggest that the origins of water on Earth were not unique, and that the thirst-quenching, life-supporting substance may be common on exoplanets throughout the galaxy.”

Project Marilyn aims to create an open-source anti-cancer drug

Geek – By: By Graham Templeton – “A crowdfunded anti-cancer research effort called Project Marilyn is, to say the least, interesting. It has tinges of the potential of crowdfunding, of open source development, of anti-patent law, of cancer research, and of good or bad science. Its implications could reach further than any one single anti-cancer drug, as it hopes to lead by example and help the whole research sector to a better future. Project Marilyn is just the pilot project of a much longer series, called IndySci, but neither will come to anything if Marilyn doesn’t manage to reach its funding goal — as of this writing, Project Marilyn has about $13,700 of its $50,000 goal, and just 20 days left to raise the difference.

The drug being developed here is referred to as 9DS, or 9-deoxysibiromycin, and it’s not what we would call fundamentally new; like many anti-cancer drugs of the past, it works by inhibiting cell proliferation, taking essentially the chemotherapy approach and betting on the fact that relatively high-turnover cancer cells will die more quickly in such a situation than healthy ones. The 9DS molecule literally holds the double-helix closed, slowing cell replication by preventing those cells from peeling their genomes apart to duplicate them. 9DS has shown real promise for treating kidney, breast, and skin cancers, but (so goes the narrative) that promise was scuttled by raw financial greed; 9DS was not patented, and as a result drug companies saw little potential profit in taking the drug through the expensive process of clinical trials.

Yet, because it’s not patented, the drug is essentially open source. This means that while large companies are less likely to invest, large companies are also not the only ones who can invest. That investment, which can be as little as $1 in volume thanks to IndySci, will go directly and entirely toward research expenses. That means that, quite literally, this is the most direct cancer research donation you are likely to find anywhere in the world — cancer research, more than just about any other disease, has an enormous and often intimidating bureaucracy behind it. IndieSci, or some version of the same idea, could potentially make the funder-fundee relationship in science much, much closer.

But there’s an issue (not a problem, an issue) with 9DS itself: maybe it’s bunk. This is ultimately the most likely stumbling block for any crowdfunded science project, that while science thrives on a steady diet of failures and null results, public opinion absolutely does not. A scientist might go out for celebratory beers after usefully falsifying his or her own hypothesis, and that’s a mentality most people just don’t understand. For all its nefarious tendencies, the corporate world has always been able to see far enough to keep funding such a stuttering and anti-climactic way of doing things. The crowd, however? Someone whose donation eventually became a viable drug would be far more likely to donate again in the future than someone whose donation had gone to proving that a particular drug is useless.

That natural emotional response fundamentally breaks the research sector – the last time we relied on the public’s high-minded commitment to quality over populism, we all watched passively as the nation’s newspapers tanked. This has not been a winning strategy in the past, but perhaps the immediate personal impact of cancer will be enough to galvanize the public behind this cause. Perhaps it will also be enough to motivate a higher percentage of researchers to exaggerate or falsify results to please backers. Dr. Isaac Yonemoto, a lead researcher on Project Marilyn and the prime mover behind IndieSci, showed up in the comments over at Hacker News to answer some questions — he certainly seems to understand the difficulties of crowdfunding every step of a process of trial and error.

Another issue with crowdfunding science is that, very often, you’ll be asking people to fund projects they do not understand. It’s still unclear how a thriving IndieSci of the future would help potential backers sift the doomed or less promising studies from the truly solid science. The expertise needed to really understand science lends itself naturally to the introduction of learned gatekeepers — but that’s what got us here in the first place.

If it reaches its $50,000 goal, Project Marilyn will begin with what’s known as a xenograft experiment, which test the drug’s effectiveness in mice. This is work which could lead to human trials, though the amount of money needed at that stage would be much, much higher than $50 grand. More interesting will be the funders’ reaction if this work comes to nothing more than a better understanding of cancer — will they be disappointed, or sophisticated enough to be satisfied anyway?”

Like I said, this may be the “Big One!”

An unpaid programmer wrote BASH as a very useful tool, now it is being exploited to harm 1000s of computers.

Security Experts Expect ‘Shellshock’ Software Bug in Bash to Be Significant

The New York Times – By: Nicole Perlroth – “Long before the commercial success of the Internet, Brian J. Fox invented one of its most widely used tools.

In 1987, Mr. Fox, then a young programmer, wrote Bash, short for Bourne-Again Shell, a free piece of software that is now built into more than 70 percent of the machines that connect to the Internet. That includes servers, computers, routers, some mobile phones and even everyday items like refrigerators and cameras.

On Thursday, security experts warned that Bash contained a particularly alarming software bug that could be used to take control of hundreds of millions of machines around the world, potentially including Macintosh computers and smartphones that use the Android operating system.

The bug, named ‘Shellshock,’ drew comparisons to the Heartbleed bug that was discovered in a crucial piece of software last spring.

But Shellshock could be a bigger threat. While Heartbleed could be used to do things like steal passwords from a server, Shellshock can be used to take over the entire machine. And Heartbleed went unnoticed for two years and affected an estimated 500,000 machines, but Shellshock was not discovered for 22 years.

