The Linkielist

Linking ideas with the world

The Linkielist

China’s Mass Surveillance App Hacked; Code Reveals Specific Criteria For Illegal Oppression of specific minorities

Human Rights Watch got their hands on an app used by Chinese authorities in the western Xinjiang region to surveil, track and categorize the entire local population – particularly the 13 million or so Turkic Muslims subject to heightened scrutiny, of which around one million are thought to live in cultural ‘reeducation’ camps.

By “reverse engineering” the code in the “Integrated Joint Operations Platform” (IJOP) app, HRW was able to identify the exact criteria authorities rely on to ‘maintain social order.’ Of note, IJOP is “central to a larger ecosystem of social monitoring and control in the region,” and similar to systems being deployed throughout the entire country.

The platform targets 36 types of people for data collection, from those who have “collected money or materials for mosques with enthusiasm,” to people who stop using smartphones.

[A]uthorities are collecting massive amounts of personal information—from the color of a person’s car to their height down to the precise centimeter—and feeding it into the IJOP central system, linking that data to the person’s national identification card number. Our analysis also shows that Xinjiang authorities consider many forms of lawful, everyday, non-violent behavior—such as “not socializing with neighbors, often avoiding using the front door”—as suspicious. The app also labels the use of 51 network tools as suspicious, including many Virtual Private Networks (VPNs) and encrypted communication tools, such as WhatsApp and Viber. –Human Rights Watch

Another method of tracking is the “Four Associations”

The IJOP app suggests Xinjiang authorities track people’s personal relationships and consider broad categories of relationship problematic. One category of problematic relationships is called “Four Associations” (四关联), which the source code suggests refers to people who are “linked to the clues of cases” (关联案件线索), people “linked to those on the run” (关联在逃人员), people “linked to those abroad” (关联境外人员), and people “linked to those who are being especially watched” (关联关注人员). –HRW

*An extremely detailed look at the data collected and how the app works can be found in the actual report.

[…]

When IJOP detects a deviation from normal parameters, such as when a person uses a phone not registered to them, or when they use more electricity than what would be considered “normal,” or when they travel to an unauthorized area without police permission, the system flags them as “micro-clues” which authorities use to gauge the level of suspicion a citizen should fall under.

IJOP also monitors personal relationships – some of which are deemed inherently suspicious, such as relatives who have obtained new phone numbers or who maintain foreign links.

Chinese authorities justify the surveillance as a means to fight terrorism. To that end, IJOP checks for terrorist content and “violent audio-viusual content” when surveilling phones and software. It also flags “adherents of Wahhabism,” the ultra-conservative form of Islam accused of being a “source of global terrorism.

[…]

Meanwhile, under the broader “Strike Hard Campaign, authorities in Xinjiang are also collecting “biometrics, including DNA samples, fingerprints, iris scans, and blood types of all residents in the region ages 12 to 65,” according to the report, which adds that “the authorities require residents to give voice samples when they apply for passports.

The Strike Hard Campaign has shown complete disregard for the rights of Turkic Muslims to be presumed innocent until proven guilty. In Xinjiang, authorities have created a system that considers individuals suspicious based on broad and dubious criteria, and then generates lists of people to be evaluated by officials for detention. Official documents state that individuals “who ought to be taken, should be taken,” suggesting the goal is to maximize the number of people they find “untrustworthy” in detention. Such people are then subjected to police interrogation without basic procedural protections. They have no right to legal counsel, and some are subjected to torture and mistreatment, for which they have no effective redress, as we have documented in our September 2018 report. The result is Chinese authorities, bolstered by technology, arbitrarily and indefinitely detaining Turkic Muslims in Xinjiang en masse for actions and behavior that are not crimes under Chinese law.

Read the entire report from Human Rights Watch here.

Source: China’s Mass Surveillance App Hacked; Code Reveals Specific Criteria For Illegal Oppression | Zero Hedge

7 Trends You Must Know For a Successful Digital Marketing Campaign – loads of statistics infographic

These marketing statistics have been divided across seven key trends, both in the infographic below and in the list that follows it, helping you zero in on your primary marketing channel of interest. On the other hand, like most modern marketers, if your campaign strategy involves multiple channels, this division should help you update your notes more clearly.

Source: 7 Trends You Must Know For a Successful Digital Marketing Campaign – Serpwatch.io

Google gives Chrome 3rd party cookie control – which allows it to track you better, but rivals to not be able to do so

Google I/O Google, the largest handler of web cookies, plans to change the way its Chrome browser deals with the tokens, ostensibly to promote greater privacy, following similar steps taken by rival browser makers Apple, Brave, and Mozilla.

At Google I/O 2019 on Tuesday, Google’s web platform director Ben Galbraith announced the plan, which has begun to appear as a hidden opt-in feature in Chrome Canary – a version of Chrome for developer testing – and is expected to evolve over the coming months.

When a website creates a cookie on a visitor’s device for its own domain, it’s called a first-party cookie. Websites may also send responses to visitor page requests that refer to resources on a third-party domain, like a one-pixel tracking image hosted by an advertising site. By attempting to load that invisible image, the visitor enables the ad site to set a third-party cookie, if the user’s browser allows it.

Third-party cookies can have legitimate uses. They can help maintain states across sessions. For example, they can provide a way to view an embedded YouTube video (the third party in someone else’s website) without forcing a site visitor already logged into YouTube to navigate to YouTube, login and return.

But they can also be abused, which is why browser makers have implemented countermeasures. Apple uses WebKit’s Intelligent Tracking Protection for example to limit third-party cookies. Brave and Firefox block third party requests and cookies by default.

[…]

Augustine Fou, a cybersecurity and ad fraud researcher who advises companies about online marketing, told The Register that while Google’s cookie changes will benefit consumer privacy, they’ll be devastating for the rest of the ad tech business.

“It’s really great for Google’s own bottom line because all their users are logged in to various Google services anyway, and Google has consent/permission to advertise and personalize ads with the data,” he said.

In a phone interview with The Register, Johnny Ryan, chief policy and industry relations officer at browser maker Brave, expressed disbelief that Google makes it sound as if it’s opposed to tracking.

