Monthly Archives: November 2023

FBI Director Admits Agency Rarely Has Probable Cause When It Performs Backdoor Searches Of NSA Collections

Posted on by

After years of continuous, unrepentant abuse of surveillance powers, the FBI is facing the real possibility of seeing Section 702 curtailed, if not scuttled entirely.

Section 702 allows the NSA to gather foreign communications in bulk. The FBI benefits from this collection by being allowed to perform “backdoor” searches of NSA collections to obtain communications originating from US citizens and residents.

There are rules to follow, of course. But the FBI has shown little interest in adhering to these rules, just as much as the NSA has shown little interest in curtailing the amount of US persons’ communications “incidentally” collected by its dragnet.

[…]

Somehow, the FBI director managed to blurt out what everyone was already thinking: that the FBI needs this backdoor access because it almost never has the probable cause to support the search warrant normally needed to access the content of US persons’ communications.

“A warrant requirement would amount to a de facto ban, because query applications either would not meet the legal standard to win court approval; or because, when the standard could be met, it would be so only after the expenditure of scarce resources, the submission and review of a lengthy legal filing, and the passage of significant time — which, in the world of rapidly evolving threats, the government often does not have,” Wray said. 

Holy shit. He just flat-out admitted it: a majority of FBI searches of US persons’ communications via Section 702 are unsupported by probable cause

[…]

Unfortunately, both the FBI and the current administration are united in their desire to keep this executive authority intact. Both Wray and the Biden administration call the warrant requirement a “red line.” So, even if the House decides it needs to go (for mostly political reasons) and/or Wyden’s reform bill lands on the President’s desk, odds are the FBI will get its wish: warrantless access to domestic communications for the foreseeable future.

Source: FBI Director Admits Agency Rarely Has Probable Cause When It Performs Backdoor Searches Of NSA Collections | Techdirt

Former GTA Developer’s Blog Removed After Rockstar Complains

Posted on by

Former Rockstar North developer Obbe Vermeij had been enjoying a few weeks of sharing some decades-old tales. Reminiscing on his many years with the GTA developer, Vermeij took to his personal blog to recall revealing inside stories behind games like San Andreas and Vice City, and everyone was having a good time. Until Rockstar North came along.

[…]

In the last few weeks, on his very old-school Blogger blog, Vermeij had been sharing some stories about the development processes behind the games, seemingly without any malice or ill-intent.

These included interesting insights into the original GTA and GTA 2, like how much the PC versions of the games had to be compromised so it would run on the PS1. “I remember one particular time when all of the textures for the PS version had been cut down to 16 colours,” Vermeij writes. “When the artists saw the results there was cursing. There was no choice though. Difficult choices had to be made to get the game to run on a PS.”

[…]

It seems the line was crossed for some at Rockstar after a couple of weeks of these lovely anecdotes and insights. On November 22, Vermeij removed most of the posts from the site, and added a new one explaining that after receiving an email from Rockstar North, “some of the OGs there are upset by my blog.”

I genuinely didn’t think anyone would mind me talking about 20 year old games but I was wrong. Something about ruining the Rockstar mystique or something.

Anyway,

This blog isn’t important enough to me to piss off my former colleagues in Edinburgh so I’m winding it down.

[…]

Of course, you know, nothing goes away on the internet. All the posts are a splendid, positive read.

[…]

 

Source: Former GTA Developer’s Blog Removed After Rockstar Complains

Copyright Bot Can’t Tell The Difference Between Star Trek Ship And Adult Film Actress

Posted on by

Given that the overwhelming majority of DMCA takedown notices are generated by copyright bots that are only moderately good at their job, at best, perhaps it’s not terribly surprising that these bots keep finding new and interesting ways to cause collateral damage unintentionally.

[…]

a Tumblr site, called “Mapping La Sirena.” If you’re a fan of Star Trek: Picard, you will know that’s the name of the main starship in that series. But if you’re a copyright enforcer for a certain industry, the bots you’ve set up for yourself apparently aren’t programmed with Star Trek fandom.

Transparency.automattic reports Tumblr has received numerous DMCA takedown notices from DMCA Piracy Prevention Inc, a third-party copyright monitoring service used frequently by content creators to prevent infringement of their original work. And these complaints occurred all because of the name La Sirena which also happens to be the name of an adult content creator, La Sirena 69 who is one of Piracy Prevention’s customers.

In one copyright claim over 90 Tumblr posts were targeted by the monitoring service because of the keyword match to “la sirena.” But instead of Automattic being alerted to La Sirena 69’s potentially infringed content, the company reported many of mappinglasirena.tumblr.com’s original posts.

Pure collateral damage. While not intentional per se, this is obviously still a problem. One of two things has to be the case: either we stop allowing copyright enforcement to be farmed out to a bunch of dumb bots that suck at their jobs or we insist that the bots stop sucking, which ain’t going to happen anytime soon. What cannot be allowed to happen is to shrug this sort of thing off as an innocent accident and oh well, too bad, so sad for the impact on the speech rights of the innocent.

There was nothing that remotely infringed La Sirena 69’s content. Everything about the complaints and takedown notices was wrong.

[…]

 

Source: Copyright Bot Can’t Tell The Difference Between Star Trek Ship And Adult Film Actress | Techdirt

Limits for quantum computers: Perfect clocks are impossible, research finds

Posted on by

[…]

Every clock has two : a certain precision and a certain time resolution. The time resolution indicates how small the time intervals are that can be measured—i.e., how quickly the clock ticks. Precision tells you how much inaccuracy you have to expect with every single tick.

The research team was able to show that since no clock has an infinite amount of energy available (or generates an infinite amount of entropy), it can never have perfect resolution and perfect precision at the same time. This sets fundamental limits to the possibilities of quantum computers.

[…]

Marcus Huber and his team investigated in general which laws must always apply to every conceivable clock. “Time measurement always has to do with entropy,” explains Marcus Huber. In every closed physical system, entropy increases and it becomes more and more disordered. It is precisely this development that determines the direction of time: the future is where the entropy is higher, and the past is where the entropy is even lower.

As can be shown, every measurement of time is inevitably associated with an increase in entropy: a clock, for example, needs a battery, the energy of which is ultimately converted into frictional heat and audible ticking via the clock’s mechanics—a process in which a fairly ordered state occurs the battery is converted into a rather disordered state of heat radiation and sound.

