Tech News

Yesterday, Apple Inc. announced the acquisition of Akonia Holographics, a startup focused on making lenses for augmented reality glasses, which may launch sometime in the year 2020. Akonia Holographics was founded in 2012 by a group of holography scientists and had originally focused on holographic data storage before shifting its efforts to creating displays for augmented reality glasses. Why did Apple acquire Akonia Holographics? With this acquisition, Apple aims to create a wearable device that has the potential to superimpose digital information in the real world via a thin lens. Akonia’s display technology allows for thin, transparent smart glass lenses that display vibrant, full-color, wide field-of-view images. This can help Apple in reaching its ambition of superimposing digital information. Akonia has a portfolio of more than 200 patents related to holographic systems and materials, according to its website. As reported by Reuters, The Akonia acquisition is a clear indication of how Apple might handle one of the most daunting challenges in augmented reality hardware, which is producing crystal clear optical displays that are thin and light enough to fit into glasses similar to everyday frames with images bright enough for outdoor use and suited to mass manufacturing at a relatively low price. In 2013, Apple acquired a small Israeli firm called PrimeSense that made three-dimensional sensors. The iPhone X, launched last year, uses a similar sensor to power facial recognition features. Similarly, Akonia’s acquisition might also result in a new AR lens update in one of its upcoming releases in its devices. Ming-Chi Kuo, a former Apple Inc. analyst said that the Apple Car will launch sometime in 2023-2025. The iCar project is codenamed as 'Titan', according to The Wall Street Journal. Kuo said, “Apple’s leading technology advantages (e.g. AR) would redefine cars and differentiate Apple Car from peers’ products”. Apple acquiring Akino could also be part of including the latest AR tech within the iCar initiative and scale forward the timelines. Apple bans Facebook’s VPN app from the App Store for violating its data collection rules Stack skills, not degrees: Industry-leading companies, Google, IBM, Apple no longer require degrees 16 year old hacked into Apple’s servers, accessed ‘extremely secure’ customer accounts for over a year undetected

Netflix announced yesterday that Verna Myers is joining the company as Vice President, inclusion strategy. In her new role, Myers will help with the implementation of strategies that reinforce cultural diversity and inclusion and equity into the varied aspects of Netflix's operations worldwide. https://twitter.com/VernaMyers/status/1034855768682422272 According to Jessica Neal, Netflix Chief Talent Officer, "Having worked closely with Vernā as a consultant on a range of organizational issues, we are thrilled that she has agreed to bring her talents to this new and important role”. Myers, a graduate of Harvard Law School, has spent the past two decades as the head at The Vernā Myers Company. Here, her major role involved providing consultation to major corporations and organizations regarding how to eradicate barriers based on race, ethnicity, gender, sexual orientation and other differences. She has also written several self-help books, been an active TED speaker, and contributed to reputed publications such as Refinery29, The Atlantic, Forbes, etc. Netflix deeply respects cultural diversity and fired its chief communications officer Jonathan Friedland, two months back, for using the N-word in a meeting. “As a global company dedicated to attracting the best people and representing a broad range of perspectives, Vernā will be an invaluable champion of our efforts to build a culture where all employees thrive” added Jessica Neal. “I have been a longtime fan of the inclusive and diverse programming and talent at Netflix. I was so impressed by their mission, their excellence, and decision to take their inclusion and diversity efforts to a higher level. I excited and look forward to collaborating all across Netflix to establish bold innovative frameworks and practices that will attract, and sustain high performing diverse teams” says Myers. For more information, check out the official Netflix blog post. How everyone at Netflix uses Jupyter notebooks from data scientists, machine learning engineers, to data analysts 20 lessons on bias in machine learning systems by Kate Crawford at NIPS 2017 Apollo 11 source code: A small step for a woman, and a huge leap for ‘software engineering’  