“Google isn’t just the biggest tracker, it’s the biggest workaround actor of tracking prevention yet,” he said, pointing to the company’s efforts to bypass tracking protection in Apple’s Safari browser.

In 2012, Google agreed to pay $22.5m to settle Federal Trade Commission charges that it “placed advertising tracking cookies on consumers’ computers, in many cases by circumventing the Safari browser’s default cookie-blocking setting.”

Ryan explained that last year Google implemented a forced login system that automatically allows Chrome into the user’s Google account whenever the user signs into a single Google application like Gmail.

“When the browser knows everything you’re doing, you don’t need to track anything else,” he said. “If you’re signed into Chrome, everything goes to Google.”

But other ad companies will know less, which will make them less competitive. “In real-time ad bidding, where Google’s DoubleClick is already by far the biggest player, Google will have a huge advantage because the Google cookie, the only cookie across websites, will have so much more valuable bid responses from advertisers.”

Source: Google puts Chrome on a cookie diet (which just so happens to starve its rivals, cough, cough…) • The Register

Radical Desalination Approach May Disrupt the Water Industry

Columbia Engineering researchers design new desalination method for hypersaline brines that is low-cost, efficient, and effective; could address the growing water challenges across the globe

About the Study

The study is titled “Membrane-less and Non-evaporative Desalination of Hypersaline Brines by Temperature Swing Solvent Extraction.”

A New Paradigm for Desalination

New York, NY—May 6, 2019—Hypersaline brines—water that contains high concentrations of dissolved salts and whose saline levels are higher than ocean water—are a growing environmental concern around the world. Very challenging and costly to treat, they result from water produced during oil and gas production, inland desalination concentrate, landfill leachate (a major problem for municipal solid waste landfills), flue gas desulfurization in fossil-fuel power plants, and effluent from industrial processes.

If hypersaline brines are improperly managed, they can pollute both surface and groundwater resources. But if there were a simple, inexpensive way to desalinate the brines, vast quantities of water would be available for all kinds of uses, from agriculture to industrial applications, and possibly even for human consumption.

A Columbia Engineering team led by Ngai Yin Yip, assistant professor of earth and environmental engineering, reports today that they have developed a radically different desalination approach—“temperature swing solvent extraction (TSSE)”—for hypersaline brines. The study, published online in Environmental Science & Technology Letters, demonstrates that TSSE can desalinate very high-salinity brines, up to seven times the concentration of seawater. This is a good deal more than reverse osmosis, the gold-standard for seawater desalination, and can handle approximately twice the seawater salt concentrations.

 

Currently, hypersaline brines are desalinated either by membrane (reverse osmosis) or water evaporation (distillation). Each approach has limitations. Reverse osmosis methods are ineffective for high-saline brines because the pressures applied in reverse osmosis scale with the amount of salt: hypersaline brines require prohibitively high pressurizations. Distillation techniques, which evaporate the brine, are very energy-intensive.

Yip has been working on solvent extraction, a separation method widely employed for chemical engineering processes. The relatively inexpensive, simple, and effective separation technique is used in a wide range of industries, including production of fine organic compounds, purification of natural products, and extraction of valuable metal complexes.

Source: Radical Desalination Approach May Disrupt the Water Industry | Columbia Engineering

Experimental device generates electricity from the coldness of the universe, good for night time

The obvious drawback of solar panels is that they require sunlight to generate electricity. Some have observed that for a device on Earth facing space, which has a frigid temperature, the chilling outflow of energy from the device can be harvested using the same kind of optoelectronic physics we have used to harness solar energy. New work, in a recent issue of Applied Physics Letters, looks to provide a potential path to generating electricity like solar cells but that can power electronics at night.

An international team of scientists has demonstrated for the first time that it is possible to generate a measurable amount of electricity in a diode directly from the coldness of the universe. The infrared semiconductor device faces the sky and uses the difference between Earth and space to produce the electricity.

[…]

By pointing their device toward space, whose temperature approaches mere degrees from absolute zero, the group was able to find a great enough to generate power through an early design.

“The amount of power that we can generate with this experiment, at the moment, is far below what the theoretical limit is,” said Masashi Ono, another author on the paper.

[…]

Calculations made after the diode created showed that, when atmospheric effects are taken into consideration, the current device can theoretically generate almost 4 watts per square meter, roughly one million times what the group’s device generated and enough to help power machinery that is required to run at night.

By comparison, today’s solar panels generate 100 to 200 watts per square meter.

While the results show promise for ground-based devices directed to the sky, Fan said the same principle could be used to recover waste heat from machines. For now, he and his group are focusing on improving their ‘s performance.

Source: Experimental device generates electricity from the coldness of the universe

One of the World’s Largest Crypto Exchanges, Binance, Hacked to the Tune of $40 Million

Cryptocurrency trading hub Binance, one of the world’s largest, has confirmed it lost about 7,000 Bitcoins (around $40 million) to hackers after its so-called “hot wallet,” i.e. one connected to the internet and used to process transactions, was breached, Bloomberg reported on Tuesday.

The hot wallet in question contained about two percent of Binance’s holdings and was robbed in a single transaction, Bloomberg wrote. Binance wrote in a statement that they were aware the hackers involved “used a variety of techniques, including phishing, viruses and other attacks,” though the company was “still concluding all possible methods used” and there may be “additional affected accounts that have not been identified yet.”

[…]

Binance said that it would cover any losses in full using its Secure Asset Fund for Users, an insurance reserve set up for this type of situation, Bloomberg wrote. The news network added that Binance said automated systems triggered an alarm during the incident, though it was unable to prevent the attack’s success, and it estimates a security review and temporary halt to all deposits and withdrawals will take a week to complete:

Source: One of the World’s Largest Crypto Exchanges, Binance, Hacked to the Tune of $40 Million

Amazon Has Gone From Neutral Platform to Cutthroat Competitor, Say Open Source Developers

March 11, a Vice President at Amazon Web Services, Amazon’s cloud computing behemoth, published a blog post announcing the release of its own version of Elasticsearch, a powerful open-source software search engine tool.

Elastic is a public company founded in 2012 that is currently worth over $5 billion; the vast majority of its revenue is generated by selling subscription access to Elastic’s search capabilities via the cloud. It’s based in Amsterdam and employs more than 1,200 people.

