Daily Archives: September 3, 2020

Academic Study Says Open Source Has Peaked: But Why?

Posted on by

Open source runs the world. That’s for supercomputers, where Linux powers all of the top 500 machines in the world, for smartphones, where Android has a global market share of around 75%, and for everything in between, as Wired points out:

When you stream the latest Netflix show, you fire up servers on Amazon Web Services, most of which run on Linux. When an F-16 fighter takes off, three Kubernetes clusters run to keep the jet’s software running. When you visit a website, any website, chances are it’s run on Node.js. These foundational technologies — Linux, Kubernetes, Node.js — and many others that silently permeate our lives have one thing in common: open source.

Ubiquity can engender complacency: because open source is indispensable for modern digital life, the assumption is that it will always be there, always supported, always developed. That makes new research looking at what the longer-term trends are in open source development welcome. It builds on work carried out by three earlier studies, in 2003, 2007 and 2007, but using a much larger data set:

This study replicates the measurements of project-specific quantities suggested by the three prior studies (lines of code, lifecycle state), but also reproduce the measurements by new measurands (contributors, commits) on an enlarged and updated data set of 180 million commits contributed to more than 224,000 open source projects in the last 25 years. In this way, we evaluate existing growth models and help to mature the knowledge of open source by addressing both internal and external validity.

The new work uses data from Open Hub, which enables the researchers to collect commit information across different source code hosts like GitHub, Gitlab, BitBucket, and SourceForge. Some impressive figures emerge. For example, at the end of 2018, open source projects contained 17,586,490,655 lines of code, made up of 14,588,351,457 lines of source code and 2,998,139,198 lines of comments. In the last 25 years, 224,342 open source projects received 180,937,525 commits in total. Not bad for what began as a ragtag bunch of coders sharing stuff for fun. But there are also some more troubling results. The researchers found that most open source projects are inactive, and that most inactive projects never receive a contribution again.

Looking at the longer-term trends, an initial, transient exponential growth was found until 2009 for commits and contributors, until 2011 for the number of available projects, and until 2013 for available lines of code. Thereafter, all those metrics reached a plateau, or declined. In one sense, that’s hardly a surprise. In the real world, exponential growth has to stop at some point. The real question is whether open source has peaked purely because it has reached its natural limits, or whether they are other problems that could have been avoided.

For example, a widespread concern in the open source community is that companies may have deployed free code in their products with great enthusiasm, but they have worried less about giving back and supporting all the people who write it. Such an approach may work in the short term, but ultimately destroys the software commons they depend on. That’s just as foolish as over-exploiting the environmental commons with no thought for long-term sustainability. As the Wired article mentioned above points out, it’s not just bad for companies and the digital ecosystem, it’s bad for the US too. In the context of the current trade war with China, “the core values of open source — transparency, openness, and collaboration — play to America’s strengths”. The new research might be an indication that the open source community, which has selflessly given so much for decades, is showing signs of altruism fatigue. Now would be a good time for companies to start giving back by supporting open source projects to a much greater degree than they have so far.

Source: Academic Study Says Open Source Has Peaked: But Why? | Techdirt

I spoke of this in 2017

Private Intel Firm Buys Location Data to Track People to their ‘Doorstep’ sourced from innocuous seeming apps

Posted on by

A threat intelligence firm called HYAS, a private company that tries to prevent or investigates hacks against its clients, is buying location data harvested from ordinary apps installed on peoples’ phones around the world, and using it to unmask hackers. The company is a business, not a law enforcement agency, and claims to be able to track people to their “doorstep.”

The news highlights the complex supply chain and sale of location data, traveling from apps whose users are in some cases unaware that the software is selling their location, through to data brokers, and finally to end clients who use the data itself. The news also shows that while some location firms repeatedly reassure the public that their data is focused on the high level, aggregated, pseudonymous tracking of groups of people, some companies do buy and use location data from a largely unregulated market explicitly for the purpose of identifying specific individuals.

HYAS’ location data comes from X-Mode, a company that started with an app named “Drunk Mode,” designed to prevent college students from making drunk phone calls and has since pivoted to selling user data from a wide swath of apps. Apps that mention X-Mode in their privacy policies include Perfect365, a beauty app, and other innocuous looking apps such as an MP3 file converter.