Oracle announced the release of Oracle Solaris 11.4, a trusted business platform. Oracle Solaris gives consistent compatibility, is secure and simple to use platform. The version 11.4 is the first and the only operating system with a complete UNIX® V7 certification. Check out these facts about Oracle Solaris 11.4: The team worked on 175 development builds to get Oracle Solaris 11.4 It has been tested for more than 30 million machine hours 50 customers have put Oracle Solaris into production More than 3000 applications are certified to run on it New features in Oracle Solaris 11.4 Consistently compatible Major reason for companies and organizations behind choosing Oracle Solaris is its continued consistency. The Oracle Solaris Application Compatibility Guarantee program guarantees that it will work seamlessly on previous releases of Oracle Solaris. Additionally you can migrate Oracle 10 workloads to Oracle 11 with enhanced migration tools and documentation available for modern hardware. Simple Interface A new feature, Observability Tools System Web Interface brings together several key observability technologies. It includes the new StatsStore data, audit events and FMA events, into a centralized, customizable browser-based interface, that allows you to see the current and past system behavior at a glance. It will also allow you to add your own data for collection and customize the interface as you like. The Service Management Framework has been enhanced to allow you to automatically monitor and restart critical applications and services. Oracle Solaris Zones are now updated and the applications inside it can be run simply with the ability to evacuate a system of all of its Zones with just one command. With Oracle Solaris 11.4, you can now build intra-Zone dependencies and have the dependent Zones boot in the correct order. This will enable you to automatically boot and restart complex application stacks in the correct order. Safe and Secure Oracle Solaris 11.4 will give more security capabilities with multi-node compliance to  stay secure and compliant. You will be able to setup compliance to either push a compliance assessment to all systems with a single command and review the results in a single report. Alternatively, you can setup your systems to regularly generate their compliance reports and push them to a central server which can be viewed via a single report. Trusted path services are added in Oracle Solaris 11.4, to create your own services like Puppet and Chef, that can be placed on the trusted path. It will allow you to make the requisite changes while keeping the system/zone immutable and protected. With update to Oracle Solaris the team released a new version of Oracle Solaris Cluster 4.4. To know more about this release and to download Oracle Solaris 11.4 visit the Oracle Technology Network page. Oracle releases GraphPipe: An open source tool that standardizes machine learning model deployment Oracle’s bid protest against U.S Defence Department’s(Pentagon) $10 billion cloud contract Oracle makes its Blockchain cloud service generally available

Yesterday, Facebook made its video-streaming service named, Facebook Watch globally available. It was first launched in August 2017 for a limited group of people in the US. Facebook Watch's content is produced by its partners, who can earn 55% of advertising revenue while Facebook keeps 45%. How Facebook Watch is different from other streaming rivals like YouTube, Twitch and more? Facebook believes that Watch is unique as compared to its rivals, such as YouTube, Amazon’s Twitch, Netflix because it has an added advantage of how Watch helps viewers interact with each other. Fidji Simo, Facebook’s vice-president of video, told BBC: “It is built on the notion that watching video doesn’t have to be a passive experience. You can have a two-way conversation about the content with friends, other fans or even the creators themselves.” Facebook Watch comes with a feature called Watch Party that lets its users to coordinate themselves to watch a show together. Creators can boost engagement with the help of Interactivity Platform that allows them to run polls, challenges, and quizzes. How will it support its content creators? Facebook has laid out a plan to support their publishers and content creators in two main areas: Ad breaks to generate revenue from their videos Creator Studio to understand how their content is performing Ad breaks eligibility criteria and availability Ad breaks are launched across four markets and is only available to pages that publish videos in certain languages and countries right now. It will support more countries and languages by the end of the year and in 2019. Eligibility: Your videos should be 3-minute long Videos that have generated more than 30,000 1-minute views in total over the past two months Pages should have at least 10,000 Facebook followers Meet their Monetisation Eligibility standards Should be located in a country where ad breaks are available Availability: Currently, ad breaks are supported in the US, UK, Ireland, New Zealand and Australia. Over the next few months, availability will further expand to more countries and languages. Manage your video content with Creator Studio Creator Studio provide creators a central place for Pages to manage their entire content library and business. You can do the following: Manage content and interactions: Look through the insights, manage interactions across all owned Pages, respond to Facebook messages or comments on Facebook and Instagram. Streamline video publishing: Compose, schedule, and publish content across owned Pages and also do bulk uploads. Access ad breaks: Review monetisation insights and view payments. Along with this, you can access Rights Manager, use sound collection, and take advantage of new features and monetisation opportunities that they may be eligible for. To know more about the recent updates and your eligibility on Facebook Watch, check out their official announcement. A new conservative employee group within Facebook to protest Facebook’s “intolerant” liberal policies Facebook bans another quiz app and suspends 400 more due to concerns of data misuse Facebook is reportedly rating users on how trustworthy they are at flagging fake news

