Matthew Miller, Author at Techbest - Top Tech Reviews In Australia - Page 94 of 165

Google’s Project Zero Accelerates Vulnerability Disclosure Procedure

Matthew Miller on August 1, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Google’s Project Zero Speeds Up Vulnerability Disclosure Process

Quick Overview

  • Google’s Project Zero will now publicly disclose identified vulnerabilities within a week of notifying vendors.
  • The goal is to shorten the “upstream patch gap” for quicker user protection.
  • The current 90+30 days policy for bug remediation and patch application stays the same.
  • Technical specifics will remain undisclosed until the bug-fixing timeline concludes.
  • Experts advocate for enhanced government regulation alongside industry initiatives for enduring security improvements.

Insights on Project Zero’s New Policy

Google’s Project Zero, famous for its top-tier bug hunting team, has rolled out a fresh policy to bolster the rapidity and clarity of vulnerability disclosures. The team will now make vulnerabilities public within a week of notifying vendors, a strategy aimed at reducing the “upstream patch gap”—the lag between a vendor releasing a fix and its use in downstream products.

Google's Project Zero to announce vulnerabilities faster

Effects on End Users

Tim Willis, Project Zero’s security engineering manager, stated that the new policy is aimed at reducing the time it takes for vulnerability fixes to reach users’ devices. He stressed that for users, a vulnerability is only truly fixed when they download and apply the update on their device, not merely when a patch is made available by a vendor.

Current Policies and Security Protocols

While Project Zero’s new policy hastens the initial disclosure timeframe, it upholds the existing structure established in 2020, which permits 90 days for vendors to rectify a bug and an extra 30 days for patch implementation. Crucially, Project Zero will refrain from sharing technical details or proof of concept code until after the deadline, preventing attackers from exploiting this knowledge.

Expert Perspectives and Government Involvement

Security expert Lee Barney commended the changes, observing the potential for heightened industry standards influenced by significant tech firms like Google. Nevertheless, Barney also underscored the need for stronger governmental regulation to ensure significant change. He referenced recent legislative initiatives such as Australia’s Cyber Security Act for IoT devices as vital steps forward.

Conclusion

Google’s Project Zero has set forth a new policy to disclose vulnerabilities more swiftly, increasing transparency and pushing vendors to hasten their patching processes. By publicly announcing vulnerabilities within a week, Project Zero seeks to lessen the risks related to the “upstream patch gap.” While the policy suggests improvements, experts emphasize the need for collaborative initiatives from both industry and government to secure long-term advancements in cybersecurity.

Q: What does the “upstream patch gap” mean?

A: It refers to the delay between when a vendor issues a fix and when it is implemented in downstream products.

Q: Will the new policy alter the current bug-fix timeline?

A: No, the 90+30 days policy for fixing bugs and adopting patches remains intact.

Q: How does Project Zero protect against exploitation of disclosed vulnerabilities?

A: Project Zero holds back technical details and proof of concept code until after the bug-fixing period concludes.

Q: What role do experts suggest for the government?

A: Experts advocate for stronger governmental regulation to support industry efforts and maintain cybersecurity improvements.

Earaku Wireless Earphones Review

Matthew Miller on August 1, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Earaku Wireless Earphones, Ultimate Sound Experience, Industry’s First Multi-Functional Touch Screen, Bluetooth Earphones, DSP Sound Quality Advanced, Incus Algorithm, No Sound Leakage, Innovation in

CMF by Nothing Buds Pro 2 Wireless Earbuds Review

Matthew Miller on August 1, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

CMF by Nothing Buds Pro 2 Wireless Earbuds with HiFi Sound, 50 dB Intelligent Active Noise Cancellation, 6 HD Microphones and Spatial Audio Effect, 2026 – Light Grey

Urbanista Atlanta Wireless Earbud, Scarlet Red Review

Matthew Miller on July 31, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Urbanista Atlanta Wireless Earbud, Scarlet Red