On this basis, the research team was able to create a that basically every conceivable clock must obey. “For a given increase in , there is a tradeoff between and precision,” says Florian Meier, first author of the second paper, now posted to the arXiv preprint server. “That means: Either the clock works quickly or it works precisely—both are not possible at the same time.”

[…]

“Currently, the accuracy of quantum computers is still limited by other factors, for example, the precision of the components used or electromagnetic fields. But our calculations also show that today we are not far from the regime in which the fundamental limits of time measurement play the decisive role.”

[…]

More information: Florian Meier et al, Fundamental accuracy-resolution trade-off for timekeeping devices, arXiv (2023). DOI: 10.48550/arxiv.2301.05173

Source: Limits for quantum computers: Perfect clocks are impossible, research finds

How to bypass Windows Hello fingerprint login

Posted on by

Hardware security hackers have detailed how it’s possible to bypass Windows Hello’s fingerprint authentication and login as someone else – if you can steal or be left alone with their vulnerable device.

The research was carried out by Blackwing Intelligence, primarily Jesse D’Aguanno and Timo Teräs, and was commissioned and sponsored by Microsoft’s Offensive Research and Security Engineering group. The pair’s findings were presented at the IT giant’s BlueHat conference last month, and made public this week. You can watch the duo’s talk below, or dive into the details in their write-up here.

For users and administrators: be aware your laptop hardware may be physically insecure and allow fingerprint authentication to be bypassed if the equipment falls into the wrong hands. We’re not sure how that can be fixed without replacing the electronics or perhaps updating the drivers and/or firmware within the fingerprint sensors. One of the researchers told us: “It’s my understanding from Microsoft that the issues were addressed by the vendors.” So check for updates or errata. We’ve asked the manufacturers named below for comment, and we will keep you updated.

For device makers: check out the above report to make sure you’re not building these design flaws into your products. Oh, and answer our emails.

The research focuses on bypassing Windows Hello’s fingerprint authentication on three laptops: a Dell Inspiron 15, a Lenovo ThinkPad T14, and a Microsoft Surface Pro 8/X, which were using fingerprint sensors from Goodix, Synaptics, and ELAN, respectively. All three were vulnerable in different ways. As far as we can tell, this isn’t so much a problem with Windows Hello or using fingerprints. It’s more due to shortcomings or oversights with the communications between the software side and the hardware.

Windows Hello allows users to log into the OS using their fingerprint. This fingerprint is stored within the sensor chipset. What’s supposed to happen, simply put, is that when you want to set up your laptop to use your print, the OS generates an ID and passes that to the sensor chip. The chip reads the user’s fingerprint, and stores the print internally, associating it with the ID number. The OS then links that ID with your user account.

Then when you come to login, the OS asks you to present your finger, the sensor reads it, and if it matches a known print, the chips sends the corresponding ID to the operating system, which then grants you access to the account connected to that ID number. The physical communication between the chip and OS involves cryptography to, ideally, secure this authentication method from attackers.

But blunders in implementing this system have left at least the above named devices vulnerable to unlocking – provided one can nab the gear long enough to connect some electronics.

“In all, this research took approximately three months and resulted in three 100 percent reliable bypasses of Windows Hello authentication,” Blackwing’s D’Aguanno and Teräs wrote on Tuesday.

Here’s a summary of the techniques used and described by the infosec pair:

    • Model: Dell Inspiron 15
    • Method: If someone can boot the laptop into Linux, they can use the sensor’s Linux driver to enumerate from the sensor chip the ID numbers associated with known fingerprints. That miscreant can then store in the chip their own fingerprint with an ID number identical to the ID number of the Windows user they want to login as. The chip stores this new print-ID association in an internal database associated with Linux; it doesn’t overwrite the existing print-ID association in its internal database for Windows.

      The attacker then attaches a man-in-the-middle (MITM) device between the laptop and the sensor, and boots into Windows. The Microsoft OS sends some non-authenticated configuration data to the chip. Crucially, the MITM electronics rewrites that config data on the fly to tell the chip to use the Linux database, and not the Windows database, for fingerprints. Thus when the miscreant next touches their finger to the reader, the chip will recognize the print, return the ID number for that print from the Linux database, which is the same ID number associated with a Windows user, and Windows will log the attacker in as that user.

    • Model: Lenovo ThinkPad T14
    • Method: The attack used against the ThinkPad is similar to the one above. While the Dell machine uses Microsoft’s Secure Device Connection Protocol (SDCP) between the OS and the chip, the T14 uses TLS to secure the connection. This can be undermined to again, using Linux, add a fingerprint with an ID associated with a Windows user, and once booted back into Windows, login as that user using the new fingerprint.
    • Model: Microsoft Surface Pro 8 / X Type Cover with Fingerprint ID
    • Method: This is the worst. There is no security between the chip and OS at all, so the sensor can be replaced with anything that can masquerade as the chip and simply send a message to Windows saying: Yup, log that user in. And it works. Thus an attacker can log in without even presenting a fingerprint.

Interestingly enough, D’Aguanno told us restarting the PC with Linux isn’t required for exploitation – a MITM device can do the necessary probing and enrollment of a fingerprint itself while the computer is still on – so preventing the booting of non-Windows operating systems, for instance, won’t be enough to stop a thief. The equipment can be hoodwinked while it’s still up and running.

“Booting to Linux isn’t actually required for any of our attacks,” D’Aguanno told us. “On the Dell (Goodix) and ThinkPad (Synaptics), we can simply disconnect the fingerprint sensor and plug into our own gear to attack the sensors. This can also be done while the machine is on since they’re embedded USB, so they can be hot plugged.”

In that scenario, “Bitlocker wouldn’t affect the attack,” he added.

As to what happens if the stolen machine is powered off completely, and has a BIOS password, full-disk encryption, or some other pre-boot authentication, exploitation isn’t as straight forward or perhaps even possible: you’d need to get the machine booted far enough into Windows for the Blackwing team’s fingerprint bypass to work. The described techniques may work against BIOSes that check for fingerprints to proceed with the startup sequence.

“If there’s a password required to boot the machine, and the machine is off, then that could stop this just by nature of the machine not booting to the point where fingerprint authentication is available,” D’Aguanno clarified to us.

“However, at least one of the implementations allows you to use fingerprint authentication for BIOS boot authentication, too. Our focus was on the impact to Windows Hello, though, so we did not investigate that further at this point, but that may be able to be exploited too.”

The duo also urged manufacturers to use SDCP and enable to connect sensor chips to Windows: “It doesn’t help if it’s not turned on.”

