Spotify is extending its free trial for Spotify Premium from one month to three months. Which means that anyone who hasn’t yet tried Premium can try it free for three months. Putting Spotify on a par with Apple Music, which also offers a three-month free trial.
Spotify and Apple Music Fight for Subscribers
Spotify now boasts more than 100 million subscribers. That’s the number of people who actually pay for the privilege of streaming music, with many more listening for free. However, Spotify wants more subscribers, especially with Apple Music growing as a threat.
Apple Music launched in 2015. Unlike Spotify, Apple Music doesn’t offer a free tier, so all of the 60 million users and counting pay for the privilege. But not before enjoying a free trial lasting three months. Which is two months longer than Spotify offers.
Spotify Extends Its Free Trial to Three Months
So, as a way of enticing people into subscribing to Spotify Premium, Spotify is extending its free trial from one month to three months. Putting it on a par with Apple Music. Which seems to be a sensible way of countering the growing threat posed by Apple Music.
Finally made the jump. After years of limited skips and ads, I bought Spotify premium. Live look at me for the next 24 hours: pic.twitter.com/2S5hbUyGwh
Spotify announced this change in a post on the Spotify Blog talking up the benefits of a Spotify Premium subscription. Which includes the lack of ads, the option to download music and podcasts, and the ability to play music on demand across devices.
The three-month free trial is available from today (August 22) and will apply to all eligible users who sign up to Spotify Premium. This is available for individual and student plans, but only for people who “haven’t already tried Premium”.
Protenus, a healthcare analytics firm, says hackers and other bad actors breached 32 million patient records in the first six months of 2019. That’s double the total breaches for all of 2018.
2019 is shaping up to be a bad year for personal information. With 32 million patient records stolen in just six months and no signs of slowing down, it seems like everybody is receiving notice to lock down their credit. And that’s to say nothing of breaches in other institutions.
According to Protenus, hackers were responsible for 60 percent of the breaches in those six months and hospital insiders were responsible for a total of three million patient records stolen.
In the single most significant breach, hackers targetted a medical collections agency and stole the patient records for 20 million people. That stolen data ended up for sale on the dark web.
Unfortunately, there’s no way to prevent someone from stealing your data from a hospital or doctor’s office. Ultimately, it’s up to the institutions to implement better security. The best thing you can do currently is to freeze your credit. You may want to consider the freeze even if you’re the last person on Earth who hasn’t had their data stolen. [Engadget]
Lyft pulled 1,000 electric bikes from service after two fires: Two Lyft e-bikes caught fire while in its docks in San Francisco. Given the nightmare scenario of riding a bike that catches on fire, Lyft has wisely chosen to take its e-bikes out of service while it investigates what happened. [Gizmodo]
Google is actively testing a new Play Pass subscription service: Subscriptions for app stores are on the way. Apple is working on an Arcade subscription service and Google is testing the waters with a Play Pass subscription. According to screenshots, $5 a month gives you access to hundreds of apps and games. [Android Police]
Alexa may answer more complicated questions in the future: Amazon is working on making Alexa more intelligent. That includes complicated questions such as, “Which Nolan films won an Oscar but missed a Golden Globe?” The process is complicated because Alexa needs to figure out you mean Christopher Nolan, find his awards for Oscars and Golden Globes, and then compare and contrast that information. But Amazon says it has the process figured out. Neat! [TechCrunch]
Apple is joining the Data Transfer Project: Last year, Google, Microsoft, Facebook, and Twitter launched the Data Transfer Project. The goal is to make it easy for you to transfer data from one service to another. Eventually, that would entail direct transfers with no download on your part. Apple joining adds another strong voice to the plan to give you greater control of your data. [The Verge]
NanoLeaf’s smart lights will double as smart buttons for Homekit: If you have (or are interested in) NanoLeaf’s beautiful modular smart light squares, the devices are picking up a new feature—touch controls. You’ll soon be able to touch the lights to control your smart home, at least if you have Homekit powered home. Hopefully, they expand to other ecosystems in the future. [MacRumors]
The Solar Light Sail 2, currently cruising above the Earth, is raising its orbit. That may not seem impressive at first, but the spacecraft is using light for propulsion. The craft has a boxing ring sized sail designed to catch light particles. While light particles don’t have mass, they do have carry momentum. In this case, enough to give the spacecraft a push.