In the blog post, Adrian Cockcroft, VP of cloud architecture strategy at Amazon Web Services (AWS), explained that the company felt forced to take action because Elastic was “changing the rules” on how its software code could be shared. Those changes, made in the run-up to Elastic’s 2018 IPO, started mixing intellectual property into Elastic’s overall line of software products.

Open-source software is defined as code that can be freely shared and modified by anyone. But now Elastic was telling customers that certain elements in its product mix could not be accessed without payment and that the code could not be freely shared.

Elastic did not explain its strategic shift at the time. But industry observers interpreted the changes as a response to increasing competition from AWS, which had incorporated Elasticsearch’s code and search functionality into its own suite of computing services.

Elastic isn’t the only open source cloud tool company currently looking over its shoulder at AWS. In 2018 alone, at least eight firms have made similar “rule changes” designed to ward off what they see as unfair competition from a company intent on cannibalizing their services.

[…]

Open source software has been one of the biggest success stories of the software industry. In 2018 alone, Microsoft’s purchase of the open source software development platform GitHub for $7.5 billion, Salesforce’s purchase of the open source company Mulesoft for $6.5 billion, and IBM’s blockbuster $34 billion purchase of the Linux vendor Red Hat proved that open source is a crucial part of the larger software industry. And there is growing acceptance that the collaborative model of developing open source software is a winning strategy to meet the tech industry’s need for constant innovation. So, when the likes of Amazon start accusing companies of not playing fair, people notice.

Sharone Zitzman, a respected commentator on open source software and the head of developer relations at AppsFlyer, an app development company, called Amazon’s move a “hostile takeover” of Elastic’s business. Steven O’Grady, co-founder of the software industry analyst firm RedMonk, cited it as an example of the “existential threat” that open source companies like Elastic believe a handful of cloud computing giants could pose. Shay Banon, founder and CEO of Elastic, carefully defended Elastic’s new licensing practices, while at the same time making his unhappiness with Amazon crystal clear.

[…]

The reaction to Amazon’s move wasn’t all negative. Some veterans of the open source community praised Amazon’s defense of open source values, while pointing out the fundamentally messy contradictions of Elastic mixing commercial priorities with open source principles. And fundamentally, adopting open source code is entirely legal.

But the notion that Amazon was presenting itself as an altruistic defender of the digital public commons rankled community veterans like Zitzman, who says that Amazon has a poor reputation for working with the community. (GitHub data shows that Amazon has far fewer employees than Microsoft, Google, or IBM contributing code to open source projects.)

These critics see Amazon’s decision to recreate Elasticsearch as opportunistic . behavior. Amazon, they say, is leveraging its dominant power in cloud computing in order to unfairly reap intellectual property. In doing so, AWS is striking at the Achilles’ heel of open source: lifting the work of others, and renting access to it.

Source: Amazon Has Gone From Neutral Platform to Cutthroat Competitor, Say Open Source Developers

Hacker Finds He Can Remotely Kill Car Engines, take location and personal data After Breaking Into Fleet GPS Tracking Apps, because default account password is 123456

The hacker, who goes by the name L&M, told Motherboard he hacked into more than 7,000 iTrack accounts and more than 20,000 ProTrack accounts, two apps that companies use to monitor and manage fleets of vehicles through GPS tracking devices. The hacker was able to track vehicles in a handful of countries around the world, including South Africa, Morocco, India, and the Philippines. On some cars, the software has the capability of remotely turning off the engines of vehicles that are stopped or are traveling 12 miles per hour or slower, according to the manufacturer of certain GPS tracking devices.

By reverse engineering ProTrack and iTrack’s Android apps, L&M said he realized that all customers are given a default password of 123456 when they sign up.

At that point, the hacker said he brute-forced “millions of usernames” via the apps’ API. Then, he said he wrote a script to attempt to login using those usernames and the default password.

This allowed him to automatically break into thousands of accounts that were using the default password and extract data from them.

According to a sample of user data L&M shared with Motherboard, the hacker has scraped a treasure trove of information from ProTrack and iTrack customers, including: name and model of the GPS tracking devices they use, the devices’ unique ID numbers (technically known as an IMEI number); usernames, real names, phone numbers, email addresses, and physical addresses. (According to L&M, he was not able to get all of this information for all users; for some users he was only able to get some of the above information.)

[…]

Though the hacker didn’t prove that he was able to turn off a car’s engine, a representative for Concox, the makers of one of the hardware GPS tracking devices used by some of the users of ProTrack GPS and iTrack, confirmed to Motherboard that customers can turn off the engines remotely if the vehicles are going under 20 kilometers per hour (around 12 miles per hour.)

[…]

Rahim Luqmaan, the owner of Probotik Systems, a South African company that uses ProTrack, said in a phone call with Motherboard that it’s possible to use ProTrack to stop engines if a technician enables that function when installing the tracking devices.

[…]

ProTrack is made by iTryBrand Technology, a company based in Shenzhen, China. iTrack is made by SEEWORLD, a company based in Guangzhou, China. Both iTryBrand and SEEWORLD sell hardware tracking devices and the cloud platforms to manage them directly to users, and to companies that then distribute the hardware and services to users. L&M claimed to have broken into the accounts of some distributors too, which allows him to monitor the vehicles and control the accounts of their customers.

[…]

On its Google Play app page, iTrack advertises a free demo account with the username “Demo,” and the password “123456.” ProTrack provides potential customers with a free demo on its website. This week, when Motherboard tried the demo, the site displayed a prompt to change password because “the default password is too simple.” Last week, when Motherboard first tried the demo, this message did not appear. ProTrack’s API, moreover, also mentions the default password of “123456” in its documentation.

[…]

L&M said that ProTrack has reached out to customers via the app and via email to ask them to change their password this week, but it’s not forcing password resets yet.

ProTrack denied the data breach via email, but confirmed that its prompting users to change passwords.

“Our system is working very well and change password is normal way for account security like other systems, any problem?” a company representative said. “What’s more, why you contact our customers for this thing which make them to receive this kind of boring mail. Why hacker contact you?”