They also promised to provide more details about the vulnerabilities they exploited in all three targets in future, and were obviously circumspect in giving away too many details that could be used to crack kit.

Source: How to bypass Windows Hello, log into vulnerable laptops • The Register

Your Tastebuds Help Tell You When to Stop Eating, New Research Suggests

Posted on by

Our mouths might help keep our hunger in check. A recent study found evidence in mice that our brains rely on two separate pathways to regulate our sense of fullness and satiety—one originating from the gut and the other from cells in the mouth that let us perceive taste. The findings could help scientists better understand and develop anti-obesity drugs, the study authors say.

The experiment was conducted by researchers at the University of California San Francisco. They were hoping to definitively answer one of the most important and basic questions about our physiology: What actually makes us want to stop eating?

It’s long been known that the brainstem—the bottom part of the brain that controls many subconscious body functions—also helps govern fullness. The current theory is that neurons in the brainstem respond to signals from the stomach and gut as we’re eating a meal, which then trigger that feeling of having had enough. But scientists have only been able to indirectly study this process until now, according to lead author Zachary Knight, a UCSF professor of physiology in the Kavli Institute for Fundamental Neuroscience. His team was able to directly image and record the fullness-related neurons in the brainstem of alert mice right as they were chowing down.

“Our study is the first to observe these neurons while an animal eats,” Knight told Gizmodo in an email. “We found surprisingly that many of these cells respond to different signals and control feeding in different ways than was widely assumed.”

The team focused on two types of neurons in the brainstem thought to regulate fullness: prolactin-releasing hormone (PRLH) neurons and GCG neurons.

When they fed mice through the stomach alone, they found that PRLH neurons were activated by the gut, as expected by prior assumptions. But when the mice ate normally, these gut signals disappeared; instead, the PRLH neurons were almost instantly activated by signals from the mouth, largely from the parts responsible for taste perception. Minutes later, the GCG neurons were activated by gut signals.

The team’s findings, published Wednesday in Nature, indicate that there are two parallel tracks of satiety in the brainstem, ones that operate at different speeds with slightly different purposes.

“We found that the first pathway—which controls how fast you eat and involves PRLH neurons—is unexpectedly activated by the taste of food,” Knight said. “This was surprising, because we all know that tasty food causes us to eat more. But our findings reveal that food tastes also function to limit the pace of ingestion, through a brainstem pathway that likely functions beneath the level of our conscious awareness.”

The second pathway, governed by the gut and GCG neurons, seems to control how much we ultimately eat, Knight added.

Mice are not humans, of course. So more research will be needed to confirm whether we have a similar system.

[…]

Source: Your Tastebuds Help Tell You When to Stop Eating, New Research Suggests

Toxic air killed more than 500,000 people in EU in 2021, data shows

Posted on by

Dirty air killed more than half a million people in the EU in 2021, estimates show, and about half of the deaths could have been avoided by cutting pollution to the limits recommended by doctors.

The researchers from the European Environment Agency attributed 253,000 early deaths to concentrations of fine particulates known as PM2.5 that breached the World Health Organization’s maximum guideline limits of 5µg/m3. A further 52,000 deaths came from excessive levels of nitrogen dioxide and 22,000 deaths from short-term exposure to excessive levels of ozone.

“The figures released today by the EEA remind us that air pollution is still the number one environmental health problem in the EU,” said Virginijus Sinkevičius, the EU’s environment commissioner.

Doctors say air pollution is one of the biggest killers in the world but death tolls will drop quickly if countries clean up their economies. Between 2005 and 2021, the number of deaths from PM2.5 in the EU fell 41%, and the EU aims to reach 55% by the end of the decade.

[…]

Source: Toxic air killed more than 500,000 people in EU in 2021, data shows | Air pollution | The Guardian

Ubisoft blames ‘technical error’ for showing pop-up ads in Assassin’s Creed

Posted on by

Ubisoft is blaming a “technical error” for a fullscreen pop-up ad that appeared in Assassin’s Creed Odyssey this week. Reddit users say they spotted the pop-up on Xbox and PlayStation versions of the game, with an ad appearing just when you navigate to the map screen. “This is disgusting to experience while playing,” remarked one Reddit user, summarizing the general feeling against such pop-ups in the middle of gameplay.

“We have been made aware that some players encountered pop-up ads while playing certain Assassin’s Creed titles yesterday,” says Ubisoft spokesperson Fabien Darrigues, in a statement to The Verge. “This was the result of a technical error that we addressed as soon as we learned of the issue.”

The pop-up ad appeared during the middle of gameplay.
The pop-up ad appeared during the middle of gameplay.Image: triddell24 (Reddit)

While it was unclear at first why the game suddenly started showing Black Friday pop-up ads to promote Ubisoft’s latest versions of Assassin’s Creed, the publisher later explained what went wrong in a post on X (formerly Twitter). Ubisoft says it was trying to put an ad for Assassin’s Creed Mirage in the main menu of other Assassin’s Creed games. However, a “technical error” caused the promotion to show up on in-game menus instead. Ubisoft says the issue has since been fixed.

We recently saw Microsoft use fullscreen Xbox pop-up ads to promote its own games, and they’ve been annoying Xbox owners. Microsoft’s ads only appear when you boot an Xbox, and not everyone seems to be getting them. Microsoft and Ubisoft’s pop-ups are still very different to the ads we’re used to seeing on game consoles. We’ve seen games like Saints Row 2 with ads running on billboards, or plenty of in-game ads in EA Games titles in the mid-to-late 2000s.

Fullscreen pop-up ads in the middle of a game certainly aren’t common. Imagine a world full of games you’ve paid $70 for and then ads popping up in the middle of gameplay. I truly hope that Ubisoft’s “technical error” never becomes a game industry reality.

Source: Ubisoft blames ‘technical error’ for showing pop-up ads in Assassin’s Creed – The Verge

A new way to predict ship-killing rogue waves, more importantly: to see how an AI finds its results

Posted on by

[…]

In a paper in Proceedings of the National Academy of Sciences, a group of researchers led by Dion Häfner, a computer scientist at the University of Copenhagen, describe a clever way to make AI more understandable. They have managed to build a neural network, use it to solve a tricky problem, and then capture its insights in a relatively simple five-part equation that human scientists can use and understand.

The researchers were investigating “rogue waves”, those that are much bigger than expected given the sea conditions in which they form. Maritime lore is full of walls of water suddenly swallowing ships. But it took until 1995 for scientists to measure such a wave—a 26-metre monster, amid other waves averaging 12 metres—off the coast of Norway, proving these tales to be tall only in the literal sense.