The Solar Light Sail 2 is in an elliptical orbit, so eventually, it will come crashing down to Earth. Raising it’s orbit right now will only speed up that process. But the project proves that solar sails are viable means of propulsion for satellites too small to depend on traditional fuel engines. [Space.com]
This month, Microsoft Patch Land looks like a stranger Stranger Things Upside Down, where Security-only patches carry loads of telemetry, Visual Studio patches appear for the wrong versions… and we still can’t figure out how to keep the Win10 1903 upgrade demogorgon from swallowing established drivers.
As we end the month, we’ve seen the second “optional” monthly cumulative updates for all Win10 versions — the 1903 patch was released, pulled, then re-released — and fixes for Visual Studio’s transgressions. There’s a kludge for getting the Win10 1903 upgrade to work. And BlueKeep still looms like a gorging Mind Flayer.
Win7 Security-only patch brings telemetry
Those of you who have been dodging Windows 7 telemetry by using the monthly Security-only patches — a process I described as “Group B” three years ago — have reached the end of the road. The July 2019 Win7 “Security-only” patch, KB4507456, includes a full array of telemetry/snooping, uh, enhancements.
We don’t know what information Microsoft’s collecting with the new patch, but if you’ve been hoping to minimize Microsoft snooping by staying on the increasingly difficult Security-only path, the jig is up. You have two options:
Install the July Security-only update and start sending your telemetry to Microsoft, or
Stop patching entirely (“Group W”), six months before Win7’s end of life
It’s not an easy choice.
In my opinion, if you want to continue to patch Win7, you’re better off paying the devil his due and installing the Win7 Monthly Rollup, KB4507449 (“Group A”). That’ll give you the full version of Win7 telemetry, along with many small bug fixes.
To be sure, there are two sides to this development. On the one hand, you have people who feel that Microsoft should start collecting all of the data it can to guide the inevitable demise of Win7 and help customers onto Win10. On the other hand, you have people who just don’t like the intrusion.
I’m surprised that regulators haven’t launched an investigation into Microsoft’s newfound nosiness, but the fact remains that we don’t know what telemetry is being collected along either the Monthly Rollup or Security-only path.
Win10 1903 upgrade block for Intel RST drivers
Microsoft has halted Win10 version 1903 upgrades for PCs that have older versions of the Intel Rapid Storage Technology (RST) drivers. (Think Optane memory or certain RAID drivers.) The latest official Release Information status page says:
To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST driver version between 126.96.36.1992 and 188.8.131.523 installed from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.
Just one problem. Many, many people report that the Win10 1903 upgrade refuses to proceed in spite of the fact that they have recent Intel RST drivers. When they try to upgrade to 1903, they’re getting a block notice, which looks like this:
This is in spite of the fact that these folks have moved heaven and earth to try to get the latest versions of the RST drivers. An anonymous poster on AskWoody has a workaround that may or may not apply in all situations.
To my point of view, this is a feature, not a bug. It’s still too early to move to Win10 version 1903. There are still too many bugs lurking about — this being an excellent case in point. Give 1903 a few more months to mature, and then let’s take a new look.
It’s very difficult to keep the 1903 upgrade from changing your drivers
Speaking of problems with the Win10 1903 upgrade, Rick Corbett has been trying to get the 1903 upgrade to bypass updating his drivers — he has his drivers set up the way he likes, and he doesn’t want the upgrader to come in and mess with them.
So far, we don’t have a definitive method for blocking new drivers. In particular, the techniques that worked for 1809 and earlier aren’t working right in 1903.
Second monthly Win10 cumulative updates are all available
The second, “optional” Win10 July cumulative updates are all out, although the 1903 patch was posted last Thursday, pulled, then released again last Friday.