Update, 31st August 2018: Yandex has refused to remove pirated content. According to a statement from the company, Yandex believes that the law is being misinterpreted. While pirate content must be removed from sites hosting it, the removal of links to such content on search engines falls outside the scope of the current legislation.  “In accordance with the Federal Law On Information, Information Technologies, and Information Protection, the mechanics are as follows: pirated content should be blocked by site owners and on the so-called mirrors of these sites,” Yandex says. A Yandex spokesperson said that the company works in “full compliance” with the law. “We will work with market participants to find a solution within the existing legal framework.” Check out more info on Interfax. Roskomnadzor has found Russian search giant Yandex guilty of holding pirated content. The Federal Service for Supervision of Communications, Information Technology and Mass Media or Roskomnadzor is the Russian federal executive body responsible for censorship in media and telecommunications. The Moscow City Court found the website guilty of including links to pirated content last week. The search giant was asked to remove those links and the mandate was further reiterated by Roskomnadzor this week. Per the authorities, if Yandex does not take action within today, its video platform will be blocked by the country's ISPs. Last week, major Russian broadcasters Gazprom-Media, National Media Group (NMG), and others had protested against pirated content by removing their TV channels from Yandex’s ‘TV Online’ service. They said that they would allow their content to appear again only if Yandex removes pirated content completely. Following this, Gazprom-Media had filed a copyright infringement complaint with the Moscow City Court. Subsequently, the Moscow Court made a decision compelling Yandex to remove links to pirated TV shows belonging to Gazprom-Media. Pirate content has been a long-standing challenge for the telecom sector that is yet to be completely eradicated. Not only does it lead to a loss in revenues, but also a person watching illegal movies violates copyright and intellectual property laws. The Yandex website is heavily populated with pirated content, especially TV shows and movies. Source: Yandex.video In a statement to Interfax, Deputy Head of Roskomnadzor Vadim Subbotin warned that Yandex.video will be blocked Thursday night (August 30) if the pirate links aren’t removed. “If the company does not take measures, then according to the law, the Yandex.Video service must be blocked. There’s nowhere to go,” Subbotin said. The search giant has not yet responded to this accusation. You can check out the detailed coverage of the news on Interfax. Adblocking and the Future of the Web. Facebook, Twitter takes down hundreds of fake accounts with ties to Russia and Iran. YouTube has a $25 million plan to counter fake news and misinformation.

Nintendo has come out with a new tool, called, wideNES, to let you relive your childhood days. Only this time, you can record the screen while playing in real-time, gradually building up a map of the different levels explored. The new tool wideNES, is a feature of ANESE, which is an NES emulator developed by Daniel Prilik. What’s great about wideNES is the fact that it syncs the action on-screen to the generated map, thereby, allowing players to see ahead of the levels by “peeking past the edge of the NES’s screen”. Also, this mapping technique is not applicable to only a few games i.e. it enables the wideNES to work with a wide range of NES games. Let’s look at how wideNES works. Rendering graphics Back in the 80s, the NES (Nintendo entertainment system) used MOS 6502 CPU. It also used a powerful graphics coprocessor called the Picture Processing Unit (PPU) in conjunction with the 6502 CPU. The wideNES also makes use of PPU. PPU is an integrated circuit in the NES which generates video signals from graphics data stored in memory. The chip is known for using very little memory to store graphical data. In wideNES, the CPU updates the PPU on what has changed throughout the game using Memory Mapped I/O.  This process comprises of setting up new sprite positions ( Great for moving objects: player, enemies, projectiles), new level data, and new viewport offsets. With wideNES running in an emulator, it’s easy to track the values written to the PPUSCROLL register (controls viewport X/Y offset) i.e. it’s easy to measure how much of the screen has been scrolled between two frames. But, there’s a limitation to this technique as you can’t get a complete map of the game unless the player manually explores the entire game. Scrolling past 256 The NES is an 8-bit system and in this, the PPUSCROLL register accepts only 8-bit values. This limited the maximum scroll-offset in NES to just 255px. So, on scrolling past 255, PPUSCROLL register would become 0, explaining why Smart Mario Bros would bounce-back to the start on Mario moving too far right. With wideNES, scrolling past 256 is possible as it completely ignores the PPUCTRL register, and simply looks at the PPUSCROLL delta between frames. So, in case the PPUSCROLL unexpectedly jumps up to ~256, it indicates that the player character has moved left/up a screen, whereas if the PPUSCROLL jumps down to ~0, then that means the player has moved right/down a screen. However, this approach does not work for games that have static-UI elements such as HUDs, Masks, and Status Bars at the edges of the screen. To solve this issue, wideNES implements several rules which detect and mask-off static screen elements automatically. Detecting “Scenes” Most NES games are split into many smaller “scenes” with doors or transition screens that move between them. The wideNES uses perceptual hashing to detect whenever a scene changes. Perceptual hash functions work on keeping the similar inputs “close” to one another in the output space making them perfect for detecting similar images. But, perceptual hashes can also get incredibly complex with some being able to detect similar images even if few of the images have been rotated, scaled, stretched, and color shifted. But, wideNES doesn’t need a complex hash function as each frame is always the exact same size. Now, work is still being done on improving wideNES core and on improving ANESE’s wideNES implementation. For now, you can explore the ANESE emulator and take the trip down the memory lane! For more information, check out the official wideNES blog post. Meet yuzu – an experimental emulator for the Nintendo Switch AI for game developers: 7 ways AI can take your game to the next level AI for Unity game developers: How to emulate real-world senses in your NPC agent behavior