[…]

To produce something a human could follow, the researchers restricted their neural network to around a dozen inputs, each based on ocean-wave maths that scientists had already worked out. Knowing the physical meaning of each input meant the researchers could trace their paths through the network, helping them work out what the computer was up to.

The researchers trained 24 neural networks, each combining the inputs in different ways. They then chose the one that was the most consistent at making accurate predictions in a variety of circumstances, which turned out to rely on only five of the dozen inputs.

To generate a human-comprehensible equation, the researchers used a method inspired by natural selection in biology. They told a separate algorithm to come up with a slew of different equations using those five variables, with the aim of matching the neural network’s output as closely as possible. The best equations were mixed and combined, and the process was repeated. The result, eventually, was an equation that was simple and almost as accurate as the neural network. Both predicted rogue waves better than existing models.

The first part of the equation rediscovered a bit of existing theory: it is an approximation of a well-known equation in wave dynamics. Other parts included some terms that the researchers suspected might be involved in rogue-wave formation but are not in standard models. There were some puzzlers, too: the final bit of the equation includes a term that is inversely proportional to how spread out the energy of the waves is. Current human theories include a second variable that the machine did not replicate. One explanation is that the network was not trained on a wide enough selection of examples. Another is that the machine is right, and the second variable is not actually necessary.

Better methods for predicting rogue waves are certainly useful: some can sink even the biggest ships. But the real prize is the visibility that Dr Häfner’s approach offers into what the neural network was doing. That could give scientists ideas for tweaking their own theories—and should make it easier to know whether to trust the computer’s predictions.

Source: A new way to predict ship-killing rogue waves

EU Parliament adopts Right to Repair law with broad support

Posted on by

[…]

At the Parliament’s plenary session in Strasbourg, the right to repair was adopted with 590 votes in favour.

The legislative file, first presented by the EU Commission in March, aims to support the European Green Deal targets by increasing incentives for a circular economy, such as making repair a more attractive option than replacement for consumers.

[…]

Apart from ensuring favourable conditions for an independent repair market and preventing manufacturers from undermining repairs as an attractive choice, the IMCO position also extended the product category for a right-to-repair to bicycles.

“We do need this right to repair. What we are currently doing is simply not sustainable. We are living in a market economy where after two years, products have to be replaced, and we must lead Europe to a paradigm shift in that regard,” Repasi said.

Sunčana Glavak (EPP), the rapporteur for the opinion of the ENVI (Environment, Public Health and Food Safety) Committee, added it was “necessary to strengthen the repair culture through awareness raising campaigns, above all at the national level”.

[…]

To incentivise the choice for repair, the Parliament introduced an additional one-year guarantee period on the repaired goods, “once the minimum guarantee period has elapsed”, Repasi explained, as well as the possibility for a replacement product during repair if the repair takes too long.

Moreover, the Parliament intends to create a rule that market authorities can intervene to lower prices for spare parts to a realistic price level.

“Manufacturers must also be obliged to provide spare parts and repair information at fair prices. The European Parliament has recognised this correctly,” Holger Schwannecke, secretary general of the German Confederation of Skilled Crafts and Small Businesses, said.

He warned that customer claims against vendors and manufacturers must not result in craftspeople being held liable for third-party repairs.

To ensure that operating systems of smartphones continue to work after repair by an independent repairer, the Parliament aims to ban phone makers’ practice of running a closed system that limits access to alternative repair services.

[…]

Source: EU Parliament adopts Right to Repair law with broad support – EURACTIV.com

Google reportedly struck a special with Spotify that let it skip Play Store fees revealed in Epic vs Google lawsuit

Posted on by

Spotify struck a special deal with Google that lets it pay no commission to Google when people sign up for subscriptions using the music streaming service’s own payment system on Android, according to new testimony in the ongoing Epic v. Google trial first reported by The Verge. As part of the same deal, Spotify paid Google just four percent commission if users signed up for the service through Google, far less than most other apps which typically pay 15 percent for subscriptions through the Google Play Store.

“Listening to music is one of [the phone’s] core purposes… if we don’t have Spotify working properly across Play services and core services, people will not buy Android phones”, Google’s partnerships head Don Harrison reportedly said in court. Both Google and Spotify also agreed to put $50 million each in a “success fund” as part of the deal.

The remarks were made as part of a lawsuit first filed against Google by Epic Games, the maker of the wildly popular Fortnite, in 2020. Epic claimed that Google’s Play Store on Android was an illegal monopoly that forced app makers to part with huge sums of cash in exchange for offering users in-app purchases through the Play Store. Epic filed a similar lawsuit against Apple in 2021, which it lost.

“A small number of developers that invest more directly in Android and Play may have different service fees as part of a broader partnership that includes substantial financial investments and product integrations across different form factors,” Dan Jackson, a Google spokesperson, wrote to Engadget in a statement. “These key investment partnerships allow us to bring more users to Android and Play by continuously improving the experience for all users and create new opportunities for all developers.”

Spotify initially supported Epic in its fight against Google and Apple. But in 2022, the company started using a Google program called User Choice Billing that let Android apps use their own payment systems in exchange for giving a reduced cut to Google. The special deal revealed in court showed that Google was willing to carve out even more exceptions for popular apps like Spotify.

Source: Google reportedly struck a special with Spotify that let it skip Play Store fees

So it’s not a very level playing field in the app store at all then?

The AI startup behind Stable Diffusion is now testing generative video

Posted on by

Stable Diffusion’s generative art can now be animated, developer Stability AI announced. The company has released a new product called Stable Video Diffusion into a research preview, allowing users to create video from a single image. “This state-of-the-art generative AI video model represents a significant step in our journey toward creating models for everyone of every type,” the company wrote.

The new tool has been released in the form of two image-to-video models, each capable of generating 14 to 25 frames long at speeds between 3 and 30 frames per second at 576 × 1024 resolution.

[…]

Stable Video Diffusion is available only for research purposes at this point, not real-world or commercial applications. Potential users can sign up to get on a waitlist for access to an “upcoming web experience featuring a text-to-video interface,” Stability AI wrote. The tool will showcase potential applications in sectors including advertising, education, entertainment and more.

[…]

it has some limitations, the company wrote: it generates relatively short video (less than 4 seconds), lacks perfect photorealism, can’t do camera motion except slow pans, has no text control, can’t generate legible text and may not generate people and faces properly.

