Why are security experts calling the Log4j vulnerability the worst one in a decade? Why is OSHA investigating Apple? And why did Meta revoke one Instagram user's 10-year-old Instagram account?
Learn more about your ad-choices at https://www.iheartpodcastnetwork.com
Welcome to tech Stuff, a production from I Heart Radio. Hey there, and welcome to tech Stuff. I'm your host, Jonathan Strickland, domin executive producer with I Heart Radio and I love all things tech and this is the tech news for Tuesday, December one. Let's get to it. Last week, security experts revealed the discovery of a zero day vulnerability in Apache log for j. Now, that is a Java based utility that, as the name suggests, it logs data, and tons of apps and organizations use it to help log data. I mean, data, as we all know, is worth a lot of money, but it's only worth money if you can do stuff with it, and tools such as log for j are meant to record and organized data in ways that make it useful. But the vulnerability is a doozy. It allows for remote code execution, which is security talk. That means if you exploit that vulnerability, you can use it to infiltrate someone else's machine and get that machine to execute code of your choice and thus potentially infected with malware that you have, you know, delivered to it. So this is kind of like an open gateway for hackers who can use it to infect target systems. With something really nasty. Services that rely on log for j includes some really big ones out there. Um there's a Java version of Minecraft that uses it. For example, platforms like Twitter use it. Major services like cloud Flare, which does stuff like a distributed denial of service mitigation strategies for companies they use it. So this is a major problem. It's been called the worst security vulnerability in years, like in a decade, and it's going to require companies to patch servers quickly to mitigate the damage that's already being done. Because here's the thing. The world at large wasn't really made aware of this vulnerability until Thursday, December nine one, but the bad guys surely knew about it before then and had been working on ways to infiltrate different target servers. Now. The fix, as fixes go, is relatively simple, but the scale at which it must be rolled out means that even a simple task can be a huge endeavor. Meanwhile, the thing keeping I t Pros up at night is that the next several weeks will be spent trying to determine which servers may have been compromised and by whom. CNN reports that Chinese hackers potentially backed by the Chinese government are using this vulnerability to penetrate target computer systems. Right now, the US Occupational Safety and Health Administration a k a OSHA has launched an investigation into Apple, and at the heart of the matter is an accusation from a former Apple employee who says that the company retaliated against her after she filed labor complaints against Apple and participated in public criticism of the company. So now OSHA is going to investigate Apple to see if those accusations hold water. This is another component to the ongoing movement within Apple, one in which a growing number of employees and former employees have come forward to share stories about a seemingly toxic work culture. I might need to do an episode about this before too long. I have a theory that the Steve Jobs era at Apple kind of set up a culture that could be pretty brutal at times. Jobs himself had a famous reputation for being a really, really harsh taskmaster, and in fact, people would sometimes refer who getting fired at Apple as getting jobs because he was known for having angry outbursts in which he would fire people. And my guess is that that contributed to a culture that was not particularly healthy, but during the Job's era, no one was comfortable speaking out about it. Now, years after Jobs has passed away, it looks to me like the company culture is slowly kind of falling out from that era. And now employees, particularly employees who who may not have even worked during the Jobs era, but who have uh let's say, more empowered ideas of what being an employee is are starting to bring these issues to light, and the company is kind of flailing in its responses now. I think that the employees coming forward is a good thing. I think anytime we see organizations being held accountable for the work conditions that are at that organization, that's a good thing. Um. I think it's unfortunate that Apple has appeared two engaged in retaliatory practices. If that, in fact is what OSHA discovers, the company could end up facing some pretty serious fines. You know, in the old days of the web, it was not unusual to see people rush out to register domain names in an attempt to squat on them and then sell them off later. The whole idea being if I can get that domain name, then in the future, this company that exists is going to want that they're gonna have to pay me to get off their land, essentially, so you might run out and buy something like Levi's dot com, hoping that the Levi's Genes company would ultimately come up to you and say, hey, buddy, clear off, here's you know, ten thousand bucks, give us the name. However, squatting is certainly not what thea My Bauman was doing when she created an Instagram account with the handle Metaverse. She was not trying to jump ahead of meta slash Facebook or anything unless she's able to see well into the future, because she has held that metaverse Instagram account for a decade, at least she did until November two of this year. That's when Instagram blocked her account, and all she got was an explanation that she was quote pretending to be someone else in the quote. By the way, that was not like a targeted message to her. That was an automated message that was here's why your account has been blocked. And that's still pretty rich because she had held that account for a decade. But meta slash Facebook has big plans to create a metaverse, and that you know company happens to own Instagram. So I think this was less of a you're pretending to be someone else, so now we're punishing you, and more of a we own this and we're going to engage in a little imminent domain virtual land grab here. That handle belongs to us now. And in a way I get it. I mean, I get that the company wants to own and control the handle for something that they're really planning on being a big thing, like the future of the company. However, it is more than a little bit of a low zypr move to