At the Linux Foundation's Open Source Summit in Vancouver, Storj Labs a leader in decentralized cloud storage company, launched their ‘Open Source Partner Program’. This program will enable open-source projects to generate revenue when their users store data in the cloud. The program was launched with the aim to bridge the "major economic disconnect between the 24-million total open-source developers and the $180 billion cloud market" as stated by Ben Golub, Storj's executive chairman and interim CEO. How does the Open Source Partner program work? Open-source projects simply need to integrate Storj into their existing cloud application infrastructure. Since Storj uses an Amazon Web Services (AWS) S3 compliant interface, this integration should be easy. Storj provides a blockchain encrypted, distributed cloud storage with facilitates data security, improves reliability, and enhances performance when compared to traditional cloud storage approaches. Using client-side encryption ensures that data can only be accessed by the data owners. While harvesting all these benefits, open-source projects that will use the Storj network will be provided with a continuous revenue stream. 60% of its gross revenue will be given to its storage farmers and 40% will be split amongst open-source developers. Through simple Storj data connectors that will be integrated with their platforms, Storj can track data storage usage. Partners will be given help desk support and tools to test the network's performance and capabilities. What’s in it for open source companies? Monetization has always been a challenge for open source companies. They ultimately require revenue to sustain themselves. Open source drives a sizable majority of the $200 billion-plus cloud computing market which is inversely proportional to the revenue that currently makes its way directly back to their projects and companies. The ‘Open Source Partner Program’ will help open source companies to grow exponentially and meet other financial-related goals.  Ultimately, open source companies - even the ones that only provide free products - require revenue to sustain themselves, and the Storj Open Source Partner Program aims to help. What’s in it for Storj? While this revenue generation program will benefit open source companies, it can also be viewed as an effective marketing strategy for Storj.  Open source projects are all the rage these days and the more these companies turn to Storj for decentralized cloud-based solutions, the more popularity and recognition Storj gets. Storj, as well as open source companies, realize the importance of openness, decentralization, and broad-based individual empowerment, which is why this program strikes the perfect balance to support open source projects. The Storj Labs has already won over ten major open-source partners, including Confluent, Couchbase, FileZilla, MariaDB, MongoDB, and Nextcloud, to join its Open Source Partner Program. These partners will be given early, immediate access to the V3 network private alpha. You can get a complete overview of the program on Storj’s blog post. 5 reasons why your business should adopt cloud computing Demystifying Clouds: Private, Public, and Hybrid clouds Google’s second innings in China: Exploring cloud partnerships with Tencent and others

On the second day of GopherCon, 28th Aug, Microsoft announced contributions to the open-source Project Athens and their involvement with GopherSource. These announcements add to Microsoft’s efforts to better enable Go developers for making better apps and services. They support GO in Microsoft Visual Studio and on Azure cloud. Project Athens Package version changes in Go causes the current builds to break. This happens when the changed packages are dependencies for a working project. Project Athens stores and serves packages outside of Github, which means that Athens holds dependencies. It is an open source project released under the MIT license and is hosted on GitHub. Microsoft’s current focus is on improving the whole module experience. The aim is to ensure seamless working of Go modules with all proxy servers. They are working to set up a federated and diverse proxy network to include features like: Proxy server implementation for edge deployments in Go modules A new protocol for authenticated module proxies Adding module notary servers for source code authentication An include/exclude list for companies using Go to filter external Go packages Project Athens has been open-source and community owned since it was formed. While Microsoft engineers remain the core maintainers of the project, Athens is supported by many developers from the open-source community now. GopherSource Go can be confusing and intimidating to start using for both new and experienced developers. GopherSource is an initiative to enhance and expand the Go ecosystem by building up more contributors to contribute to Go and key Go projects, this includes Project Athens. GopherSource is like a community for Go developers, to contribute for upstreaming Go, give feedback, make proposals, and provide mentorship. Go at Microsoft There are many users at Microsoft who use Go to build products at scale. They implemented the core services behind Azure Kubernetes Service (AKS) in Golang. Aaron Schlesinger, developer at Microsoft Azure, and core maintainer of Project Athens, stated in Microsoft’s blog post: “Internally, we contribute a significant amount of Go code to the cloud native ecosystem, including Virtual Kubelet, which enables scheduling Kubernetes workloads to off-cluster resources such as IoT Edge or Azure Container Instances; and Helm, the Kubernetes package manager.” For more, visit the Microsoft Blog. Go 2 design drafts include plans for better error handling and generics Golang 1.11 is here with modules and experimental WebAssembly port among other updates GoMobile: GoLang’s Foray into the Mobile World