“As a TI [threat intelligence] tool it’s incredible, but ethically it stinks,” a source in the threat intelligence industry who received a demo of HYAS’ product told Motherboard. Motherboard granted the source anonymity as they weren’t authorized by their company to speak to the press.

[…]

HYAS differs in that it provides a concrete example of a company deliberately sourcing mobile phone location data with the intention of identifying and pinpointing particular people and providing that service to its own clients. Independently of Motherboard, the office of Senator Ron Wyden, which has been investigating the location data market, also discovered HYAS was using mobile location data. A Wyden aide said they had spoken with HYAS about the use of the data. HYAS said the mobile location data is used to unmask people who may be using a Virtual Private Network (VPN) to hide their identity, according to the Wyden aide.

In a webinar uploaded to HYAS’ website, Todd Thiemann, VP of marketing at the company, describes how HYAS used location data to track a suspected hacker.

“We found out it was the city of Abuja, and on a city block in an apartment building that you can see down there below,” he says during the webinar. “We found the command and control domain used for the compromised employees, and used this threat actor’s login into the registrar, along with our geolocation granular mobile data to confirm right down to his house. We also got his first and last name, and verified his cellphone with a Nigerian mobile operator.”

hyas-webinar.png

A screenshot of a webinar given by HYAS, in which the company explains how it has used mobile application location data.

On its website, HYAS claims to have some Fortune 25 companies, large tech firms, as well as law enforcement and intelligence agencies as clients.

[…]

Customers can include banks who want to get a heads-up on whether a freshly dumped cache of stolen credit card data belongs to them; a retailer trying to protect themselves from hackers; or a business checking if any of their employees’ login details are being traded by cybercriminals.

Some threat intelligence companies also sell services to government agencies, including the FBI, DHS, and Secret Service. The Department of Justice oftens acknowledges the work of particular threat intelligence companies in the department’s announcement of charges or indictments against hackers and other types of criminals.

But some other members of the threat intelligence industry criticized HYAS’ use of mobile app location data. The CEO of another threat intelligence firm told Motherboard that their company does not use the same sort of information that HYAS does.

The threat intelligence source who originally alerted Motherboard to HYAS recalled “being super shook at how they collected it,” referring to the location data.

A senior employee of a third threat intelligence firm said that location data is not hard to buy.

[…]

Motherboard found several location data companies that list HYAS in their privacy policies. One of those is X-Mode, a company that plants its own code into ordinary smartphone apps to then harvest location information. An X-Mode spokesperson told Motherboard in an email that the company’s data collecting code, or software development kit (SDK), is in over 400 apps and gathers information on 60 million global monthly users on average. X-Mode also develops some of its own apps which use location data, including parental monitoring app PlanC and fitness tracker Burn App.

“Whatever your need, the XDK Visualizer is here to show you that our signature SDK is too legit to quit (literally, it’s always on),” the description for another of X-Code’s own apps, which visualizes the company’s data collection to attract clients, reads.

“They’re like many location trackers but seem more aggressive to be honest,” Will Strafach, founder of the app Guardian, which alerts users to other apps accessing their location data, told Motherboard in an online chat. In January, X-Mode acquired the assets of Location Sciences, another location firm, expanding X-Mode’s dataset.

[…]

Motherboard then identified a number of apps whose own privacy policies mention X-Mode. They included Perfect365, a beauty-focused app that people can use to virtually try on different types of makeup with their device’s camera.

[…]

Various government agencies have bought access to location data from other companies. Last month, Motherboard found that U.S. Customs and Border Protection (CBP) paid $476,000 to a firm that sells phone location data. CBP has used the data to scan parts of the U.S. border, and the Internal Revenue Service (IRS) tried to use the same data to track criminal suspects but was unsuccessful.

Source: Private Intel Firm Buys Location Data to Track People to their ‘Doorstep’

Amazon Prime Air drone delivery fleet gets FAA approval

Posted on by

Amazon received federal approval to operate its fleet of Prime Air delivery drones, the Federal Aviation Administration said Monday, a milestone that allows the company to expand unmanned package delivery.

