This Week In Security: The UK Wants Your ICloud, Libarchive Wasn’t Ready, And AWS

February 14, 2025 by Jonathan Bennett 15 Comments

There’s a constant tension between governments looking for easier ways to catch criminals, companies looking to actually protect their users’ privacy, and individuals who just want their data to be truly private. The UK government has issued an order that threatens to drastically change this landscape, at least when it comes to Apple’s iCloud backups. The order was issued in secret, and instructed Apple to provide a capability for the UK officials to access iCloud backups that use the Advanced Data Protection (ADP) system. ADP is Apple’s relatively new end-to-end encryption scheme that users can opt-into to make their backups more secure. The key feature here is that with ADP turned on, Apple themselves don’t have access to decrypted user data.

If this order wasn’t onerous enough, it seems to explicitly include all ADP-protected data, regardless of the country of origin. This should ring alarm bells. The UK government is attempting to force a US company to add an encryption backdoor to give them access to US customer data. Cryptographer [Matthew Green] has thoughts on this situation. One of the slightly conspiratorial theories he entertains is that portions of the US government are quietly encouraging this new order because the UK has weaker protections against unreasonable search and seizure of data. The implication here is that those elements in the US would use this newfound UK data access capability to sidestep Fourth Amendment protections of citizens’ data. This doesn’t seem like much of a stretch.

[Matthew] does have a couple of suggestions. The first is passing laws that would make it illegal for a US company to add backdoors to their systems, specifically at the request of foreign nations. We’ve seen first-hand how such backdoors can backfire once accessed by less-friendly forces. In an ironic turn of fate, US agencies have even started recommending that users use end-to-end encrypted services to be safe against such backdoors. Technically, if this capability is added, the only recourse will be to disable iCloud backups altogether. Thankfully Apple has pushed back rather forcefully against this order, threatening to simply turn off ADP for UK users, rather than backdoor the rest of the world. Either way, it’s a scary bit of overreach.

Continue reading “This Week In Security: The UK Wants Your ICloud, Libarchive Wasn’t Ready, And AWS” →

Screenshot of Linux in a PDF in a browser

Nice PDF, But Can It Run Linux? Yikes!

February 10, 2025 by Heidi Ulrich 21 Comments

The days that PDFs were the granny-proof Swiss Army knives of document sharing are definitely over, according to [vk6]. He has managed to pull off the ultimate mind-bender: running Linux inside a PDF file. Yep, you read that right. A full Linux distro chugging along in a virtual machine all encapsulated within a document. Just when you thought running DOOM was the epitome of it. You can even try it out in your own browser, right here. Mind-boggling, or downright Pandora’s box?

Let’s unpack how this black magic works. The humble PDF file format supports JavaScript – with a limited standard library, mind you. By leveraging this, [vk6] managed to compile a RISC-V emulator (TinyEMU) into JavaScript using an old version of Emscripten targeting asm.js instead of WebAssembly. The emulator, embedded within the PDF, interfaces with virtual input through a keyboard and text box.

The graphical output is ingeniously rendered as ASCII characters – each line displayed in a separate text field. It’s a wild solution but works astonishingly well for something so unconventional.

Security-wise, this definitely raises eyebrows. PDFs have long been vectors for malware, but this pushes things further: PDFs with computational power. We know not to trust Word documents, whether they just capable of running Doom, or trash your entire system in a blink. This PDF anomaly unfolds a complete, powerful operating system in front of your very eyes. Should we think lightly, and hope it’ll lead to smarter, more interactive PDFs – or will it bring us innocent looking files weaponized for chaos?

Curious minds, go take a look for yourself. The project’s code is available on GitHub.

Continue reading “Nice PDF, But Can It Run Linux? Yikes!” →

Flip Flops Make Great Soft Switches

February 10, 2025 by Zoe Skyforest 46 Comments

Mechanical switches are pretty easy to understand—the contacts touch, the current flows, and Bob is, presumably, your uncle. But what about soft switches? Well, they’re not that difficult to understand either, as explained by [EDN].

*You can build a touch switch quite easily with old-school chips.*

The traditional softswitch takes input from a momentary single-pole pushbutton and lets you press to toggle power on and off. This operation is easy to achieve with a simple flip-flop constructed with old-school logic to create a “bistable” circuit. That means it will happily remain stable in one of two states unless you do something to make it switch.