Miscellaneous problems with Visual Studio, SQL Server
If you couldn’t get the Visual Studio patch KB4506161 installed, you aren’t alone. Microsoft messed up the version detection mechanism. It was fixed in a re-release on July 19, leaving admins everywhere scratching their heads for 10 days.
Also, in case you missed it, SQL Server 2008 has been relegated to the big bit bucket in the sky. Susan Bradley has the full story, including some workarounds, in her Patch Watch column.
Updated support sites
We have a new set of Servicing Stack Updates for all versions of Win10, as well as Win8.1. (If you use Windows Update to get your updates, you don’t need to worry about the new SSUs. They only apply if you manually install updates.)
There are new lists of cumulative updates for .NET:
There aren’t any entries in the latter list, so far.
Get Windows XP, Vista, Win7 systems patched to May
I would remiss if I didn’t repeat, loudly, the BlueKeep message I’ve been posting for months. If you run a WinXP, Vista, Win7, Server 2003, or Server 2008 machine and you haven’t installed the May patch, you’re playing with fire. Tell your friends to get patched. There are still many hundreds of thousands of machines sitting out there with “Kick me” signs facing the internet.
On Christmas day, 2013, many delighted people opened up new Xbox and Playstation gifts. That excitement turned to disappointment when they were unable to log onto game services and play. Now the hacker responsible will spend 27 months in jail.
Austin Thompson is the worst kind of trendsetter. Back in 2013, many game services, whether it be Xbox, PlayStation, or Steam, were ill prepared for DDOS attacks. That fact became readily apparent when Thompson easily took down multiple services over the Christmas holiday break.
Under the name DerpTrolling, the hacker took requests, made announcements of next targets, and then frequently brought another game service to its knees.
Others took notice and followed suit, DerpTrolling inspired Lizard Squad, Phantom Squad, and others, some of which set up DDOS-for-hire services.
Later in 2014, Federal Agents found and arrested Thomson. In late 2018 he pleaded guilty. Now the hacker has been sentenced to 27 months in prison and ordered to pay $95,000 in restitution. If you think 27 months doesn’t seem that long, keep in mind Thomson has been in jail since his arrest in 2014. [ZDNet]
Superhuman Promises to turn off Super Tracking: Superhuman, an email app that comes with fancy features and a $30 a month price tag, had a tracking problem. By default, it injected a tracking pixel into every email sent out that would tell you how many times a person opened an email and that person’s location. It was overkill, and problematic, and thankfully, Superhuman is rolling the feature back. [TechCrunch]
You should really stop using your ISP Wi-Fi router: Confirming what we’ve been sayingfor years, ISP provided routers tend to be subpar at best and only cost you extra money in the long run. A study shows that ISP supplied routers were unable to achieve full speeds on 100 Mbps networks. Worse yet the 2.4 GHz bands lost speed at a distance at a faster pace than 5 GHz band, which defies all logic. [TechRadar]
Apple may soon ditch its terrible keyboards: When you consider all the recalls as of late, the MacBook’s sterling reputation is a little bit damaged. One of the biggest reasons is the terrible keyboard that tends to stick or break altogether. Now Apple may be planning to change to a better design. Unfortunately, we don’t have confirmation yet; this is still a rumor. But here’s hoping the rumor is true. [Engadget]
Samsung sued for allegedly misleading ads: Samsung regularly touts its phones as water resistant. And they are, under the right conditions. If you drop many Samsung phones in fresh water and it doesn’t go deeper than 1.5 meters, it will likely be fine. But water resistance ratings doesn’t cover salt water or pool water scenarios, which is where Samsung shows its phones in ads. Now an Australian watchdog is suing the company, claiming the ads are misleading. [Slashgear]
YouTube bans Infosec videos in a bid to ban hacking videos: Kody Kinzie, a co-founder of Hacker Interchange, was in for a rude surprise when he went upload the latest video to the Cyber Weapons Lab channel. He couldn’t upload it: the channel had a strike for “teaching about hacking.” While the subject of hacking is covered, it’s not about how to do it illegally. Instead, it covers how to use hacking skills to protect against illegal uses. YouTube doesn’t see the distinction it seems. [The Verge]
User Inyerface is the worst—on purpose: A well-designed user interface is incredibly important. To drive that point home, design firm Bagaar created a site that features the most frustrating user interface you will ever use. If you manage to complete it (instead of tossing your keyboard at the wall), User Inyerface will reward you with a celebratory gif and show the time it took you to finish. Our best is 5:19. What can you do? [Ars Technica]
SwiftKey Beta adds its own take on Animoji: Apple’s Animoji is all the rage, but you need an iPhone from the X series to use them. Now Microsoft has its own version of Animoji called Puppets, and the company is showing them off in a beta of SwiftKey. The most impressive part is just about any Android phone can use them, no special kinect-like camera needed. [9to5Google]
Google’s upcoming camera app makes Night Sight easier to find: We think Google’s Night Sight is amazing. But one of the main problems with it is the feature is buried in a submenu which may make it hard to discover. An upcoming update will solve that by moving the Night Sight option to an easier to find location. Very nice. Now if we could just get it on non-Pixel phones… [XDA Developers]
Bad news: too much exposure to sunlight is generally bad for you. Good news: the Earth does a decent job of protecting you from that damage (but wear your sunscreen).