ADHA Invites Proposals for Support of My Health Record and API Gateway

Matthew Miller on July 31, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

ADHA Digital Upgrade: My Health Record and API Gateway

Quick Overview

  • ADHA invites proposals for integrated support of My Health Record and API Gateway.
  • This project is part of a comprehensive digital infrastructure upgrade.
  • The tender represents the first competitive bidding for the $788 million contract in over ten years.
  • My Health Record is developed using Oracle technologies, supported by extensive user licences.
  • API Gateway, created by Deloitte, operates on Microsoft Azure and Red Hat OpenShift.
  • ADHA aims to enhance the digital health landscape in Australia.

Overview

The Australian Digital Health Agency (ADHA) is advancing with a bold initiative to merge My Health Record and API Gateway into a singular application support and maintenance agreement. This move is part of a larger strategy to revamp the country’s digital health infrastructure.

ADHA Invites Bids for My Health Record and API Gateway Support

Tender Announcement

ADHA has issued a tender request for services encompassing the technologies and platforms that underpin My Health Record and the API Gateway. This is the first occasion that the $788 million digital infrastructure contract, which has been with Accenture since 2012, is available for competitive bidding.

Technological Backbone

My Health Record is constructed on Oracle technologies, primarily featuring Oracle Database Enterprise Edition at its core. Oracle Access Manager, Splunk, and Symantec enhance its security features. Data storage and indexing are facilitated by Oracle Healthcare Data Repository and Oracle Health Sciences Information Manager. ADHA maintains 28 million perpetual Oracle user licenses for user engagement support.

User Access Points

Adobe Experience Manager supports key user access points, including the National Consumer Portal, National Provider Portal, and Administration Portal, offering vital interfaces for stakeholders.

The API Gateway

The API Gateway acts as a vital link for external stakeholders, accommodating 125 APIs of varied complexity. Redeveloped by Deloitte, it became operational in 2022. It is hosted on Microsoft Azure as well as on the Red Hat OpenShift platform, replacing an earlier Oracle gateway managed by Accenture.

Contract Specifications

Deloitte’s agreement for the API Gateway, commenced in July 2021, is valued at $50 million and is scheduled to conclude in December 2026. Questions arose regarding whether the new tender encompasses a distinct management scope.

Future Prospects

As ADHA embarks on a thorough transformation to modernise Australia’s digital health framework, the revamp of My Health Record is expected to be pivotal. ADHA CTO John Borchi highlighted that the tender signifies a vital opportunity to uphold Australia’s status as a world leader in digital health innovation.

Conclusion

ADHA is merging My Health Record and API Gateway support into a unified contract as part of a larger digital infrastructure upgrade. This tender opens up the $788 million contract to competitive bids for the first time in over a decade, with the goal of modernising and enhancing Australia’s digital health system.

Q: Why is the ADHA’s tender request important?

A: The tender request is significant as it initiates the first competitive bidding process for the $788 million digital infrastructure contract in over a decade, aiming to unify support for My Health Record and the API Gateway.

Q: What technologies are foundational to My Health Record?

A: My Health Record is constructed using Oracle technologies, which include Oracle Database Enterprise Edition, Oracle Access Manager, and various Oracle data management tools.

Q: What function does the API Gateway serve?

A: The API Gateway provides a channel for external stakeholders to interact with ADHA and supports 125 APIs of differing complexity, enabling integrated healthcare services.

Q: How is the API Gateway structured?

A: The API Gateway operates on Microsoft Azure and leverages the Red Hat OpenShift platform, having been redeveloped by Deloitte.

Q: What are the main objectives of ADHA’s digital infrastructure upgrade?

A: The upgrade aims to modernise Australia’s digital health framework, improve system functionalities, and sustain Australia’s leadership in digital health innovation.