Google today announced that it is stepping back from managing the Kubernetes architecture and is funding the Cloud Native Computing Foundation (CNCF) $9M in GCP credits for a successful transition. These credits are split over a period of three years to cover infrastructure costs. Google is also handing over operational control of the Kubernetes project to the CNCF community. They will now take ownership of day-to-day operational tasks such as testing and builds, as well as maintaining and operating the image repository and download infrastructure. Kubernetes was first created by Google in 2014. Since then Google has been providing Kubernetes with the cloud resources that support the project development. These include CI/CD testing infrastructure, container downloads, and other services like DNS, all running on Google Cloud Platform. With Google passing the reign to CNCF, it’s goal is to make make sure “Kubernetes is ready to scale when your enterprise needs it to”. The $9M grant will be dedicated to building the world-wide network and storage capacity required to serve container downloads. In addition, a large part of this grant will also be dedicated to funding scalability testing, which runs 150,000 containers across 5,000 virtual machines. “Since releasing Kubernetes in 2014, Google has remained heavily involved in the project and actively contributes to its vibrant community. We also believe that for an open source project to truly thrive, all aspects of a mature project should be maintained by the people developing it. In passing the baton of operational responsibilities to Kubernetes contributors with the stewardship of the CNCF, we look forward to seeing how the project continues to evolve and experience breakneck adoption” said Sarah Novotny, Head of Open Source Strategy for Google Cloud. The CNCF foundation includes a large number of companies of the likes of Alibaba Cloud, AWS, Microsoft Azure, IBM Cloud, Oracle, SAP etc. All of these will be profiting from the work of the CNCF and the Kubernetes community. With this move, Google is perhaps also transferring the load of running the Kubernetes infrastructure to these members. As mentioned in their blog post, they look forward to seeing the new ideas and efficiencies that all Kubernetes contributors bring to the project’s operations. To learn more, check out the CNCF announcement post and the Google Cloud Platform blog. Kubernetes 1.11 is here! Google Kubernetes Engine 1.10 is now generally available and ready for enterprise use. Kubernetes Container 1.1 Integration is now generally available.

During July 2018, a planned Firefox Nightly experiment was performed involving secure DNS via the DNS over HTTPS (DoH) protocol. About 25,000 Firefox Nightly 63 users had agreed to be part of Nightly experiments and participated in this study. Cloudflare operated the DoH servers that were used according to the privacy policy they had agreed to with Mozilla. Each user was additionally given information directly in the browser about the project. That information included the service provider, and an opportunity to decline participation in the study. Browser users are currently experiencing spying and spoofing of their DNS information due to reliance on the unsecured traditional DNS protocol. Using a trusted DoH cloud based service in place of traditional DNS is a significant change in how networking operates and it raises many things to consider as we go forward when selecting servers. However, the initial experiment focused on validating two separate important technical questions: Does the use of a cloud DNS service perform well enough to replace traditional DNS? Does the use of a cloud DNS service create additional connection errors? The experiment is now complete and here are the finding highlights: The HTTPS with a cloud service provider shows a minor performance impact on the majority of non-cached DNS queries as compared to traditional DNS. Most queries were around 6 milliseconds slower, which seems to be an acceptable cost for the benefit of securing the data. However, the slowest DNS transactions performed much better with the new DoH based system than the traditional one – sometimes hundreds of milliseconds better. Source: Firefox Nightly The above chart shows the net improvement of the DoH performance distribution vs the traditional DNS performance distribution. The fastest DNS exchanges are at the left of the chart and the slowest at the right. The slowest 20% of DNS exchanges are radically improved (improvements of several seconds are truncated for chart formatting reasons at the extreme), while the majority of exchanges exhibit a small tolerable amount of overhead when using a cloud service. It shows a good result. The Firefox team hypothesized the improvements at the tail of the distribution derived from 2 advantages DoH provides compared to traditional DNS. First, the consistency of the service operation – when dealing with thousands of different operating system that are overloaded, unmaintained, or forwarded to strange locations. Second, HTTP’s use of modern loss recovery and congestion control allow it to better operate on very busy or low quality networks. The experiment also considered connection error rates and found that users using the DoH cloud service in ‘soft-fail’ mode experienced no statistically significant different rate of connection errors than users in a control group using traditional DNS. Soft-fail mode primarily uses DoH, but it will fallback to traditional DNS when a name does not resolve correctly or when a connection to the DoH provided address fails. The connection error rate measures whether an HTTP channel can be successfully established from a name and therefore incorporates the fallbacks into its measurements. These fallbacks are needed to ensure seamless operation in the presence of firewalled services and captive portals. “We’re committed long term to building a larger ecosystem of trusted DoH providers that live up to a high standard of data handling. We’re also working on privacy preserving ways of dividing the DNS transactions between a set of providers, and/or partnering with servers geographically. Future experiments will likely reflect this work as we continue to move towards a future with secured DNS deployed for all of our users.” says the Firefox Nightly team. Mozilla’s new Firefox DNS security updates spark privacy hue and cry Firefox Nightly browser: Debugging your app is now fun with Mozilla’s new ‘time travel’ feature Firefox has made a password manager for your iPhone