issue a statement to a ten year old account that that account is violating rules because they're pretending to be someone else, because there was no someone else to pretend to be ten years ago. I mean, clearly this is not the case. Balman had used the account to promote her art and her business, which changed over the years, but that's what she kept using it for. She had never made any sort of claim that she was actually a Facebook plan from the future, so it's a pretty crappy move on Meta's part. In fact, if she had been using the account for ten years, like if she literally made it ten years ago, that would mean she created the Instagram account before Facebook had even bought Instagram. That happened in two thousand twelve. Anyway, my hope is that the company will make good with Bauman at some point, at least give her access to all the stuff that she has posted over that time period. I mean, I get that you want to control the metaverse handle, but this approach was so clumsy and inaccurate that it's infuriating. One of the stories I've covered this year has been the right to repair movement, in which advocates are pushing lawmakers to create rules that would require companies to make it possible for you know, people to repair their own stuff, or to bring their stuff to any repair shop that they want, instead of being forced down a company operated or company licensed business. And we've seen this with all kinds of technology, from consumer electronics like smartphones and laptops to farming tractors. John Dear is infamous for this stuff. Well, now Microsoft is adding features that make repairs on surface laptops a little more accessible. Microsoft is partnering with I fix it dot com, and Microsoft is going to offer its service tools for sale through I fix it. And uh, it's not quite at the point where the end user is going to be able to go out and get these specialty tools, So if you're not like running a repair shop or whatever, you're not going to run out and grab these so that you just have them in your tool chest at home. However, it does mean that people who are independent repair shop owners will be able to get the official tools for themselves. So it's a small step toward breaking out that siloed approach to repairs. And if you're wondering why companies even do this in the first place, the answer is money. A company can only sell you a specific lap top once, right, they sell it to you, you bought it, that's it. They can sell another one to you down the line, but the transaction of that one computer that's over. Well, if the company can guarantee that the it is the only entity that can offer maintenance and repairs, or that it will only extend that capability to repair shops that will pay a hefty licensing fee back to the company for that privilege, well then that means the company can keep making money off of a single sale indefinitely for as long as you know, you continue to use it and bringing them for maintenance and repairs. All right, we have some more stories for this episode, but before we get to that. Let's take a quick break. We're back, all right. The company Chronos that's k r o n Os announced that it was hit with a ransomware attack from hackers, and specifically, the hackers tar getted the Chronos private cloud and that houses a suite of HR tools that other companies use. So Chronos is a company that provides HR services to clients. So other companies that have chosen to outsource their HR functions. That's bad news for Chronos customers because there's an outage now and some of them have found it impossible to perform HR functions like issuing payroll. That means employees that those companies will not get paid on time, and that's always a hardship. It's particularly tough during the holidays. U k G, the parent company of Chronos, hasn't revealed many details about the ransomware attacks, such as what group was behind the attack, nor do we know anything about the company's plan to respond to the attack and whether or not they intend to pay off the ransom Once again, paying ransomware that tends to be the worst idea because it justifies the ransomware attacks in the first place. If the attacks weren't profitable hackers wouldn't use them, right, but paying off hackers pretty much ensures that future attacks will follow. That being said, it is hard to advocate a stiff upper lip approach when so many small businesses are in a holding pattern when it comes to stuff like you know, doing their payroll. Uh, that's a real issue. In fact, I would argue that's exactly why the hackers targeted something like Chronos, because especially with the timing, it means that the company is under tremendous pressure because there are all these people and organizations that depend upon those services that it's it's what you know, puts the squeeze on the company to try and convince them to pay the ransom. So, you know, it's super tough situation. And I don't know, I don't know what I would do if I were in the position of having to make decisions at Chronos. Okay, imagine for a moment that you have a piece of technology that has a convenience feature and it's one that you depend upon on occasion, and then one day the feature stops working and then you find out you can regain the use of that feature, but only if you pay a subscription fee. That's kind of what some Toyota vehicle owners are starting to experience recently. It's part of the Remote Connect suite of features, and the Remote Connect includes a bunch of convenience features like remote locks and preheating a vehicle remotely, or remote starting a vehicle. And it's that last one, the remote start, that has stopped working for some Toyota owners. And there's reasons why. I want to say that this is super tricky alright, So Toyota owners who have a two thousand, eighteen or newer vehicle can opt to have remote start as part of the remote Connect features. It's lumped in with some other features that you can get with certain Toyota vehicles. However, those features are also part of a three year trial, so you have free use of those for three years. But then once you've owned the car for three years or longer, that trial comes to an end and the remote start feature stops working, along with all the other remote Connect features that are part of that suite. But here's the weird thing. See, a lot of remote Connect features involve Toyota sending information to the car, right, so these are features that depend upon Toyota's back end so you can see why