Source: Hacker Finds He Can Remotely Kill Car Engines After Breaking Into GPS Tracking Apps – VICE

EU Votes to Amass a Giant Centralised Database of Biometric Data with 350m people in it

The European Parliament has voted by a significant margin to streamline its systems for managing everything from travel to border security by amassing an enormous information database that will include biometric data and facial images—an issue that has raised significant alarm among privacy advocates.

This system, called the Common Identity Repository (CIR), streamlines a number of functions, including the ability for officials to search a single database rather than multiple ones, with shared biometric data like fingerprints and images of faces, as well as a repository with personally identifying information like date of birth, passport numbers, and more. According to ZDNet, CIR comprises one of the largest tracking databases on the planet.

The CIR will also amass the records of more than 350 million people into a single database containing the identifying information on both citizens and non-citizens of the EU, ZDNet reports. According to Politico Europe, the new system “will grant officials access to a person’s verified identity with a single fingerprint scan.”

This system has received significant criticism from those who argue there are serious privacy rights at stake, with civil liberties advocacy group Statewatch asserting last year that it would lead to the “creation of a Big Brother centralised EU state database.”

The European Parliament has said the system “will make EU information systems used in security, border and migration management interoperable enabling data exchange between the systems.” The idea is that it will also make obtaining information a faster and more effective process, which is either great or nightmarish depending on your trust in government data collection and storage.

[…]

The CIR was approved through two separate votes: one for merging systems used for things related to visas and borders was approved 511 to 123 (with nine abstentions), and the other for streamlining systems users for law enforcement, judicial, migration, and asylum matters, which was approved 510 to 130 (also with nine abstentions). If this sounds like the handiwork of some serious lobbying, you might be correct, as one European Parliament official told Politico Europe.

A European Commission official told the outlet that they didn’t “think anyone understands what they’re voting for.” So that’s reassuring.

Source: EU Votes to Amass a Giant Database of Biometric Data

Because centralised databases are never leaked or hacked. Wait…

Is Alexa Listening? Amazon Employees Can Access Home Addresses, telephone numbers, contacts

An Amazon.com Inc. team auditing Alexa users’ commands has access to location data and can, in some cases, easily find a customer’s home address, according to five employees familiar with the program.

The team, spread across three continents, transcribes, annotates and analyzes a portion of the voice recordings picked up by Alexa. The program, whose existence Bloomberg revealed earlier this month, was set up to help Amazon’s digital voice assistant get better at understanding and responding to commands.

Team members with access to Alexa users’ geographic coordinates can easily type them into third-party mapping software and find home residences, according to the employees, who signed nondisclosure agreements barring them from speaking publicly about the program.

While there’s no indication Amazon employees with access to the data have attempted to track down individual users, two members of the Alexa team expressed concern to Bloomberg that Amazon was granting unnecessarily broad access to customer data that would make it easy to identify a device’s owner.

[…]

Some of the workers charged with analyzing recordings of Alexa customers use an Amazon tool that displays audio clips alongside data about the device that captured the recording. Much of the information stored by the software, including a device ID and customer identification number, can’t be easily linked back to a user.

However, Amazon also collects location data so Alexa can more accurately answer requests, for example suggesting a local restaurant or giving the weather in nearby Ashland, Oregon, instead of distant Ashland, Michigan.

[…]

It’s unclear how many people have access to that system. Two Amazon employees said they believed the vast majority of workers in the Alexa Data Services group were, until recently, able to use the software.

[…]

A second internal Amazon software tool, available to a smaller pool of workers who tag transcripts of voice recordings to help Alexa categorize requests, stores more personal data, according to one of the employees.

After punching in a customer ID number, those workers, called annotators and verifiers, can see the home and work addresses and phone numbers customers entered into the Alexa app when they set up the device, the employee said. If a user has chosen to share their contacts with Alexa, their names, numbers and email addresses also appear in the dashboard.

[…]

Amazon appears to have been restricting the level of access employees have to the system.

One employee said that, as recently as a year ago, an Amazon dashboard detailing a user’s contacts displayed full phone numbers. Now, in that same panel, some digits are obscured.

Amazon further limited access to data after Bloomberg’s April 10 report, two of the employees said. Some data associates, who transcribe, annotate and verify audio recordings, arrived for work to find that they no longer had access to software tools they had previously used in their jobs, these people said. As of press time, their access had not been restored.

Source: Is Alexa Listening? Amazon Employees Can Access Home Addresses – Bloomberg

brain implant turns thoughts to speech

Scientists have developed a brain implant that can read people’s minds and turn their thoughts to speech.

[…]

They add that their findings, published in the journal Nature, could help people when disease robs them of their ability to talk.

[…]

The mind-reading technology works in two stages.

First an electrode is implanted in the brain to pick up the electrical signals that manoeuvre the lips, tongue, voice box and jaw.

Then powerful computing is used to simulate how the movements in the mouth and throat would form different sounds.

This results in synthesised speech coming out of a “virtual vocal tract”.

Why do it like that?

You might think it would be easier to scour the brain for the pattern of electrical signals that code for each word.

However, attempts to do so have only had limited success.

Instead it was focusing on the shape of the mouth and the sounds it would produce that allowed the scientists to achieve a world first.

[…]

It is not perfect.

If you listen to this recording of synthesised speech:

Media captionListen to speech decoded from brain activity

You can tell it is not crystal clear (the recording says “the proof you are seeking is not available in books”).

The system is better with prolonged sounds like the “sh” in ship than with abrupt sounds such as the “buh” sound in “books”.

In experiments with five people, who read hundreds of sentences, listeners were able to discern what was being spoken up to 70% of the time when they were given a list of words to choose from.

[…]

The participants in the study were told not to make any specific mouth movements.

Prof Chang said: “There were just asked to do the very simple thing of reading some sentences.

“So it’s a very natural act that the brain translates into movements itself.”

Source: ‘Exhilarating’ implant turns thoughts to speech – BBC News

Amazon behaving as a monopoly is really affecting open source development and their income models, leading to changes in open sourcing (finally, but in the wrong way). An example from Elasticsearch which Amazon calls a kettle.

March 11, a Vice President at Amazon Web Services, Amazon’s cloud computing behemoth, published a blog post announcing the release of its own version of Elasticsearch, a powerful open-source software search engine tool.