Red Hat and SUSE have withdrawn their support for OpenLDAP in their Enterprise Linux offers, which will be replaced by Red Hat’s own 389 Directory Server. The openldap-server packages were deprecated starting from Red Hat Enterprise Linux (RHEL) 7.4, and will not be included in any future major release of RHEL. SUSE, in their release notes, have mentioned that the OpenLDAP server is still available on the Legacy Module for migration purposes, but it will not be maintained for the entire SUSE Linux Enterprise Server (SLE) 15 lifecycle. What is OpenLDAP? OpenLDAP is an open source implementation of Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. It is a collective effort to develop a LDAP suite of applications and development tools, which are robust, commercial-grade, and open source. What is 389 Directory Server? The 389 Directory Server is an LDAP server developed by Red Hat as a part of Red Hat’s community-supported Fedora Project. The name “389” comes from the port number used by LDAP. It supports many operating systems including Fedora, Red Hat Enterprise Linux 3 and above, Debian, Solaris 8 and above. The 389 Directory Server packages provide the core directory services components for Identity Management (IdM) in Red Hat Enterprise Linux and the Red Hat Directory Server (RHDS). The package is not supported as a stand-alone solution to provide LDAP services. Why Red Hat and SUSE withdrew their support? According to Red Hat, customers prefer Identity Management (IdM) in Red Hat Enterprise Linux solution over OpenLDAP server for enterprise use cases. This is why, they decided to focus on the technologies that Red Hat historically had deep understanding, and expertise in, and have been investing into, for more than a decade. By focusing on Red Hat Directory Server and IdM offerings, Red Hat will be able to better serve their customers of those solutions and increase the value of subscription. To know more on Red Hat and SUSE withdrawing their support for OpenLDAP, check out Red Hat’s announcement and SUSE release notes. Red Hat Enterprise Linux 7.6 Beta released with focus on security, cloud, and automation Red Hat Enterprise Linux 7.5 (RHEL 7.5) now generally available Google, IBM, RedHat and others launch Istio 1.0 service mesh for microservices