The approval will give Amazon broad privileges to “safely and efficiently deliver packages to customers,” the agency said. The certification comes under Part 135 of FAA regulations, which gives Amazon the ability to carry property on small drones “beyond the visual line of sight” of the operator.

Amazon said it will use the FAA’s certification to begin testing customer deliveries. The company said it went through rigorous training and submitted detailed evidence that its drone delivery operations are safe, including demonstrating the technology for FAA inspectors.

“This certification is an important step forward for Prime Air and indicates the FAA’s confidence in Amazon’s operating and safety procedures for an autonomous drone delivery service that will one day deliver packages to our customers around the world,” David Carbon, vice president of Prime Air, said in a statement. “We will continue to develop and refine our technology to fully integrate delivery drones into the airspace, and work closely with the FAA and other regulators around the world to realize our vision of 30 minute delivery.”

Amazon added that while the Prime Air fleet isn’t ready to immediately deploy package deliveries at scale, it’s actively flying and testing the technology.

[…]

Source: Amazon Prime Air drone delivery fleet gets FAA approval

How Face Shields and Valve Masks Fail to Stop Infectious Droplets, as Shown by Lasers

Posted on by

A new study using lasers suggests that face shields and masks outfitted with an exhaust valve aren’t particularly great at protecting others from tiny respiratory droplets containing contagious germs like the coronavirus that causes covid-19. These aerosols can spill through and around these types of face equipment, the study found, weakening their potential to keep users from spreading an infection to others

Mask wearing has been embraced by public health experts as one of the most impactful ways to reduce the chances of someone giving covid-19 to other people. To a lesser extent, masks seem to also lower the risk of wearers catching the coronavirus from others. And despite a noisy contingent of skeptics, particularly in the U.S., much of the public in countries around the world have adapted to wearing masks in situations where they’re around people outside their household.

But there are many different kinds of face coverings that have become popular. Two in particular are plastic face shields and N95-respirator masks that come with exhaust valves. N95 respirators filter inhaled air from the outside, significantly reducing the potential for catching a respiratory infection, while the valves are intended to make breathing out easier. Shields are less cumbersome on the user’s breathing but have large gaps on the bottom and sides that, presumably, would let germs enter and escape fairly easily. Medical professionals typically wear face shields in addition to masks and other protective equipment, as a way to prevent sneezed or coughed droplets from a patient from landing in their eyes and other parts of their face.

In this new study, published Tuesday in the journal Physics of Fluids, both face shields and valve masks were shown to be pretty bad at stopping the flow of aerosols.

Engineers at Florida Atlantic University created a sort of light show to visualize what happens to our exhalations while using these coverings. They lit up the area around a mannequin’s mouth with lasers, outfitted the dummy with either an exhaust-valve mask or face shield, then pumped a mixture of water and glycerin through its mouth, creating a synthetic fog with a similar consistency to the aerosol droplets emitted by a person while coughing and sneezing. In the dark, the lasers were able to eerily illuminate the path of these droplets as they left the mannequin’s mouth.

The results were plain to see. The face shield did blunt the initial forward burst from the mouth, but the aerosolized droplets were then easily dispersed to the sides and even behind the shield in still high concentrations. Though the concentration of droplets dissipated as they moved further from the mannequin’s mouth, they would likely still be able to cover a lot of ground before they evaporated under the right conditions, such as indoor places with little air flow. Exhaust-valve N95 masks were even less effective at blocking the forward movement of droplets, with the valve serving as an easy escape hatch.

The team also tested several brands of surgical and N95 masks. Though these masks weren’t foolproof either at blocking aerosols, with some masks performing worse than others, they were still overall more effective in limiting aerosol concentration than either the shield or valve masks.

The two brands of surgical masks tested out by the group proved more effective at blocking aerosols than either the face shield or valve N95 mask, though Brand A, seen above, was better than Brand B.
The two brands of surgical masks tested out by the group proved more effective at blocking aerosols than either the face shield or valve N95 mask, though Brand A, seen above, was better than Brand B.
Screenshot: Verma, et al/Phys. Fluids

“Overall, the visuals presented here indicate that face shields and masks with exhale valves may not be as effective as regular face masks in restricting the spread of aerosolized droplets,” the authors wrote. “Thus, despite the increased comfort that these alternatives offer, it may be preferable to use well-constructed plain masks.”