Elastic is a public company founded in 2012 that is currently worth over $5 billion; the vast majority of its revenue is generated by selling subscription access to Elastic’s search capabilities via the cloud. It’s based in Amsterdam and employs more than 1,200 people.

In the blog post, Adrian Cockcroft, VP of cloud architecture strategy at Amazon Web Services (AWS), explained that the company felt forced to take action because Elastic was “changing the rules” on how its software code could be shared. Those changes, made in the run-up to Elastic’s 2018 IPO, started mixing intellectual property into Elastic’s overall line of software products.

[…]

Elastic did not explain its strategic shift at the time. But industry observers interpreted the changes as a response to increasing competition from AWS, which had incorporated Elasticsearch’s code and search functionality into its own suite of computing services.

Elastic isn’t the only open source cloud tool company currently looking over its shoulder at AWS. In 2018 alone, at least eight firms have made similar “rule changes” designed to ward off what they see as unfair competition from a company intent on cannibalizing their services.

[…]

Open source software has been one of the biggest success stories of the software industry. In 2018 alone, Microsoft’s purchase of the open source software development platform GitHub for $7.5 billion, Salesforce’s purchase of the open source company Mulesoft for $6.5 billion, and IBM’s blockbuster $34 billion purchase of the Linux vendor Red Hat proved that open source is a crucial part of the larger software industry. And there is growing acceptance that the collaborative model of developing open source software is a winning strategy to meet the tech industry’s need for constant innovation. So, when the likes of Amazon start accusing companies of not playing fair, people notice.

Sharone Zitzman, a respected commentator on open source software and the head of developer relations at AppsFlyer, an app development company, called Amazon’s move a “hostile takeover” of Elastic’s business. Steven O’Grady, co-founder of the software industry analyst firm RedMonk, cited it as an example of the “existential threat” that open source companies like Elastic believe a handful of cloud computing giants could pose

[…]

The reaction to Amazon’s move wasn’t all negative. Some veterans of the open source community praised Amazon’s defense of open source values, while pointing out the fundamentally messy contradictions of Elastic mixing commercial priorities with open source principles. And fundamentally, adopting open source code is entirely legal.

[…]

These critics see Amazon’s decision to recreate Elasticsearch as opportunistic . behavior. Amazon, they say, is leveraging its dominant power in cloud computing in order to unfairly reap intellectual property. In doing so, AWS is striking at the Achilles’ heel of open source: lifting the work of others, and renting access to it.

What happened to Elastic, Zitzman says, fits into a “long-standing trend of AWS rolling out managed services of popular open source technology, or replicating such technologies… This move is a text-book commoditization move — providing Elastic’s premium services for free.” Or as Salil Deshpande, a managing director at Bain Capital Ventures and an investor in multiple open source companies, puts it: “It is clear that AWS is using its market power to be anti-competitive.”

Source: Amazon Has Gone From Neutral Platform to Cutthroat Competitor, Say Open Source Developers

Some notes – most people who defend open source viciously as it is, formed by some idealists years ago actually have full employment at either universities or at closed source companies. It’s easy to be idealistic with a full belly.

This fits in well with a talk I gave in Zagreb in 2017: Open Source XOR Money about the problems facing the Open Source community, especially the financials.

In 2019 I gave another talk called “Break it up!” about the growing anti-competitive monopolistic powers of the big 5 tech companies.

It’s interesting to see how these subjects are suddenly flaring up in conjunction with each other.

Epic Games Boss Says They’ll Stop Doing Exclusives If Steam Gives Developers More Money because some people seem to be happy to live with a Steam monopoly

Last night, Epic Games boss Tim Sweeney tweeted that his company would end its controversial exclusivity agreements if Steam raised its revenue cut for developers. It’s a strong statement, even if there are reasons to be skeptical of Sweeney’s position.

“If Steam committed to a permanent 88% revenue share for all developers and publishers without major strings attached,” Sweeney wrote, “Epic would hastily organize a retreat from exclusives (while honoring our partner commitments) and consider putting our own games on Steam.”

Since the Epic Game Store launched in December, the company behind Fortnite and the Unreal Engine has struck several exclusivity deals with high-profile games like Borderlands 3 and The Division 2, preventing those games from appearing on Steam. The practice has been contentious, drawing a lot of ire from PC gamers, especially considering the Epic Game Store lacks many of the features that make Steam so enticing for players. For developers, however, being on the Epic Store is a boon, as it gives 88% of revenue earned from games to the people who make them. PC megalith Steam, on the other hand, gives developers between 70-80% depending on sales.

Source: Epic Games Boss Says They’ll Stop Doing Exclusives If Steam Gives Developers More Money

Yup, exclusivity deals are a great way to differentiate yourself from the competition. No one is forcing anyone to go with the Epic store, if they don’t like it. But there is a clear victor in monopoly breaking: the developers. And happier developers should lead to better products, so eventually the customer will win too. And with any luck, the Steam game player will be a different kind of player than the Epic game player, which means that the stores will have different popularity scores,  leading to more diversity and recognition of different products in the gaming ecosphere. Again, the customer wins.

BAE Systems uses MAGMA demonstrator to roll and pitch jet aircraft without using moving surfaces

In a series of ground-breaking flight trials that took place in the skies above north-west Wales, the MAGMA unmanned aerial vehicle (UAV) demonstrated two innovative flow control technologies which could revolutionise future aircraft design.
MAGMA, designed and developed by researchers at The University of Manchester in collaboration with engineers from BAE Systems, successfully trialled the two ‘flap-free’ technologies earlier this month at the Llanbedr Airfield.
The technologies have been designed to improve the control and performance of aircraft. By replacing moving surfaces with a simpler ‘blown air’ solution, the trials have paved the way for engineers to create better performing aircraft that are lighter, more reliable and cheaper to operate. The technologies could also improve an aircraft’s stealth as they reduce the number of gaps and edges that currently make aircraft more observable on radar.
Developing such technologies helps to ensure the UK has the right technologies and skills in place for the future and could be applied to the development of a Future Combat Air System. It is the latest technological breakthrough to come from a number of BAE Systems collaborations with academia and industry, that will help the UK to deliver more advanced capability, more quickly, and through shared investment.
[…]
The technologies demonstrated in the trials were:
  • Wing Circulation Control: Taking air from the aircraft engine and blowing it supersonically through narrow slots around a specially shaped wing tailing edge in order to control the aircraft.
  • Fluidic Thrust Vectoring: Controlling the aircraft by blowing air jets inside the nozzle to deflect the exhaust jet and generate a control force.
The trials form part of a long-term collaboration between BAE Systems, academia and the UK government to explore and develop flap-free flight technologies, and the data will be used to inform future research programmes. Other technologies to improve the aircraft performance are being explored in collaboration with NATO Science and Technology Organisation.