On 27th August, a self-proclaimed ‘retired vulnerability researcher’ who goes by the name ‘SandboxEscaper’  tweeted about a local privilege escalation exploit for Windows. The unknown Windows zero-day vulnerability found in the Windows OS could allow a local user or a malicious one to obtain system privileges on the targeted machine. Will Dorman, an engineer of CERT/CC, confirmed the vulnerability and issued an official CERT/CC alert on the same day. He said that the vulnerability is a privilege escalation issue and resides in the Windows' task scheduler program. It occurred due to errors in the handling of Advanced Local Procedure Call (ALPC) systems. ALPC interface is a Windows-internal mechanism and works as an inter-process communication system. With ALPC, a client process running within the OS can ask a server process running within the same OS to provide some information or perform some action. Proof-of-concept (PoC) code to exploit the ALPC interface on GitHub SandboxEscaper released a proof-of-concept (PoC) code on GitHub on 7th May,  in order to exploit the ALPC interface to gain SYSTEM access on a Windows system. This PoC can largely attract malware authors as it allows benign malware to gain an admin access on targeted systems. At present, there are no known solutions for this vulnerability, which has been awarded a Common Vulnerability Scoring System (CVSS) score of 6.4 - 6.8. A CVSS score ranging between 4.0 - 6.9 is said to have medium severity as per the Qualitative Severity Rating Scale. SandboxEscaper did not notify Microsoft about the vulnerability, which leaves all the Windows 64-bit users prone to attack. However, Microsoft has acknowledged the 0-day flaw and we can expect this flaw to be resolved in Microsoft's next security updates scheduled for September 11, the company's next ‘Patch Tuesday’. The person behind the Windows zero-day hack:  SandboxEscaper This vulnerability was discovered by a self-educated blogger named ‘Sandbox escaper’. Her previous work can be found at https://sandboxescaper.blogspot.com/p/disclosures_8.html What is intriguing is that the blogger calls herself a ‘retired vulnerability researcher’ who now blogs on travel. However, she has just started looking for a job in vulnerability research a week before her now famous Windows 0day hack. She says on her post on her current job hunt, “I have mainly focused on logic bugs so far. So ideally I would prefer a place that is willing to mentor me, and doesn't just expect me to start breaking all the hard targets and sandboxes by myself. I would also prefer an onsite job in the UK (I'm currently a citizen of Belgium and also living there).” She also goes forth to mention that being a transgender, her transition has been really difficult. Dealing with social pressure and anxiety isn’t easy, but this vulnerability researcher is causing heads to turn thanks to this discovery! She’s definitely got Microsoft’s attention now. Would be interesting to see if Microsoft decides to give her a chance at a job interview. On a related note, this story also underscores the existing toxic culture in tech and highlights why it is important for tech companies to push inclusion and diversity as a key CxO performance metric. A person should be judged on merits and capabilities, not on their personal lifestyle choices or their traits/features, physical, emotional, sexual, political or otherwise. Further updates to this story After SandboxEscaper’s first tweet caused friction in the flaw disclosure process. She followed up with another tweet stating "Enjoy the 0day. It will get patched really fast. I guess I had fun today. Now I'm gone for a while, bye." Publicly releasing Windows vulnerabilities before Microsoft has issued a patch is quite rare. Microsoft, and many other companies offer bug bounties, or rewards, for information on software flaws. However, publicly disclosing the flaw vindicates someone from earning a bug bounty. As per Microsoft's rules, detailed proof-of-concept code similar to the one that SandboxEscaper posted, must not be disclosed until 30 days after Microsoft issues a patch. Her GitHub video might have violated Microsoft's terms and conditions for bug rewards. Yesterday, SandboxEscaper tweeted, "I screwed up, not MSFT (they are actually a cool company)." SandboxEscaper received an overwhelmingly positive response and compliments for her vulnerability discovery from various tech geeks, including from the cybersecurity training company Hacker House. Read more about this 0day exploit’s technical details on Kevin Beaumont’s Medium post. Note: Updated on 30th Aug, to include section on ‘Further updates to this story’. Epic games CEO calls Google “irresponsible” for disclosing the security flaw in Fortnite Android Installer before the patch was ready Sugar operating system: A new OS to enhance GPU acceleration security in web apps Meet ‘Foreshadow’: The L1 Terminal Fault in Intel’s chips

The Lerna team has taken a strong stand against the U.S. Immigration and Customs Enforcement ( ICE ) by modifying their MIT license to ban companies who have collaborated with ICE from using Lerna. Lerna is a tool for managing large-scale JavaScript projects with multiple packages. Lerna lets you add dependencies to multiple packages with a single command. It made monorepos available to everyone, which were earlier very expensive and used only by big companies. A comment on Github by a Lerna developer, Jamie Kyle earlier this day, stated how he has been deeply disturbed by ICE’s behavior with American immigrants, especially with the way ICE has acted with immigrant children and wants it to stop. “The actions of ICE have had a lifelong lasting impact on these children, and many of them won't even remember it happening. I have trouble expressing how angry this makes me feel. And the worst part is that I feel helpless to improve the situation. There is one thing I have control over, and that's open source”, reads the post. Kyle states that major tech giants such as Facebook, Uber, Google, Amazon, etc, carry out “a lot of shady things behind the scenes. These companies care only about the millions of dollars that ICE is paying them and are willing to ignore all the horrible things that ICE does.” Now, these companies are also using Lerna, and “it's really hard for me to sit back and ignore what these companies are doing with my code” says Kyle. Reinforcing Lerna’s ethical beliefs, the updated Lerna license bans companies that are known collaborators with US Immigration and Customs Enforcement such as Microsoft, Palantir, and Amazon, among the others from using Lerna. These companies don’t have any licensing rights and “any use of Lerna will be considered theft”. They cannot pay for a license, and if they wish to use Lerna, they need to publicly end their contracts with ICE. For everyone else, Lerna will remain MIT licensed. Public opinion about Lerna’s decision against ICE is varied: https://twitter.com/AdrienDittrick/status/1034716993323184128 https://twitter.com/sarah_federman/status/1034633564065656832 https://twitter.com/_juandjara/status/1034716644667473921 https://twitter.com/stefanpenner/status/1034687675066970112 “Now, it's not news to me that people can use open source for evil. But it's really hard for me to sit back and ignore what these companies are doing with my code. It doesn't feel like there are enough steps in between me and the horrible things ICE is doing” says Kyle. For more information, check out the official Github post. Facebook’s AI algorithm finds 20 Myanmar Military Officials guilty of spreading hate and misinformation, leads to their ban Intel faces backlash on Microcode Patches after it prohibited Benchmarking or Comparison Homebrew’s Github repo got hacked in 30 mins. How can open source projects fight supply chain attacks?  