The tool was trained on a dataset of millions of videos and then fine-tuned on a smaller set, with Stability AI only saying that it used video that was publicly available for research purposes.

[…]

Source: The AI startup behind Stable Diffusion is now testing generative video

Commercial Flights Are Experiencing dozens of GPS Spoofing Attacks in the Middle East

Posted on by

Commercial air crews are reporting something “unthinkable” in the skies above the Middle East: novel “spoofing” attacks have caused navigation systems to fail in dozens of incidents since September.

In late September, multiple commercial flights near Iran went astray after navigation systems went blind. The planes first received spoofed GPS signals, meaning signals designed to fool planes’ systems into thinking they are flying miles away from their real location. One of the aircraft almost flew into Iranian airspace without permission. Since then, air crews discussing the problem online have said it’s only gotten worse, and experts are racing to establish who is behind it.

OPSGROUP, an international group of pilots and flight technicians, sounded the alarm about the incidents in September and began to collect data to share with its members and the public. According to OPSGROUP, multiple commercial aircraft in the Middle Eastern region have lost the ability to navigate after receiving spoofed navigation signals for months. And it’s not just GPS—fallback navigation systems are also corrupted, resulting in total failure.

According to OPSGROUP, the activity is centered in three regions: Baghdad, Cairo, and Tel Aviv. The group has tracked more than 50 incidents in the last five weeks, the group said in a November update, and identified three new and distinct kinds of navigation spoofing incidents, with two arising since the initial reports in September.

While GPS spoofing is not new, the specific vector of these new attacks was previously “unthinkable,” according to OPSGROUP, which described them as exposing a “fundamental flaw in avionics design.” The spoofing corrupts the Inertial Reference System, a piece of equipment often described as the “brain” of an aircraft that uses gyroscopes, accelerometers, and other tech to help planes navigate. One expert Motherboard spoke to said this was “highly significant.”

“This immediately sounds unthinkable,” OPSGROUP said in its public post about the incidents. “The IRS (Inertial Reference System) should be a standalone system, unable to be spoofed. The idea that we could lose all on-board nav capability, and have to ask [air traffic control] for our position and request a heading, makes little sense at first glance— especially for state of the art aircraft with the latest avionics. However, multiple reports confirm that this has happened.”

Signal jamming in the Middle East is common, but this kind of powerful spoofing is new. According to Todd Humphreys, a UT Austin professor who researches satellite communications, extremely powerful signal jammers have been present in the skies near Syria since 2018. “Syria was called ‘the most aggressive electronic warfare environment on the planet’ by the head of [U.S. Special Operations Command],” Humphreys told Motherboard.

[…]

“Apart from run-of-the-mill jamming (e.g., with chirp jammers), we have captured GPS spoofing signals in our radio trawling,” he said. “But, interestingly, the spoofing signals never seemed to be complete. They were either missing key internal data, or were not mutually consistent, and so would not have fooled a GPS receiver. They seemed to be aimed at denial of service rather than actual deception. My students and I came to realize that spoofing is the new jamming. In other words, it is being used for denial of service because it’s more effective for that purpose than blunt jamming.”

[…]

“The GPS and IRS, and their redundant backups, are the principal components of modern aircraft navigation systems,” Humphreys said. “When their readings are corrupted, the Flight Management System assumes an incorrect aircraft position, Synthetic Vision systems show the wrong context, etc. Eventually, if the pilots figure out that something is amiss, they can revert to [VHF omnidirectional range]/ [distance measure equipment] over land. But in several recent cases, air traffic control had to step in and directly provide pilots ‘vectors’ (over an insecure communications channel) to guide them to their destination. That’s not a scalable solution.”

[…]

“It shows that the inertial reference systems that act as dead-reckoning backups in case of GPS failure are no backup at all in the face of GPS spoofing because the spoofed GPS receiver corrupts the IRS, which then dead reckons off the corrupted position,” he told Motherboard. “What is more, redundant GPS receivers and IRSs (large planes have 2+ GPS receivers and 3+ IRS) offer no additional protection: they all get corrupted.”

Humphreys and others have been sounding the alarm about an attack like this occurring for the past 15 years. In 2012, he testified by Congress about the need to protect GNSS from spoofing. “GPS spoofing acts like a zero-day exploit against aviation systems,” he told Motherboard. “They’re completely unprepared for it and powerless against it.”

[…]

The entities behind the novel spoofing attacks are unknown, but Humphreys said that he and a student have narrowed down possible sources. “Using raw GPS measurements from several spacecraft in low-Earth orbit, my student Zach Clements last week located the source of this spoofing to the eastern periphery of Tehran,” he said.

Iran would not be the only country spoofing GPS signals in the region. As first reported by Politico, Clements was the first to identify spoofing most likely coming from Israel after Hamas’ Oct. 7 attacks. “The strong and persistent spoofing we’re seeing over Israel since around October 15 is almost certainly being carried out by Israel itself,” Humprheys said. “The IDF effectively admitted as much to a reporter with Haartz.” Humphreys said at the time that crews experiencing this GPS spoofing could rely on other onboard instruments to land.

Humphreys said the effects of the Israeli spoofing are identical to those observed in late September near Iran. “And these are the first clear-cut cases of GPS spoofing of commercial aircraft ever, to my knowledge,” he said. “That they happened so close in time is surprising, but possibly merely coincidental.”

Source: Commercial Flights Are Experiencing ‘Unthinkable’ GPS Attacks and Nobody Knows What to Do

US government pays AT&T to let cops search phone records without warrant

Posted on by

A senator has alleged that American law enforcement agencies snoop on US citizens and residents, seemingly without regard for the privacy provisions of the Fourth Amendment, under a secret program called the Hemisphere Project that allows police to conduct searches of trillions of phone records.

According to Senator Ron Wyden (D-OR), these searches “usually” happen without warrants. And after more than a decade of keeping people — lawmakers included — in the dark about Hemisphere, Wyden wants the Justice Department to reveal information about what he called a “long-running dragnet surveillance program.”

“I have serious concerns about the legality of this surveillance program, and the materials provided by the DoJ contain troubling information that would justifiably outrage many Americans and other members of Congress,” Wyden wrote in a letter [PDF] to US Attorney General Merrick Garland.

Under Hemisphere, the White House Office of National Drug Control Policy (ONDCP) pays telco AT&T to provide all federal, state, local, and tribal law enforcement agencies with the ability to request searches of trillions of domestic phone records dating back to at least 1987, plus the four billion call records added every day.