Source: MAGMA: the future of flight | Newsroom | BAE Systems | International

Tractors, not phones, will (maybe) get America a right-to-repair law at this rate: Bernie slams ‘truly insane’ situation

A person’s “right to repair” their own equipment may well become a US election issue, with presidential candidate Bernie Sanders making it a main talking point during his tour of Iowa.

“Are you ready for something truly insane?” the veteran politician’s account tweeted on Sunday, “Farmers aren’t allowed to repair their own tractors without paying an authorized John Deere repair agent.”

The tweet links to a clip of a recent Sanders rally during which he told the crowd to cheers: “Unbelievably, farmers are unable to even repair their own tractors, and tractors cost what – at least $150,000 – people are spending $150,000 for a piece of machinery. You know what I think? The person who buys that machinery has a right to fix the damn piece of machinery.”

The right-to-repair was also highlighted as one of Sanders’ key policies issues in his plan to “revitalize rural America,” and he promised: “When we are in the White House, we will pass a national right-to-repair law that gives every farmer in America full rights over the machinery they buy.”

Source: Tractors, not phones, will (maybe) get America a right-to-repair law at this rate: Bernie slams ‘truly insane’ situation • The Register

There is hope yet…

First private Japanese rocket reaches space

Japan can finally include itself among the ranks of countries with successful private spaceflight outfits. Interstellar Technologies has successfully launched its MOMO-3 sounding rocket into space, with the vehicle easily crossing the Kármán line (62 miles in altitude) before splashing into the Pacific. It’s a modest start — the rocket only stayed aloft for 8 minutes and 35 seconds — but it’s also a relief after Interstellar’s previous two attempts ended in failure.

There was a fair amount riding on the mission. Interstellar’s ultimate aim is to ferry small satellites into orbit at a fraction of the cost of government launches, and this takes the company one step closer to achieving its dream. It also relieves some of the pressure on Interstellar founder Takafumi Horie. There had been skepticism about the Livedoor creator’s spaceflight chops given his controversial entrepreneurial history (including a conviction for accounting fraud). This shows that his initiative can work on a basic level — the challenge is translating a test like this into a full-fledged business.

Source: First private Japanese rocket reaches space

‘They’re Basically Lying’ – (Mental) Health Apps Caught Secretly Sharing Data

“Free apps marketed to people with depression or who want to quit smoking are hemorrhaging user data to third parties like Facebook and Google — but often don’t admit it in their privacy policies, a new study reports…” writes The Verge.

“You don’t have to be a user of Facebook’s or Google’s services for them to have enough breadcrumbs to ID you,” warns Slashdot schwit1. From the article: By intercepting the data transmissions, they discovered that 92 percent of the 36 apps shared the data with at least one third party — mostly Facebook- and Google-run services that help with marketing, advertising, or data analytics. (Facebook and Google did not immediately respond to requests for comment.) But about half of those apps didn’t disclose that third-party data sharing, for a few different reasons: nine apps didn’t have a privacy policy at all; five apps did but didn’t say the data would be shared this way; and three apps actively said that this kind of data sharing wouldn’t happen. Those last three are the ones that stood out to Steven Chan, a physician at Veterans Affairs Palo Alto Health Care System, who has collaborated with Torous in the past but wasn’t involved in the new study. “They’re basically lying,” he says of the apps.

Part of the problem is the business model for free apps, the study authors write: since insurance might not pay for an app that helps users quit smoking, for example, the only ways for free app developer to stay afloat is to either sell subscriptions or sell data. And if that app is branded as a wellness tool, the developers can skirt laws intended to keep medical information private.
A few apps even shared what The Verge calls “very sensitive information” like self reports about substance use and user names.

Source: ‘They’re Basically Lying’ – Mental Health Apps Caught Secretly Sharing Data – Slashdot

Aweigh – open source navigation system without satellites

Aweigh is an open navigation system that does not rely on satellites: it is inspired by the mapping of celestial bodies and the polarized vision of insects. Ancient seafarers and desert ants alike use universally accessible skylight to organize, orient, and place themselves in the world. Aweigh is a project that learns from the past and from the microscopic to re-position individuals in the contemporary technological landscape.

Networked technolgies that we increasingly rely on undergo changes that are often beyond our control. Most smartphone users require government-run satellites to get around day by day, while consequences of Brexit are calling into question the UK’s access to the EU’s new satellite system, Project Galileo. Aweigh is a set of tools and blueprints that aims to open modern technologies to means of democratization, dissemination, and self-determination.

These tools were designed to depend only on publicly available materials and resources: digital fabrication machines, open-source code, packaged instructions, and universally accessible sky light. Aweigh is inspired by ancient navigation devices that use the process of taking angular measurements between the earth and various celestial bodies as reference points to find one’s position. Combining this process with the polarization of sunlight observed in insect eyes, the group developed a technology that calculates longitude and latitude in urban as well as off-grid areas.

Source: Aweigh

Unsecured MS cloud database removed after exposing details on 80 million US households

the addresses and demographic details of more than 80 million US households were exposed on an unsecured database stored on the cloud, independent security researchers have found.

The details included names, ages and genders as well as income levels and marital status. The researchers, led by Noam Rotem and Ran Locar, were unable to identify the owner of the database, which until Monday was online and required no password to access. Some of the information was coded, like gender, marital status and income level. Names, ages and addresses were not coded.

The data didn’t include payment information or Social Security numbers. The 80 million households affected make up well over half of the households in the US, according to Statista.

“I wouldn’t like my data to be exposed like this,” Rotem said in an interview with CNET. “It should not be there.”