That a flawed piece of code could go unnoticed for more than two decades could be surprising to many. But not to programmers.

Many of the commercial tools that individual users and large corporations depend upon are built on top of programs that are written and maintained by a few unpaid volunteers in what is called the open-source community. That community, along with big companies like Google, adjusts and builds new things on top of older work. The Macintosh operating system, for example, is routinely updated, but it is built on top of older programs like Unix.

Sometimes there are flaws in that code. And over the years, the flaw becomes part of all sorts of products.

Mr. Fox maintained Bash – which serves as a sort of software interpreter for different commands from a user – for five years before handing over the reins to Chet Ramey, a 49-year-old programmer who, for the last 22 years, has maintained the software as an unpaid hobby. That is, when he is not working at his day job as a senior technology architect at Case Western Reserve University in Ohio.

Mr. Ramey said in an interview on Thursday that he believed he inadvertently introduced Shellshock in a new Bash feature in 1992, though he could not be sure because back then he was not keeping comprehensive logs. Through the years, he maintained Bash by himself and occasionally bug reports would arrive in his email inbox.

On Sept. 12, he was contacted by Stephane Chazelas, another open-source enthusiast, about a potentially dangerous bug.

Mr. Chazelas discovered the flaw after finding a similar issue in another system a few months back. He tested the bug – which he called ‘Bashdoor’- against his own servers and looked for ways to detect and fix it.

Working with Mr. Ramey and people who work on open-source security, Mr. Chazelas had a patch within hours. Then they contacted major software makers while trying to avoid tipping off hackers.

An official alert from the National Institute of Standards and Technology warned that the vulnerability was a 10 out of 10, in terms of its severity, impact and exploitability, but low in terms of its complexity, meaning that it could be easily used by hackers.

Security researchers say that as soon as the bug was reported they detected widespread Internet scanning by so-called white hat hackers – most likely security researchers – as well as people thought to be cybercriminals. The worry is that it is only a matter of time before somebody writes a program that will use Shellshock to take them over.

Researchers noted that it would be much easier for this to happen with Internet-connected servers than with a personal Macintosh laptop, because individuals would have to connect their laptops to a public network that hackers knew they were connected to in order to exploit the vulnerability.

Apple did not return a request seeking comment.

The Department of Homeland Security’s Computer Emergency Readiness Team, US-CERT, advised users and technology administrators to refer to their Linux or Unix-based operating systems suppliers for an appropriate patch. For users at home, security experts advised them to stay abreast of software updates and check manufacturer websites, particularly for hardware like routers.

Even as some question the open-source community, its biggest advocates say the bug’s discovery – even after 22 years – at least proves that programmers never stop trying to get things right.

In an interview Thursday, Mr. Fox, the Bash inventor, joked that his first reaction to the Shellshock discovery was, ‘Aha, my plan worked.’

After the Heartbleed bug was discovered last spring, the nonprofit Linux Foundation worked with major technology companies like Amazon, Apple and Google on the Core Infrastructure Initiative, an effort to identify and fund core pieces of open-source infrastructure. Contacted Thursday, Jim Zemlin, the executive director of the Linux Foundation, said the initiative was contacting Mr. Ramey to see how it could help.

‘I don’t think this is an open-source problem,’ Mr. Zemlin said. ‘Software is eating the world. The bad news is software is hard and complex.’

The mantra of open source was perhaps best articulated by Eric S. Raymond, one of the elders of the open-source movement, who wrote in 1997 that ‘given enough eyeballs, all bugs are shallow.’ But, in this case, Steven M. Bellovin, a computer science professor at Columbia University, said, those eyeballs are more consumed with new features than quality. ‘Quality takes work, design, review and testing and those are not nearly as much fun as coding,’ Mr. Bellovin said. ‘If the open-source community does not develop those skills, it’s going to fall further behind in the quality race.'”

This is a big malware threat to all UNIX, Linux and Mac computers!

Shellshock bug: First malware to exploit security flaw spotted in the wild

Mirror – By: Mikey Smith – “The first malware apparently designed to exploit the devastating Shellshock vulnerability has been discovered online, and experts think it’s the tip of the iceberg.

Shellshock is a 25-year-old, but newly discovered flaw in software run on many Linux and Apple Mac computers.

The US government has rated the security flaw 10/10 for severity, and given it a complexity rating of ‘low’ – meaning it’s very easy to exploit.

The bug affects Bash, a program that runs on Apple Mac and Linux computers – and can run in the background without a user’s knowledge. The vulnerability lets hackers piggyback malicious code on otherwise benign commands.

The new exploit, known as a ‘bot’, infiltrates a vulnerable machine via the Shellshock bug, before setting up a series of malicious code.

One part of the code seems to enable a remote user to perform a distributed denial of service (DDoS) attack – where a network of hijacked computers can flood a server with information in an attempt to make it shut down.

Another part looks for other routers on the network, and tries commonly used administrator logins to try and hijack them too.

A third section connects to a remote server in what appears to be a ‘Command and Control’ function, allowing the remotely control the hijacked machine at a later date.

Updates have been issued for Linux versions of Bash, but Apple has yet to announce a downloadable patch. Some fear the issue may go beyond servers and desktop computers, and allow internet c