[…]

Hemisphere first came to light in a 2013 New York Times report that alleged the “scale and longevity of the data storage appears to be unmatched by other government programs, including the NSA’s gathering of phone call logs under the Patriot Act.”

It’s not classified, but that doesn’t mean the Feds want you to see it

Privacy advocates including the Electronic Frontier Foundations have filed Freedom of Information Act and state-level public records lawsuits to learn more about the secret snooping program.

Few have made a dent: it appears that the Feds are doing everything they can to keep Hemisphere secret.

Although the program and its documents are not classified, the Justice Department has marked them as “Law Enforcement Sensitive,” meaning their disclosure could hurt ongoing investigations. This designation also prevents the documents from being publicly released.

Senator Wyden wants the designation removed.

Additionally, Hemisphere is not subject to a federal Privacy Impact Assessment due to its funding structure, it’s claimed. The White House doesn’t directly pay AT&T – instead the ONDCP provides a grant to the Houston High Intensity Drug Trafficking Area, which is a partnership between federal, state, and local law enforcement agencies. And this partnership, in turn, pays AT&T to operate this surveillance scheme.

[…]

Source: US government pays AT&T to let cops search phone records • The Register

Google admits it’s making YouTube worse for ad block and non-chrome (Edge, Firefox) users

Posted on by

[…]

Earlier this year, YouTube began interrupting videos for those using advert blockers with a pop-up encouraging them to either disable the offending extension or filter, or pay for YT’s ad-free premium tier.

More recently, netizens have reported experiencing delays in playback when using non-Chrome browsers as well.

Upon launching a video, Firefox users have reported a delay of roughly five seconds before playback would begin. In a statement to The Register, Google admitted it was intentionally making its content less binge-able for users unwilling to turn off offending extensions, though this wasn’t linked to any one browser.

“Ads are a vital lifeline for our creators that helps them run and grow their businesses,” a Google spokesperson explained. “In the past week, users using ad blockers may have experienced delays in loading, regardless of the browser they are using.”

To be clear, Google’s business model revolves around advertising, and ad blockers are specifically called out as being in violation of its terms of service. Google also makes Chrome, the widely-used browser that Mozilla’s Firefox and others try to compete against.

Unfortunately, the method used by Google to detect the presence of ad blockers and trigger the delay appears to be prone to false positives. Several netizens have reported experiencing delays when using Firefox or Microsoft’s Edge browser without an ad blocker installed.

[…]

The Register was unable to replicate this behavior in Firefox with or without an ad blocker enabled. This suggests Google could be experimenting to see just how far it can push users to convince them to turn off their ad blockers for good. In other words, not all netizens will or have experienced this delay.

YouTube said its ad block detection does not target any specific browsers, and that people who continue to use ad blockers may experience degraded or interrupted service as its detection efforts evolve.

[…]

Source: Google admits it’s making YouTube worse for ad block users • The Register

Also, the technology Google uses to detect your ad blocker basically amounts to spyware (Privacy advocate challenges YouTube’s ad blocking detection (which isn’t spyware))

Aging (for men) – what nobody told you: pee slippers

Posted on by
Reply

“The 100-year-old man set off in his pee-slippers (so called because men of an advanced age rarely pee farther than their shoes),”

― Jonas Jonasson, The 100-Year-Old Man Who Climbed Out the Window and Disappeared

Guys, as you get older your bladder power goes down. This has some consequences – you don’t pee very far and you don’t empty out fully after pissing, which leads to drippage in your underwear. You wake up (once, twice, three times) per night and go to the bathroom now. If you search up this kind of stuff, chances are you will have found overly serious conditions such as “Urinary Retention”, “Urinary Incontinence”, “Overflow Incontincence”, “Bladder Outlet Obstruction”, “Benign prostatic hyperplasia (BPH)”, “blood and or cloudy urine”, “Nocturia” and all kinds of other nasties. This is not about that. This is about some of the better tips I have found to handle this dripping life we have now found ourselves in.

TL;DR

You get old and your muscles get weaker, you can hold less and your piss tube gets blocked. You have to handle your pissing, so drink less before you travel or need to be somewhere, especially caffeinated drinks. Double void, lean forward and whistle to empty your bladder. Do pelvic floor muscles (kegels) for more control. After you piss, milk your piss tube (ureter) behind your balls quickly to empty the tube out. Put your legs up before sleeping and try to go to bed at the same time every night.

So what exactly happens to you as you get older?

As you age the whole system around your piss (the kidneys, bladder, ureter [=piss tube], prostrate) change naturally. The kidney becomes lighter and can’t filter as much blood. The arteries supplying blood to the kidneys narrow. For women the piss tube shortens (theirs is called the urethra) and becomes thinner, which increases the risk of being unable to piss, but for men this doesn’t change. The prostrate gland can grow though and can block your piss tube. All your life, your bladder muscles contract without you actually needing to pee, but these contractions are blocked by your spinal chord and brain controls. As you get older your system stops blocking these contractions, leading to more urine left in the bladder after you have taken a piss and you need to go more often. Not only that, but the muscles themselves weaken. The bladder wall itself becomes less elastic and so less able to hold much pee.

Further reading: Effects of Aging on the Urinary Tract – MSD Manual 2022 / Aging changes in the kidneys and bladder – Medline Plus (National Library of Medicine) 2022 / The Aging Bladder – National Library of Medicine, National Center for Biotechnology Information (2004)

Some actually useful tips for people who are just aging and not seriously ill

Medication use: Alter use of medications that could worsen urinary symptoms.

  • Talk to your doctor or pharmacist about prescription or over-the-counter medications that may be contributing to your BPH symptoms. Antihistamines and decongestants can cause problems for some.
  • If you use medications that could make you urinate more, don’t take them right before driving, traveling, attending an event, or going to bed.
  • Don’t rely on ineffective dietary supplements. Saw palmetto and other herbal supplements have failed rigorous scientific testing so far.

Fluid restriction: Change how much fluid you drink — and when — to prevent bothersome bathroom visits.

  • Don’t drink liquids before driving, traveling, or attending events where finding a bathroom quickly could be difficult.
  • Avoid drinking caffeinated or alcoholic beverages after dinner or within two hours of your bedtime.

Bladder habits: Change the timing and manner in which you empty your bladder to reduce symptoms or make them less disruptive.