Rotem and his team verified the accuracy of some data in the cache but didn’t download the data to minimize the invasion of privacy of those listed, he said.

[…]

Unlike a hack, you don’t need to break into a computer system to access an exposed database. You simply need to find the IP address, the numerical code assigned to any given web page.

[…]

Rotem found that the data was stored on a cloud service owned by Microsoft. Securing the data is up to the organization that created the database, and not Microsoft itself.

“We have notified the owner of the database and are taking appropriate steps to help the customer remove the data until it can be properly secured,” a Microsoft spokesperson told CNET in a statement Monday.

The server hosting the data came online in February, Rotem found, and he discovered it in April using tools he developed to search for and catalog unsecured databases.

Source: Cloud database removed after exposing details on 80 million US households – CNET

Color-Changing LEDs Pave the Way to Impossibly High Screen Resolutions

An international collaboration between several universities around the world has led to an innovation in LEDs that could potentially result in a giant leap forward when it comes to increasing the resolution on TV screens and mobile devices. For the first time ever, a single LED can now change color all by itself.

The current design and chemical makeup of LEDs limit the technology to producing light in just a single color. “But Andrew, what about my color-changing LED smart bulbs,” you’re probably asking. Those actually rely on a cluster of LEDs inside that each produce either red, green, or blue light. When their individual intensities are adjusted, the colors that each light produces mix to produce an overall shade of light. LED-backlit LCD TVs work in a similar fashion, but to produce one-colored pixel, three filtered LEDs are required. Even the next big breakthrough in flatscreen TV technology, MicroLEDs, require a trio of ultra-tiny light-producing diodes to create a single pixel, which limits how many can be squeezed into a given area, and resolution.

In a paper recently published to the ACS Photonics Journal, researchers from Lehigh University and West Chester University in Pennsylvania, Osaka University in Japan, and the University of Amsterdam, detail a new approach to making LEDs that uses a rare earth ion called Europium that when paired with Gallium Nitride (an alternative to silicon that’s now showing up in electronics other than LEDs, like Anker’s impossibly tiny PowerPort Atom PD 1 laptop charger) allows the LED’s color to be adjusted on the fly. The secret sauce is how power is used to excite the Europium and Gallium Nitride-different ratios and intensities of current can be selectively applied to produce the emission of three primary colors: red, blue, and green.

Using this approach, LED lightbulbs with specific color temperatures could be produced and sold at much cheaper price points since the colors from multiple tint-specific LEDs don’t have to be mixed. The technology could yield similar benefits for TVs and the screens that end up in mobile devices. Instead of three LEDs (red, green, and blue) needed to generate every pixel, a single Europium-based LED could do the job. Even more exciting than cheaper price tags is the fact that replacing three LEDs with just one could result in a display with three times the resolution. Your eyes probably wouldn’t be able to discern that many pixels on a smartphone screen, but in smaller displays, like those used in the viewfinders of digital cameras, a significant step in resolution would be a noticeable improvement.

Source: Color-Changing LEDs Pave the Way to Impossibly High Screen Resolutions

Personal information on sites about faith, illness, sexual orientation, addiction, schools in NL is directly passed on to advertisers without GDPR consent.

Websites met informatie over gevoelige onderwerpen lappen de privacywet massaal aan hun laars. Dat zegt de Consumentenbond. Veel sites plaatsen zonder toestemming cookies van advertentienetwerken, waardoor die zeer persoonlijke informatie over de bezoekers in handen krijgen.

Onderzoekers van de Consumentenbond zochten in maart en april op onderwerpen binnen de categorieën geloof, jeugd, medisch en geaardheid. Via zoekvragen over onder meer depressie, verslaving, seksuele geaardheid en kanker kwamen zij op 106 websites.

Bijna de helft van die sites plaatste bij bezoek direct, dus zonder toestemming van de bezoeker, een of meer advertentiecookies, bijna altijd van Google. Websites als CIP.nl, Refoweb.nl en scholieren.com plaatsten er zelfs tientallen. Ouders.nl maakte het helemaal bont en plaatste maar liefst 37 cookies.

Ook een flink aantal instellingen voor geestelijke gezondheidszorg viel op. Onder andere ggzdrenthe.nl, connection-sggz.nl, parnassiagroep.nl en lentis.nl volgden ongevraagd het surfgedrag van hun bezoekers en speelden deze informatie door naar Google.

De privacywet AVG is nu een jaar van kracht, maar het is volgens de bond zorgwekkend hoe slecht de wet wordt nageleefd.

Source: ‘Persoonlijke informatie niet veilig bij sites over geloof, ziekte en geaardheid’ – Emerce

Sinister secret backdoor found in networking gear perfect for government espionage: The Chinese are – oh no, wait, it’s Cisco again

Right on cue, Cisco on Wednesday patched a security vulnerability in some of its network switches that can be exploited by miscreants to commandeer the IT equipment and spy on people.

This comes immediately after panic this week over a hidden Telnet-based diagnostic interface was found in Huawei gateways. Although that vulnerability was real, irritating, and eventually removed at Vodafone’s insistence, it was dubbed by some a hidden backdoor perfect for Chinese spies to exploit to snoop on Western targets.

Which, of course, comes as America continues to pressure the UK and other nations to outlaw the use of Huawei gear from 5G networks over fears Beijing would use backdoors baked into the hardware to snatch Uncle Sam’s intelligence.

Well, if a non-internet-facing undocumented diagnostic Telnet daemon is reason enough to kick Huawei kit out of Western networks, surely this doozy from Cisco is enough to hoof American equipment out of British, European and other non-US infrastructure? Fair’s fair, no?

US tech giant Cisco has issued a free fix for software running on its Nexus 9000 series machines that can be exploited to log in as root and hijack the device for further mischief and eavesdropping. A miscreant just needs to be able to reach the vulnerable box via IPv6. It’s due to a default SSH key pair hardcoded into the software

Source: Sinister secret backdoor found in networking gear perfect for government espionage: The Chinese are – oh no, wait, it’s Cisco again • The Register

Apple killing right to repair bill

The bill has been pulled by its sponsor, Susan Talamantes-Eggman: “It became clear that the bill would not have the support it needed today, and manufacturers had sown enough doubt with vague and unbacked claims of privacy and security concerns,” she said. Her full statement has been added at the end of the piece.