Astronauts, however, don’t get that protection when they’re in space. So we’ve always naturally assumed that an Astronauts is more likely to face cancer and heart disease thanks to that greater exposure to the Sun’s harmful rays.
But a new study suggests that may not necessarily be the case, at least for the short trips we’re currently taking to space. The study focused on over 400 astronauts and cosmonauts, and how they fared after their return to Earth. What scientists discovered is, despite the time spent in space, the spacefaring individuals haven’t contracted cancer or heart disease at a higher rate than the general populous.
But the study doesn’t make clear if it controlled for the better healthcare astronauts and cosmonauts are likely to receive, and it cautions that all things considered our trips are short. A trip to Mars and back will be much longer, and thus more likely to be damaging. [Gizmodo]
How many bugs could a WinPatcher patch, if a WinPatcher could patch bugs?
Ends up that June’s one of the buggiest patching months in recent memory – lots of pesky little critters, and the ones acknowledged by Microsoft led to even more patches later in the month.
In June, we saw eight single-purpose Windows patches whose sole mission is to fix bugs introduced in earlier Windows patches. I call them silver bullets – all they do is fix earlier screw-ups. If you install security patches only, these eight have to be installed manually to fix the bugs introduced earlier. It’s a congenital defect in the patching regimen – bugs introduced by security patches get fixed by non-security “optional” patches, while waiting for the next month’s cumulative updates to roll around.
The Win10 Silver Bullets
Every modern version of Win10 except 1903 – which is to say, versions 1607, 1703, 1709, 1803, 1809, Server 2016 and Server 2019 – all got three cumulative updates this month. The third cumulative update for June resolves this one issue:
Devices may have issues connecting to some Storage Area Network (SAN) devices using Internet Small Computer System Interface (iSCSI) after installing KB4497934. You may also receive an error in the System log section of Event Viewer with Event ID 43 from iScsiPrt and a description of “Target failed to respond in time for a login request.”
In other words, it’s a silver bullet – an optional patch that fixes a bug introduced in an earlier patch that you’ll only get if you download and install it manually, or if you click on “Check for updates.”
What’s strange about this bevvy of patches is the timing. Apparently, the bug arrived with the third May cumulative updates on May 21. I first saw mention of it on a Dell support forum, on June 11 and posted about it on June 19. Microsoft hadn’t acknowledged the bug at the time. (The first official announcement I saw was on June 26, the date all four silver bullets appeared.)
On June 20, Microsoft released silver bullet patches for Win7, 8.1, Server 2008 R2 SP1, 2012, 2012 R2, and Internet Explorer 11 to fix bugs introduced in the June 11 Monthly Rollups and Security-only patches.
The update for 7 SP1 and Server 2008 R2 SP1 KB 4508772, for Windows 8.1 and Server 2012 R2 KB 4508773 and for Server 2012:
“Addresses an issue that may display the error, ‘MMC has detected an error in a snap-in and will unload it.’ when you try to expand, view, or create Custom Views in Event Viewer. Additionally, the application may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs.”