  • Don’t hold it in; empty your bladder when you first get the urge.
  • When you are out in public, go to the bathroom and try to urinate when you get the chance, even if you don’t feel a need right then.
  • Take your time when urinating so you empty your bladder as much as possible.
  • Double void: After each time you urinate, try again right away.
  • On long airplane flights, avoid drinking alcohol, and try to urinate every 60 to 90 minutes.

Try these techniques to relieve common urinary symptoms without medication

  • Timed voids. Urinate at least every three to four hours. Never hold the urine.
  • Double void. Before leaving the restroom, try to empty your bladder a second time. Focuson relaxing the muscles of the pelvic floor. You may try running your hands under warm waterbefore your second void to trigger a relaxation response.
  • Drink plenty of fluids. Fluids keep the urinary tract hydrated and clean.
  • Have a bowel movement every day. The rectum is just behind the bladder. If it is a full, it can prevent the bladder from functioning properly. Increase your fruit, fiber, water and walkinguntil you have soft bowel movements and don’t have to strain. You may add over the counter medications like Senna (Sennakot, SennaGen), Colace (docusate) or Dulcolax (bisacodyl).
  • Comfort and privacy are necessary to empty completely. Give yourself time to go.
  • Leaning forward (and rocking) may promote urination.After you have finished passing urine, squeeze the pelvic floor to try to completely empty.
  • The sound of water can promote the bladder muscle to contract, but care should be taken
  • not to promote bladder muscle instability with overuse of this technique.
  • Tapping over the bladder may assist in triggering a contraction in some people.
  • Stroking or tickling the lower back may stimulate urination and has been reported to be helpful in some patients.
  • Whistling provides a sustained outward breath with a gentle increase in pressure in the abdomen that may help with emptying your bladder.
  • General relaxation techniques can help people who are tense and anxious about theircondition.
Techniques for Complete Bladder Emptying – Urology Group Virginia

Pelvic floor exercises

The pelvic floor consists of layers of muscles and ligaments that stretch like a hammock, from the
pubic bone at the front to the tip of the back bone, that help to support your bladder and bowel.
Pelvic floor exercises can be done in different positions:
• In a standing position, stand with your feet apart and tighten your pelvic floor muscles as if
you were trying to avoid breaking wind. If you look in a mirror you should see the base of your
penis move nearer to your abdomen and your testicles rise. Hold the contraction as strongly
as you can without holding your breath or tensing your buttocks. Perform this three times (as
strong as possible) in the morning, holding each for up to 10 seconds – and three times (as
strong as possible) in the evening, holding each for up to 10 seconds.
• In a sitting position, sit on a chair with your knees apart and tighten your pelvic floor muscles
as if you were trying to avoid breaking wind. Hold the contraction as strongly as you can
without holding your breath or tensing your buttocks. Perform this three times (as strong as
possible) in the morning, holding each for up to 10 seconds – and three times (as strong as
possible) in the evening, holding each for up to 10 seconds.
• In a lying position, lie on your back with your knees bent and your legs apart. Tighten your
pelvic floor muscles as if you were trying to avoid breaking wind and hold the contractions as
strongly as you can without holding your breath or tensing your buttocks. Perform this three
times (as strong as possible) in the morning, holding each for up to 10 seconds – and three
times (as strong as possible) in the evening, holding each for up to 10 seconds.
• While walking, tighten your pelvic floor muscles as you walk.
• After urinating and you have emptied your bladder, tighten your pelvic floor muscles as
strongly as you can to avoid an after dribble

Post micturition dribble exercise (dripping, drippage, dribbling after peeing)

• After passing urine, wait for a few seconds to allow the bladder to empty.
• Place your fingers behind the scrotum and apply gentle pressure to straighten out the urethra.
• Continue this whilst gently lifting and stroking to encourage the trapped urine to follow out.
• Before leaving the toilet, repeat the technique twice to ensure that the urethra is completely
empty.
This technique can easily be used at home. When in public toilets it can be done discreetly, with a
hand inside a trouser pocket.
It only takes a few seconds and will avoid the problem of stained trousers.
Pelvic floor exercises for men can also improve this problem as it improves the tone of your
muscles

Male pelvic floor exercises and post micturition dribble – NHS Western Isles 2022 (PDF)

Many men dribble urine shortly after they have finished using the toilet and the bladder feels empty. Even waiting a moment and shaking the penis before zipping up won’t stop it. The medical term for this is post-micturition dribbling. It’s common in older men because the muscles surrounding the urethra — the long tube in the penis that allows urine to pass out of the body — don’t squeeze as hard as they once did. This leaves a small pool of urine at a dip in the urethra behind the base of the penis. In less than a minute after finishing, this extra urine dribbles out.

Here’s a simple technique that should help. Right after your urine stream stops, “milk out” the last few drops of urine. Using the fingertips of one hand, begin about an inch behind your scrotum. Gently press upward. Keep applying this pressure as you move your fingers toward the base of the penis under the scrotum. Repeat once or twice. This should move the pooled urine into the penis. You can then shake out the last few drops. With practice, you should be able to do this quickly.

What can I do about urinary dribbling? – Men’s Health 2022

Kegel Exercises

Kegel exercises, also known as pelvic floor muscle exercises, are the easiest way for you to control urinary incontinence and stress incontinence, as they can be easily added to your daily routine.

To perform a Kegel exercise, you just need to squeeze your pelvic floor muscles. These are the same muscles you would use to stop the flow of urine.

Simply squeeze these muscles for 3 seconds and then relax. The National Institute of Diabetes and Digestive and Kidney Diseases (NIDDKD) suggests building up to 10-15 repetitions, 3 times a day. You can do these pelvic floor exercises while sitting or lying down.

Bladder Training

This is an effective way to overcome overactive bladder symptoms and gain more bladder control. The exercise trains your bladder to hold more urine before needing to empty it.

First, you need to determine your baseline. Make a diary of how often you need to go to the bathroom throughout the day. Then try to go to the bathroom less often, holding in the urine longer between visits. It may feel uncomfortable, but doing this will help you gain more bladder control.