In recent weeks, an Apple representative and a lobbyist for CompTIA, a trade organization that represents big tech companies, have been privately meeting with legislators in California to encourage them to kill legislation that would make it easier for consumers to repair their electronics, Motherboard has learned.

According to two sources in the California State Assembly, the lobbyists have met with members of the Privacy and Consumer Protection Committee, which is set to hold a hearing on the bill Tuesday afternoon. The lobbyists brought an iPhone to the meetings and showed lawmakers and their legislative aides the internal components of the phone. The lobbyists said that if improperly disassembled, consumers who are trying to fix their own iPhone could hurt themselves by puncturing the lithium-ion battery, the sources, who Motherboard is not naming because they were not authorized to speak to the media, said.

The argument is similar to one made publicly by Apple executive Lisa Jackson in 2017 at TechCrunch Disrupt, when she said the iPhone is “too complex” for normal people to repair them.

[…]

a few weeks after CompTIA and 18 other trade organizations associated with big tech companies—including CTIA and the Entertainment Software Association—sent letters in opposition of the legislation to members of the Assembly’s Privacy and Consumer Protection Committee. One copy of the letter, addressed to committee chairperson Ed Chau and obtained by Motherboard, urges the chairperson “against moving forward with this legislation.” CTIA represents wireless carriers including Verizon, AT&T, and T-Mobile, while the Entertainment Software Association represents Nintendo, Sony, Microsoft, and other video game manufacturers.

“With access to proprietary guides and tools, hackers can more easily circumvent security protections, harming not only the product owner but also everyone who shares their network,” the letter, obtained by Motherboard, stated. “When an electronic product breaks, consumers have a variety of repair options, including using an OEM’s [original equipment manufacturer] authorized repair network.”

Experts, however, say Apple’s and CompTIA’s warnings are far overblown. People with no special training regularly replace the batteries or cracked screens in their iPhones, and there are thousands of small, independent repair companies that regularly fix iPhones without incident. The issue is that many of these companies operate in a grey area because they are forced to purchase replacement parts from third parties in Shenzhen, China, because Apple doesn’t sell them to independent companies unless they become part of the “Apple Authorized Service Provider Program,” which limits the types of repairs they are allowed to do and requires companies to pay Apple a fee to join.

“To suggest that there are safety and security concerns with spare parts and manuals is just patently absurd,” Nathan Proctor, director of consumer rights group US PIRG’s right to repair campaign told Motherboard in a phone call. “We know that all across the country, millions of people are doing this for themselves. Millions more are taking devices to independent repair technicians.”

[…]

“The security of devices is not related to diagnostics and service manuals, they’re related to poor code with vulnerabilities, weak authentication, devices deployed by default to be vulnerable,” Roberts told Motherboard. “We all know there’s no debate. Security for connected devices has nothing to do with repair.”

Source: Apple Is Telling Lawmakers People Will Hurt Themselves if They Try to Fix iPhones – Motherboard

Wow, this is simply ridiculous. Profiteering by the large companies at the expense of smaller companies seems to be something the US government absolutely loves.

Dell laptops and computers vulnerable to remote hijacks via Dell admin tool

A vulnerability in the Dell SupportAssist utility exposes Dell laptops and personal computers to a remote attack that can allow hackers to execute code with admin privileges on devices using an older version of this tool and take over users’ systems.

Dell has released a patch for this security flaw on April 23; however, many users are likely to remain vulnerable unless they’ve already updated the tool –which is used for debugging, diagnostics, and Dell drivers auto-updates.

The number of impacted users is believed to be very high, as the SupportAssist tool is one of the apps that Dell will pre-install on all Dell laptops and computers the company ships with a running Windows OS (systems sold without an OS are not impacted).

CVE-2019-3719

According to Bill Demirkapi, a 17-year-old security researcher from the US, the Dell SupportAssist app is vulnerable to a “remote code execution” vulnerability that under certain circumstances can allow attackers an easy way to hijack Dell systems.

The attack relies on luring users on a malicious web page, where JavaScript code can trick the Dell SupportAssist tool into downloading and running files from an attacker-controlled location.

Because the Dell SupportAssist tool runs as admin, attackers will have full access to targeted systems, if they manage to get themselves in the proper position to execute this attack.

Attack requires LAN/router compromise

“The attacker needs to be on the victim’s network in order to perform an ARP Spoofing Attack and a DNS Spoofing Attack on the victim’s machine in order to achieve remote code execution,” Demirkapi told ZDNet today in an email conversation.

This might sound hard, but it isn’t as complicated as it appears.

Two scenarios in which the attack could work include public WiFi networks or large enterprise networks where there’s at least one compromised machine that can be used to launch the ARP and DNS attacks against adjacent Dell systems running the SupportAssist tool.

Source: Dell laptops and computers vulnerable to remote hijacks | ZDNet

Sapa Profiles / Hydro Extrusion falsified aluminium tensile strength for profit, causes $700m in losses in NASA launches, years of science crashing and burning

The space agency eggheads pointed the finger of blame at the aluminium manufacturer after probing two failed science missions: the February 24, 2009 fruitless launch of the Orbiting Carbon Observatory, and the March 4, 2011 doomed launch of the Glory satellite, designed for monitoring atmospheric pollutants.

In both cases, the rocket fairing, which is the nose cone protecting the satellite payload, failed to separate after liftoff. As a result, the Orbiting Carbon Observatory (OCO) plunged into the ocean off the Antarctic, and Glory swiftly crashed into the Pacific, after their rockets fell back to Earth, the satellites still attached.

The blunders were traced back to the fairing release mechanism, and specifically the aluminium (or aluminum in Freedom Language) used in this component. It was supplied by Sapa Profiles Inc, of Oregon, USA, now renamed Hydro Extrusion Portland, Inc. NASA’s boffins said the metals used were not up to specification, and called in the Feds.

Subsequent checks appeared to show that Sapa had been falsifying its materials testing reports for profit. The metal was supposed to have a particular tensile strength, however, company employees fudged the tests to increase profit margins, investigators said.

Source: NASA fingers the cause of two bungled satellite launches, $700m in losses, years of science crashing and burning… • The Register