Cumulative Update for Internet Explorer 11 KB 4508646
“Addresses an issue that causes Internet Explorer 11 to stop working when it opens or interacts with Scalable Vector Graphics (SVG) markers, including Power BI line charts with markers.”
The bug fixes are not included in the June Monthly Rollups or Security-only patches (June 11, 2019), but are included in the Preview Monthly Rollups released on June 20.
Once again, bugs introduced by security patches are getting the latest fixes in non-security patches.
More Win10 1903 bugs
The second monthly cumulative update for Win10 1903 appeared late, as usual, on June 27. KB 4501375 includes fixes for several acknowledged bugs, including the MMC error with Custom Views described in the preceding section.
Based on my tests… KB4501375 (18362.207) behaves exactly the same way that Feature Updates behave on 1809 and 1803 – the “download and install now” behavior. In other words, KC 4501375 will be bundled and offered as [a] secondary update with any available update even if you don’t “Check for updates.” It’s possible that the latest .NET cumulative update will trigger this behavior.
That said, deferring Feature Updates (version updates) for just 1 day makes KB4501375 go away.
Win10 1903’s disappearing Update advanced Options
We’re still in a quandary about the behavior of Win10 1903’s update deferrals.
In Win10 1903 Pro, if you go into Windows Update, advanced options, you get a pane that looks like this.
Several of you have noted that if you specify deferral options as I have here (non-zero numbers in either of the two bottom boxes), the entire “Choose when updates are installed” part of the advanced options dialog disappears.
Group policy can be used to show you the feature update deferral period. The box will show up greyed, but at least you can know the period
@abbodi goes on to say that he tested changing the Quality Update deferral period the same way, with the same result — if you set it to anything other than zero, the whole section disappears. It may be related to an internal conflict with the way Semi-Annual Channel (Targeted) was removed.
Maybe, just maybe, this is the way it’s supposed to work. If so, I’d like to nominate this particular behavior for the “Harebrained Design” hall of fame. Giving a user an option, any option, then forcing them to dig into Group Policy to modify it, stinks.
On the radar
If you’ve been struggling with the “Intel” microcode updates for Meltdown/Spectre and other “Side Channel vulnerabilities,” you aren’t alone. The latest twist appears with Karl-WE’s enormous leg work, posted on GitHub, that brings some sense to the ongoing litany of patches.
In particular, Karl notes – and MS Security Response Center guru Jorge Lopez confirms – that the phrase in KB 4346085 that says:
Important Install this update for the listed processors only.
is, quite simply, wrong. Some of the updates apply to processors that are not listed. You’re better off trusting Windows Update to pick the ones that are right for your machine. Says Lopez:
“The team didn’t want to mislead anyone reading this KB in isolation to think that installing this KB/deploying across a fleet would mean they have met the requirement for microcode for these side-channel issues – that is only true for the processors listed on the KB. We will update the line, that’s not the right way to provide that warning. So yes, you don’t have to go through some complicated deployment matrix on this KB, but you still have to do so to determine what is protected or not (vuln scanning tools should help). The logic to apply or not a microcode update is part of the boot sequence in the OS – if the processor has a microcode revision that is older than what the OS has, the OS will update the CPU microcode as part of the boot sequence.
Expect to see a correction to the KB article shortly.
To end on a positive note… remember the BlueKeep vulnerability? The one that had me crying that the sky is falling and you needed to install the May patches, like, right away? Kevin Beaumont (Twitter’s @GossiTheDog) has good news:
If anybody is pondering why there’s no public BlueKeep Remote Code Execution exploit, it’s a mix of difficulty [There’s a high bar for exploitation – in theory it is ‘just’ a use after free bug, but to be able to kernel spray you have to reverse engineer the RDP driver. There’s no documentation on how to do it for this.] and a handful of people in the InfoSec world being very responsible.
Yes, you still need to make sure you have the fix installed. You should’ve done it in May. When the exploit hits it’ll be painful. But at least we’ve been spared a bloodbath of unprecedented proportions.