Dr. Bill | The Computer Curmudgeon

Well, the crowd-funding effort may have failed, but it demonstrated a desire on the part of uber-geeks for an Ubuntu phone, so… guess what? Ubuntu is making arrangements to… “Make it so!”

Ubuntu Touch OS phones coming from unnamed OEM next year

The Verge – “Canonical’s Ubuntu Touch operating system will be headed to mobile phones made by a mystery hardware manufacturer, the company said today. Speaking to CNET, founder Mark Shuttleworth said Canonical’s made an agreement with an unnamed smartphone maker to get the operating system on ‘high-end’ phones sometime next year. If this sounds like a broken record, you’re not mistaken. Back in January, Canonical promised devices running a standalone version of Ubuntu by early next year, a goal that went off track when crowdfunding for the company’s Edge smartphone hardware missed badly. The operating system that would have powered it lives on though, and Shuttleworth now says the company is currently in high-level discussions with at least four additional major phone makers to get Ubuntu Touch devices out the door.

Canonical is one of several companies fighting for what’s become a very fierce battle over mobile operating system market. Google’s Android and Apple’s iOS collectively run the devices used by the majority of smartphone users, while Microsoft, Blackberry, and others duke it out for the rest. Canonical is joined by other companies, including Samsung which also has a Linux-based operating system called Tizen, as well as Mozilla, which launched the first Firefox OS devices back in April.”

Yes, it is true! The official, actual, real, I’m not kidding, Google sanctioned, YouTube Channel for Roku! Right now it is only for Roku 3, but it will soon come to the earlier models as well. Awesome sauce! Now, if you have the old, secret code, “bootleg” YouTube Channel, you will need to remove that, then go to the Channel Store and locate the new channel! I will do a run through in this week’s show. Stay tuned!

Here’s a note directly from LastPass:

“LastPass & Changes to Google Chrome

The LastPass extension for Google Chrome has been updated today to address significant changes that Chrome is rolling out.

Starting in early January, Chrome is shutting off all extension updates that occur outside of the Chrome web store, in an effort to tighten security.

The update is now posted on the Google Chrome store, and we are automatically transferring over our users – most LastPass users will not need to take any action since the changes are happening behind-the-scenes.

However, some LastPass users may see a prompt for permissions to be granted to LastPass the next time they launch Chrome:

If you see this prompt, please press ‘Allow’. If you see this prompt, a download will start automatically – we start this download because we detect that functionality was lost in the transfer, and the download allows us to add back this functionality.

Again, most users will not need to take any further action, and the prompts for permission are not a cause for concern.

Our updates will allow LastPass users to continue running the extension without issues when Chrome is updated in January 2014, and we will update our community if any other changes will affect LastPass.

Best,
The LastPass Team.“

Ooopsy! Another Microsft security blunder!

Office 365 bug allows hackers to steal credentials

ZDNet – “Anyone hosting a Word document on their webserver can steal Microsoft Office 365 credentials due to a bug in how the cloud service attempts to authenticate users.

Adallom chief software architect Noam Liran discovered the bug, outlining how it works on his blog.

Office 365 requires users to log in to their account, and, when downloading a document from a SharePoint server, it verifies the credentials of the currently logged-in user by sending an authentication token.

The token should only be sent when the server is on the sharepoint.com domain. However, Liran found that by running his own server and sending back responses that would be expected of a legitimate SharePoint server, the user’s computer would send the authentication token anyway.

‘Now, my malicious web server, in possession of your private Office 365 authentication token, can simply go to your organisation’s SharePoint Online site, download all of it, modify it, or do whatever it wants, and you will never know about it. In fact, you won’t even know you got hit! It’s the perfect crime,’ he wrote.

Adallom has created a proof of concept video demonstrating how authentication tokens can be stolen.”