JBL Wave Beam Review

Matthew Miller on July 30, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

JBL Wave Beam, JBL Deep Bass Sound, Comfortable fit, Up to 32 (8h + 24h) total hours of battery life with speed charging, Stay aware of your surrounding, Hands-free calls with VoiceAware, Black

Google’s Gemini CLI Agent Represents a Concealed Malware Risk

Matthew Miller on July 29, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

  • The Gemini CLI agent from Google is prone to executing covert harmful commands.
  • The flaw was uncovered by security researcher Sam Cox.
  • This vulnerability entails inadequate validation, prompt injection, and confusing user experience.
  • Google has updated the status of the vulnerability to Priority 1, Severity 1.
  • Users are encouraged to upgrade to Gemini 0.1.14 for improved protections.
  • Activating sandboxing can thwart the attack, although it is not set as default.

Grasping the Gemini CLI Weakness

The Google Gemini CLI agent, built to connect with Google’s sophisticated AI language model using textual commands, has been identified to possess a critical vulnerability. Detected by Tracebit security researcher Sam Cox, this flaw permits the execution of harmful commands without the user’s knowledge.

The Detection Method

Cox found the vulnerability via a combination of inadequate validation, prompt injection, and misleading user interface. By inserting a prompt within a README.md file—along with a seemingly harmless Python script—Cox illustrated how credentials could be siphoned off using “env” and “curl” commands to a distant server.

Google’s Action Against the Risk

Initially rated as Priority 2, Severity 4, the vulnerability was reclassified by Google to Priority 1, Severity 1 following further investigation. This reassessment emphasizes the risk of major data breaches and unauthorized access.

Recommended User Measures

Users are strongly encouraged to update to Gemini 0.1.14, which offers new protections against shell code execution. Moreover, enabling sandboxing can provide additional defense to systems, though it is not automatically turned on during installation.

Mitigation Techniques

To reduce the threat posed by this vulnerability, users should promptly update their software and activate sandboxing. Sandboxing establishes an isolated environment that can prevent unauthorized code from impacting the host system.

Significance of Timely Updates

Continuous updates and prompt patching are essential for ensuring the safety of software utilities like the Gemini CLI. Users must remain alert and responsive to any security alerts from developers.

Risk posed by the Gemini CLI agent from Google

Conclusion

The Google Gemini CLI agent exhibits a serious security vulnerability that may enable silent operations of malicious commands. Uncovered by Sam Cox, this problem underscores the need for proper validation and thoughtful user interface design in terms of security. Users are advised to upgrade to the latest version and activate sandboxing for system protection.

Questions and Answers

Q: What is the Google Gemini CLI agent?

A: It serves as a text-oriented command interface meant to connect with Google’s AI large language model.

Q: How was the vulnerability identified?

A: The flaw was uncovered by security researcher Sam Cox through a series of improper validations, prompt injections, and a misleading user experience.

Q: What steps should users follow?

A: Users should upgrade to Gemini 0.1.14 and activate sandboxing to protect against possible threats.

Q: Why is sandboxing significant?

A: Sandboxing creates a separate environment that can stop harmful code from impacting the primary system.

Q: How did Google react to the vulnerability?

A: Google updated the classification of the vulnerability to Priority 1, Severity 1 and encouraged users to refresh their software.

Q: Is the vulnerability resolved in the latest edition?

A: The latest edition, Gemini 0.1.14, comprises protections against shell code execution.

Bluetooth Headphones Wireless in-Ear – Bluetooth 5.3 Hi-Fi Stereo Deep Bass Wireless Headphones Noise Cancelling CVC Wireless Earbuds 35 Hours Playtime 13 mm Driver Earphones Waterproof USB C Review

Matthew Miller on July 29, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Bluetooth Headphones Wireless in-Ear – Bluetooth 5.3 Hi-Fi Stereo Deep Bass Wireless Headphones Noise Cancelling CVC Wireless Earbuds 35 Hours Playtime 13 mm Driver Earphones Waterproof USB C