Source: How Face Shields and Valve Masks Fail to Stop Infectious Droplets, as Shown by Lasers

NB The study link itself has videos too

Engineers Have Figured Out How to Make Interactive Paper

Posted on by

Engineers at Purdue University have created a printing process by which you can coat paper or cardboard with “highly fluorinated molecules.” This then makes the coated paper dust, oil, and water-repellent, meaning you can then print multiple circuit layers onto the paper without smudging the ink. According to a paper the engineers published in Nano Energy, these “triboelectric areas” are then capable of “self-powered Bluetooth wireless communication.” That’s science-speak to say that paper printed and coated in this way doesn’t require external batteries as it generates electricity from contact with a user’s finger.

You can see a demonstration of how the tech works in these two videos. In the first video, Purdue engineers have a paper keypad that’s been treated with the aforementioned “omniphobic” coating. The paper keypad is then doused in some neon-green solution. In the second video, you can then see a person use the paper keypad to actually type on a laptop with a disabled keyboard.

In a third video, Purdue’s team printed a forward, back, mute, and volume bar on the back of a piece of paper. In it, you can see someone controlling audio playback by dragging their finger along the volume bar, as well as skipping forward and back in the music queue—some real David Blaine street magic-level shit.

While the tech itself is pretty cool, another neat aspect is that because it works on paper and cardboard, it would be relatively inexpensive, flexible, and quick to make. That makes it a good candidate for things like smart packaging.

“I envision this technology to facilitate the user interaction with food packaging, to verify if the food is safe to be consumed, or enabling users to sign the package that arrives at home by dragging their finger over the box to properly identify themselves as the owner of the package,” Ramses Martinez, an assistant professor at Purdue’s School of Industrial Engineering and one of the authors of the paper, said in a statement.

This isn’t the first time engineers have figured out novel uses for paper in electronics. A few months ago, researchers at the University of Missouri also created a paper-and-pencil medical wearable that could monitor things like heart rate, respiratory rate, glucose levels, body temperature, and sweat composition. In 2015, researchers from the University of Michigan created a stretchy conductor made of paper cut using the Japanese art of kirigami.

Purdue’s innovation is particularly interesting as it eliminates the need for external power sources, which makes applications like smart packaging less theoretical. That said, it’ll probably be a while before you can print your own paper Bluetooth keyboard.

Source: Engineers Have Figured Out How to Make Interactive Paper

COVID-19 tracing without an app? Google and Apple will ram it down your throat

Posted on by

Google and Apple have updated their COVID-19 contact-tracing tool to make it possible to notify users of potential exposures to the novel coronavirus without an app.

The new Exposure Notifications Express spec is baked into iOS 13.7, which emerged this week and will appear in an Android update due later this month.

This is not, repeat not, pervasive Bluetooth surveillance. The tool requires users to opt in, although public health authorities can use the tool to send notifications suggesting that residents do so.

Those who choose to participate agree to have their device use Bluetooth to search for other nearby opted-in devices, with an exchange of anonymised identifiers used to track encounters. If a user tests positive, and agrees to notify authorities, other users will be told that they are at risk and should act accordingly.

The update is designed to let health authorities use Bluetooth-powered contact-tracing without having to build their own apps. It’s still non-trivial to play, as the system requires one server to verify test results and another to run both contact-tracing apps and the app-free service.

Apple has published a succinct explainer here and Google has offered up code for notifications server on GitHub.

A couple of dozen US states have signed up for the new tool but other jurisdictions – among them India, Singapore and Australia – are persisting with their own approaches on the basis that the Apple/Google tech makes it harder for their manual contact-tracers to access information.

Source: COVID-19 tracing without an app? There’s an iOS and Android update for that • The Register

Considering the work both companies do with China and other friendly states, it would not surprise me that the “user opt in” feature becomes an “all users opt in without their knowing because the state is the people and the state knows best” feature in some places.