X

Aggregator

Enterprise PCs are unreliable, unpatched, and unloved compared to Macs

The Register
1 month 2 weeks ago
Omnissa telemetry suggests business buyers are loving Apple and Google

End-user compute vendor Omnissa, the company formed by the spin-out of VMware’s virtual desktops, applications, and device management biz, has dug into the telemetry it collects from customers and painted a picture of the world’s enterprise hardware fleet – and the news is better for Google and Apple than it is for Microsoft.…

Simon Sharwood

NASA Halts Work On Gateway To Develop a Lunar Base

Slashdot
1 month 2 weeks ago
NASA is reportedly halting work on the lunar Gateway in favor of a more direct push to build a lunar base. The new plan would cost tens of billions over the next decade, though the change could face hurdles because Congress previously funded Gateway specifically. SpaceNews reports: "Starting today, we're building humanity's first deep space outpost," said Carlos Garcia-Galan, program executive for NASA's moon base effort. The lunar base will take place in three phases. Phase 1, running from 2026 to 2028, "is all about getting to the moon reliably," he said. That includes a significant increase in the cadence of lander missions through the Commercial Lunar Payload Services and other programs. It will also focus on developing enabling technologies and getting "ground truth" for potential base locations at the lunar south pole. Phase 2, from 2029 through 2031, starts building the base, he said. That would include building out communications, navigation, power and other infrastructure, developing larges CLPS cargo landers and supporting two crewed missions a year. Phase 3, beginning 2032, will enable "long distance and long duration human exploration" on the moon, he said, with routine logistics missions to the moon and uncrewed cargo return missions from the moon. Garcia-Galan said NASA foresees spending $10 billion each on Phases 1 and 2. Phase 3, lasting to at least 2036, would cost an additional $10 billion or more. The base would leverage existing programs, although with some changes. NASA is planning to revamp the Lunar Terrain Vehicle program after concluding the current approach would take too long to get a crew-capable rover to the moon. "We were projecting a delivery on the lunar surface by 2030," he said. The agency is instead issuing a draft request for proposals for simplified rovers that could be quicker and easier to develop but could be upgraded later. The base, though, would include some new capabilities and technologies. One example Garcia-Galan provided was MoonFall, a drone that would be able to hop from one location to another on the lunar surface. The drones will be "built on the legacy" of Ingenuity, the small Mars helicopter. "We're going to take everything that we learned from Ingenuity's systems, the avionics, all of that, to build this."

Read more of this story at Slashdot.

BeauHD

CodeSOD: Development Tools

The Daily WTF
1 month 2 weeks ago

A few holiday seasons ago, Paul S was doing the requisite holiday shopping online, looking for those perfectly impersonal but mildly thoughtful gifts that many companies specialize in. This was one of the larger such vendors, well known for its fruit-filled gift baskets. As is not uncommon for our readers, when the site started misbehaving, he pulled up the dev tools. He didn't solve the problem, but he did learn a lot about how they were managing their API keys, as this was exposed to the client:

env: { APP_AUTH0_GUID: 'ctZZL1BqgKm9kBmDEKAjt0yBeQ47Cpwl XS0xxpLFS5g8o-EUpSu4fi9ecOqN19WnXn-EqI9yaupwme22bKuBd2jH3Kf3QngZ', APP_LOGGING_ENABLED: 'true', APP_LOGGING_SERVICE_PATH: 'r/api/logging/mbp-ui', REACT_APP_MBP_LOGGER_CONSOLE: 'ERROR', APP_TIQ_ACCOUNT: '1800flowers', APP_TIQ_PROFILE: 'full', APP_TIQ_ENV: 'prod', APP_PAYPAL_SDK_URL: 'https://www.paypal.com/sdk/js', APP_PAYPAL_CLIENT_ID: 'AcYrxrOkFwUnMKRoJmkOR0N6caopqRNqwNRxy6H-EvZ-IKUz22i-E0uT0uMT7JQZEC33Oy1HCNsgm_le', APP_PAYPAL_ENV: 'production', APP_PAYPAL_SOURCE: 'PWA', APP_VENMO_ENV: 'production', APP_VENMO_PROFILE_ID: '2705494007504552889', APP_AUTH_LOGIN_SOURCE: 'undefined', APP_SG_BASKET_SCRIPT: 'https://cdn2.smartgiftit.com/scripts/widgets/gift-basket.js', APP_AUTH_DOMAIN: 'login.celebrations.com', APP_AUTH_AUDIENCE: 'celebrations-prod.1800-flowers.auth0.com', APP_STATUS_BAR_ENABLED: 'true', APP_WALLET_ENABLED: 'true', APP_VERIFY_ADDRESS_HOST: 'api.edq.com', APP_VERIFY_ADDRESS_AUTH_TOKEN: '47d991c9-043e-4073-bee3-a5c8922baa3a', APP_FULLSTORY_ORG_ID: 'MXD30', APP_GRAPHQL_ENV: 'production', APP_VISA_CHECKOUT_API_KEY: 'B0LQRDVCE0LWKBHR880J14gCRlEjr_UqLhh6V-yYRAmcvD0W8' }

I've gone ahead and mangled the keys, and given that this was a few holidays ago, I'd hope the retailer in question has fixed their website. But as you can see, it was pushing API keys for payment processors, along with potential authentication tokens and internal IDs. Now, I would hope most of these required additional authentication to be useful, and that a malicious actor couldn't do anything nasty with this information- but that's a dim hope. Even with the data exposed here, I wonder if someone could flip APP_PAYPAL_ENV to "development" or "test" and run some transactions through. Or do the same with Venmo.

This is a React app, based on some of the keys, using Graphql for communicating with the back end, and that hits at the fact that it's a single-page application. Probably, the developers were trying to build once for the web and for a "website bundled in an app" deployment for smart phones. And the result is that they weren't thinking about the distinction between "public" and "private" information- they had state to manage,so they managed it. By sending it to the client. Where anyone could see it. But it looked good, they shipped it, and they made sales, so everyone was happy.

For a time.

[Advertisement] Picking up NuGet is easy. Getting good at it takes time. Download our guide to learn the best practice of NuGet for the Enterprise.
Remy Porter