Continue reading “Flip Flops Make Great Soft Switches” →

Your Chance To Get A Head (A Gnu Head, Specifically)

February 9, 2025 by Al Williams 43 Comments

The Free Software Foundation is holding an auction to celebrate its 40th anniversary. You can bid on the original sketch of the GNU head by [Etienne Suvasa] and [Richard Stallman’s] Internet Hall of Fame medal.

There are some other awards, including the FSF’s 1999 Norbert Wiener Award. There’s even a katana that symbolizes the fight for computer user freedom.

Continue reading “Your Chance To Get A Head (A Gnu Head, Specifically)” →

Moving Power Grids In A Weekend, The Baltic States Make The Switch

February 9, 2025 by Jenny List 35 Comments

A significant event in the world of high-power electrical engineering is under way this weekend, as the three Baltic states, Lithuania, Latvia, and Estonia, disconnect their common power grid from the Russian system, and hook it up to the European one. It’s a move replete with geopolitical significance, but it’s fascinating from our point of view as it gives a rare insight into high voltage grid technology.

There are a few news videos in the air showing contactors breaking the circuit, and even a cable-cutting moment, but in practice this is not as simple a procedure as unplugging an appliance from a wall socket. The huge level of planning that has gone into this move is evident in the countrywide precautions in case of power loss, and the heightened security surrounding the work. As we understand it at the moment the three countries exist as a temporary small grid of their own, also isolating the Russian exclave of Kaliningrad which now forms its own grid. The process of aligning the phase between Baltic and European grids has been under way overnight, and an online monitor shows significant frequency adjustments during that time. At some point on Sunday a new connection will be made to the European grid via Poland, and the process will be completed. We imagine that there will be a very relieved group of electrical engineers who will have completed their own version of a Moon landing when that has happened.

If you happen to live in either region, there’s still some time to watch the process in action, by monitoring the supply frequency for yourself. It’s not the first time that geopolitics have affected the European grid, as the continent lost six minutes a few years ago, and should you Americans think you are safe from such problems, think again.

C++ Is 45 Years Old. [Stroustrup] Says You Still Don’t Get It!

February 9, 2025 by Al Williams 117 Comments

We were surprised when we read a post from C++ creator [Bjarne Stroustrup] that reminded us that C++ is 45 years old. His premise is that C++ is robust and flexible and by following some key precepts, you can avoid problems.

We don’t disagree, but C++ is much like its progenitor, C, in that it doesn’t really force you to color inside the lines. We like that, though. But it does mean that people will go off and do things the way they want to do it, for any of a number of good and bad reasons.

Continue reading “C++ Is 45 Years Old. [Stroustrup] Says You Still Don’t Get It!” →

When Ignoring Spam Loses You An Ice Surfacer Patent

February 7, 2025 by Donald Papp 47 Comments

Bear with us for a moment for a little background. The Rideau Canal Skateway in Ottawa is the world’s largest natural skating rink, providing nearly 8 km of pristine ice surface during the winter. But maintaining such a large ice surface is a challenge. A regular Zamboni can’t do it; the job is just too big. So the solution is a custom machine called the Froster, conceived by Robert Taillefer and built by Sylvain Fredette.

*Froster* spans almost twenty meters, and carries almost 4000 L of water. There’s no other practical way to maintain almost 8 km of skating rink.

A patent was filed in 2010, granted by the Canadian Intellectual Property Office, and later lost because important notifications started going to an apparently unchecked spam folder. The annual fee went unpaid, numerous emails went unanswered, an expiry date came and went, and that was that.

It’s true that emailed reminders (the agreed-upon — and only — method of contact) going unnoticed to spam was what caused Robert to not take any action until it was too late. We’d all agree that digital assistants in general need to get smarter, and that includes being better at informing the user about automatically-handled things like spam.

But what truly cost Robert Taillefer his patent was having a single point of failure for something very, very important. The lack of any sort of backup method of communication in case of failure or problem meant that this sad experience was, in a way, a disaster just waiting to happen. At least that’s how the Federal Court saw it when he took his complaint to them, and that’s how they continued to see it when he appealed the decision.

If you’ve never heard of the Rideau Canal Skateway or would like to see the Froster in action, check out this short video from the National Capital Commission of Canada, embedded just under the page break.

Continue reading “When Ignoring Spam Loses You An Ice Surfacer Patent” →