there's a subscription fee, right, you have to pay the company to maintain and operate these back end features. But remote start doesn't require that. It's all local. It's our f base radio frequency base. That means it's just radio waves that are coming from the key fob going to the car, sending a message to remote start the vehicle. There is no interfacing with Toyota's back end system at all. So in other words, the capability is actually built into the car, it's built into the key fob. But Toyota is disabling that feature remotely unless owners subscribe to the Remote Connect service. That's eight bucks a month or eighty dollars a year. Now, one silver lining here is that if you own a Toyota from before two thousand eighteen that still has remote Start, you aren't affected. Now, this is an altruism on Toyota's part. It's rather you know, self preservation and practicality. Because those cars depend upon three G receivers that's how they receive information from Toyota. They go in through the cellular network. But cellular companies are dismantling their three G networks. That means those cars will no longer be able to be part of the remote connect ecosystem at all because they won't be able to receive messages from Toyota itself. Those messages will be sent via LTE or later, so the cars will not be able to get that info. That means it would be a terrible pr move for Toyota to disable a feature and then force people to subscribe to a service that they otherwise wouldn't be able to use. In other words, it would just be, hey, pay us money so you can unlock this loc really available technology feature. That would be not great. Plus, Toyota couldn't really do it because they wouldn't be able to send the message to disable the feature or enable the feature remotely anyway. You would have to bring it in to a dealership or something to get that stuff fixed. Speaking of Toyota, the company has partnered with another company called pony dot Ai. That's a Chinese company working on autonomous car technology. Well, the state of California recently suspended pony aiyes license really, they provoked a permit, so by that I mean California has told pony dot Ai that it will no longer be allowed to conduct fully autonomous testing on California roads and highways. Now, the reason for that decision is because of an accident. So a vehicle operating under a pony dot ai autonomous system created a single vehicle accident. It veered into a road center divider. Now, no one was injured in the accident. There were no other vehicles involved, so as far as accidents go, this was kind of a best case scenario, but it did mean that California regulators were concerned enough to revoke pony dot ais permit. Now, to be clear, pony dot Ai will still be able to test vehicles. They just will have to include a safety driver behind the wheel on all tests so that a human operator could potentially take control should the car prove to be unsafe, for make errors, or be headed toward an accident. Now, I've spoken before about how creating a truly fully autonomous vehicle, one that could operate in all conditions that human drivers can operate in, that is an enormous challenge and it's probably gonna take many more years to see something approach that. And what we see today are cars that range from having very good driver assist features too limited impressive but limited self driving capabilities that only really apply under specific conditions. Meanwhile, pony dot Ai has received approval from Beijing to operate an autonomous taxi service, and they were actually in the process of trying to get that same approval from California. Presumably this incident will put a little bit of a roadblock in the way for that particular you know goal. Finally, let's talk about Nike in the metaverse. Okay, So Nike recently acquired a company called r T f KT Studios. So what does that studio do? Well, mostly it creates stuff like n f T s that is, non fungible tokens, which I have frequently referred to as a kind of receipt for something but not a thing itself. Like someone could put up a digital image and sell it as an n f T and if you bought that n f T, you'd have a digital token showing your ownership of that image. But you know, the digital image is still a file, it's still data, which means it's still something that could be copied and distributed, and yeah, you would have a receipt saying you owned it, or rather you owned a specific incarnation of it, like maybe it was a limited edition run like one of five hundred, and you've got a little digital certificate saying which one you own? Sure, but that doesn't really mean anything. It's like owning a star anyway. R T f KT also makes virtual stuff that could potentially be used in a metaverse of some sorts. So you know, they make stuff like avatars representations of people you know that are virtual, uh, digital versions of real world goods. That's another one, and I think that's probably where Nike steps in. I mean, I assume Nike is trying to get ahead of the metaverse game by creating virtual tokens that represents stuff like shoes, so that your virtual avatar in the future can sport virtual Nikes as a virtual status symbol. And all of this makes me just want to run off into the woods for the foreseeable future. Anyway, it looks like this is another sign of a company trying to get ahead of the metaverse trend. Now my own hope, and this is nothing against Nike, because I actually owned some Nikes and I really like them and everything. But my hope is that the whole metaverse push ends up fizzling out kind of the way VR has had a real go of it, because It just seems to me to be a way to digitally enhance all the stuff about humans and capitalism that I think are kind of gross and awful. But hey, I'm well on my way into turning into a grumpy old luddite. So don't listen to me. Form your own opinions. Look into it and decide what you think is good or not good. Don't just take my own grouchy approach. Uh. I just I gotta go outside and yell at a passing cloud. And that wraps up the news for Tuesday, December fourteen, twenty one. If you have suggestions for topics I should cover in Tech Stuff in the future, please reach out to me. The best way to do that is on Twitter. The handle for the show is text Stuff h W and I'll talk to you again really soon. Text Stuff is an I Heart Radio production. For more podcasts from I Heart Radio, visit the I heart Radio app, Apple Podcasts, or wherever you listen to your favorite shows.