Godot is an open source community-driven 2D and 3D game engine. It works on a unified interface and is cross-platform. Godot is completely free and under the MIT license. Games made in Godot can be exported to Linux, macOS, Windows, Android, iOS, and HTML5. As of a recent commit made two days ago, the master branch of Godot is now in the alpha stage. This means that v3.1 is now considered feature-complete and the focus of the developers will be only on bug fixing along with improvements to existing features. Such a stage is called as a feature freeze. Any new features will have to wait for 3.1-stable to come in a couple of months. Contributors are requested not to make feature pull requests as they have a potential to create new bugs. PRs can be made once the feature freeze is lifted and a stable release is out. The feature pull requests currently made won’t be closed but will be targeted at the v3.2 milestone release. There are some exceptions to the freeze rule. Enhancements to the major new features of the 3.1 release may be considered, especially usability fixes. Work on mono/C# support is continuous. Approved features discussed with contributors on IRC  may still be considered if they are a priority for the 3.1 release. Features of the Godot game engine version 3.1 Godot comes with hundreds of built-in nodes that make game design easy Flexible scene system allows creating node compositions with support for inheritance and instancing A visual editor packed with all the tools you need Persistent live editing without loss of changes after stopping the game which also works on mobile devices Ability to create your own custom tools with ease via the tool system For more details on Godot 3.1, visit the GitHub page. How to Create 2D Navigation with the Godot Engine Unity 2018.2: Unity release for this year 2nd time in a row! Xenko 3.0 game engine is here, now free and open-source

Github has introduced “Project Paper Cuts” that was inspired from a lot of refined GitHub additions. This project aims to fix smaller code related and UI issues that users face during a project development workflow.   Source: Twitter Project Paper Cuts is committed to working directly with the community in order to fix small to medium-sized workflow problems. It aims to improve UI/UX and find ways to make quick improvements to nagging issues that users often encounter in their projects. The project aims to find fixes on issues that have the most impact but are supported with hardly any or no discussions. Most “paper cuts” will have a public changelog entry associated with them so users can keep pace. The few “lesser talked issues” that GitHub has already managed to solve are: #1 Unselect markers when copying and pasting the contents of a diff The + and - diff markers are no longer copied to the clipboard when users copy the contents of a diff. #2 Edit a repository’s README from the repository root If a user has the permission to push to a repository,  they can edit a README file from the repository root by clicking the pen icon to the right of the README’s file header. #3 Users can access their repositories straight from the profile dropdown Users can use the profile dropdown, on any page, to quickly go straight to the “Your Repositories” tab within their user profile. #4 Highlight permalinked comments When following a permalink to a specific comment in an issue or pull request, the comment will be highlighted so that a user can easily find it among other comments in the thread. #5 Remove files from a pull request with a button If a user has a write permission, he can click on the ‘trash’ icon for a file right in the pull request’s “Files changed” view to make a commit and remove it. #6 Branch names in merge notification emails The email notification from GitHub about a merge will also include the name of the base branch that the change was merged into. #7 Users can create new pull requests from their repository’s Pull Requests Page In order to quickly create a pull request without having to switch back to the “Code” tab, when a user push branches while using the “Pull requests” tab, GitHub will now display the dynamic “Compare and pull request” widget. #8 Add a teammate from the team discussions page Users can add an organization member to a team directly from the team discussion page by clicking the + button inside the sidebar. #9 Collapse all diffs in a pull request at once When a pull request contains a lot of changed files, code reviewers find it hard to isolate the changes that are necessary/ important to them. Project paper cut allows them to collapse or expand the contents of all diffs in a pull request. This can be done by holding down the alt key and clicking on the inverted caret icon in any file header. They can also use the “Jump to file or symbol” dropdown to jump to the file that they are interested to review to automatically expand it. #10 Copy the URL of a comment Previously, in order to grab a permalink to a comment within an issue or pull request, users would have to copy the URL from a comment’s timestamp. They can now click Copy URL within the comment’s options menu to quickly copy the URL to the clipboard. Project Paper Cuts is solely aimed to help all developers do their best work, faster. By incorporating customers feedback into making this project, GitHub is paving the way to make small changes in the way it works. You can read the detailed announcement on the Github Blog to know more about Project Paper Cuts. Git-bug: A new distributed bug tracker embedded in git Microsoft’s GitHub acquisition is good for the open source community GitHub open sources its GitHub Load Balancer (GLB) Director