Bladder Exercises — How to Strengthen Bladder Muscles – Urology of Greater Atlanta

How to stop pissing in the middle of the night

  • Limit liquids before bedtime: Avoid drinking water or other beverages at night to reduce the need to wake up to urinate.
  • Reduce caffeine and alcohol intake: Caffeine can trigger the bladder to become overactive and produce too much urine.Reduce your intake of caffeine and alcoholic beverages later in the afternoon and evening. 
  • Talk to your doctor about when to take medications: Some medications, such as diuretics, can increase nighttime urination. Ask your doctor about the ideal time to take medications so they don’t interfere with your sleep.
  • Strengthen your pelvic floor: Doctors recommend pelvic floor muscle exercises to help strengthen key muscles and control your urinary symptoms. 
  • Elevate or compress your legs: Some research has shown that you can reduce fluid buildup that leads to urination by elevating your legs or using compression socks before bedtime.
  • Practice good sleep hygiene: Healthy sleep hygiene can help you get better rest. Doctors recommend relaxing before bed, going to bed at the same time every night, and making sure your sleep environment is quiet, dark, and comfortable.
Frequent Urination at Night (Nocturia) – Sleep doctor 2023

Ok fellas, so hopefully we will stop dribbling into our pants a bit more. If you have any tips to improve on this guide then I look forward to hearing from you!

Next we will be looking at sleeping issues. This is a subject that seems to have some kind of taboo on it, but once you raise it, you realise that loads of people suffer from them.

Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft

Sarah Silverman’s retarded AI Case Isn’t Going Very Well Either

Posted on by

Just a few weeks ago Judge William Orrick massively trimmed back the first big lawsuit that was filed against generative AI companies for training their works on copyright-covered materials. Most of the case was dismissed, and what bits remained may not last much longer. And now, it appears that Judge Vince Chhabria (who has been very good on past copyright cases) seems poised to do the same.

This is the high profile case brought by Sarah Silverman and some other authors, because some of the training materials used by OpenAI and Meta included their works. As we noted at the time, that doesn’t make it copyright infringing, and it appears the judge recognizes the large hill Silverman and the other authors have to climb here:

U.S. District Judge Vince Chhabria said at a hearing that he would grant Meta’s motion to dismiss the authors’ allegations that text generated by Llama infringes their copyrights. Chhabria also indicated that he would give the authors permission to amend most of their claims.

Meta has not yet challenged the authors’ central claim in the case that it violated their rights by using their books as part of the data used to train Llama.

“I understand your core theory,” Chhabria told attorneys for the authors. “Your remaining theories of liability I don’t understand even a little bit.”

Chhabria (who you may recall from the time he quashed the ridiculous copyright subpoena that tried to abuse copyright law to expose whoever exposed a billionaire’s mistress) seems rightly skeptical that just because ChatGPT can give you a summary of Silverman’s book that it’s somehow infringing:

“When I make a query of Llama, I’m not asking for a copy of Sarah Silverman’s book – I’m not even asking for an excerpt,” Chhabria said.

The authors also argued that Llama itself is an infringing work. Chhabria said the theory “would have to mean that if you put the Llama language model next to Sarah Silverman’s book, you would say they’re similar.”

“That makes my head explode when I try to understand that,” Chhabria said.

It’s good to see careful judges like Chhabria and Orrick getting into the details here. Of course, with so many of these lawsuits being filed, I’m still worried that some judge is going to make a mess of things, but we’ll see what happens.

Source: Sarah Silverman’s AI Case Isn’t Going Very Well Either | Techdirt

“Make It Real” AI prototype wows UI devs by turning drawings into working software

Posted on by

collaborative whiteboard app maker called “tldraw” made waves online by releasing a prototype of a feature called “Make it Real” that lets users draw an image of software and bring it to life using AI. The feature uses OpenAI’s GPT-4V API to visually interpret a vector drawing into functioning Tailwind CSS and JavaScript web code that can replicate user interfaces or even create simple implementations of games like Breakout.

Further Reading

ChatGPT update enables its AI to “see, hear, and speak,” according to OpenAI

“I think I need to go lie down,” posted designer Kevin Cannon at the start of a viral X thread that featured the creation of functioning sliders that rotate objects on screen, an interface for changing object colors, and a working game of tic-tac-toe. Soon, others followed with demonstrations of drawing a clone of Breakout, creating a working dial clock that ticks, drawing the snake game, making a Pong game, interpreting a visual state chart, and much more.

Users can experiment with a live demo of Make It Real online. However, running it requires providing an API key from OpenAI, which is a security risk. If others intercept your API key, they could use it to rack up a very large bill in your name (OpenAI charges by the amount of data moving into and out of its API). Those technically inclined can run the code locally, but it will still require OpenAI API access.

Tldraw, developed by Steve Ruiz in London, is an open source collaborative whiteboard tool. It offers a basic infinite canvas for drawing, text, and media without requiring a login. Launched in 2021, the project received $2.7 million in seed funding and is supported by GitHub sponsors. When The GPT-4V API launched recently, Ruiz integrated a design prototype called “draw-a-ui” created by Sawyer Hood to bring the AI-powered functionality into tldraw.

GPT-4V is a version of OpenAI’s large language model that can interpret visual images and use them as prompts.  As AI expert Simon Willison explains on X, Make it Real works by “generating a base64 encoded PNG of the drawn components, then passing that to GPT-4 Vision” with a system prompt and instructions to turn the image into a file using Tailwind. In fact, here is the full system prompt that tells GPT-4V how to handle the inputs and turn them into functioning code:

const systemPrompt = ‘You are an expert web developer who specializes in tailwind css.
A user will provide you with a low-fidelity wireframe of an application.
You will return a single html file that uses HTML, tailwind css, and JavaScript to create a high fidelity website.
Include any extra CSS and JavaScript in the html file.
If you have any images, load them from Unsplash or use solid colored rectangles.
The user will provide you with notes in blue or red text, arrows, or drawings.
The user may also include images of other websites as style references. Transfer the styles as best as you can, matching fonts / colors / layouts.
They may also provide you with the html of a previous design that they want you to iterate from.
Carry out any changes they request from you.
In the wireframe, the previous design’s html will appear as a white rectangle.
Use creative license to make the application more fleshed out.
Use JavaScript modules and unpkg to import any necessary dependencies.’

As more people experiment with GPT-4V and combine it with other frameworks, we’ll likely see more novel applications of OpenAI’s vision-parsing technology emerging in the weeks ahead. Also on Wednesday, a developer used the GPT-4V API to create a live, real-time narration of a video feed by a fake AI-generated David Attenborough voice, which we have covered separately.

For now, it feels like we’ve been given a preview of a possible future mode of software development—or interface design, at the very least—where creating a working prototype is as simple as making a visual mock-up and having an AI model do the rest.

Source: “Make It Real” AI prototype wows devs by turning drawings into working software | Ars Technica

The EU DMA will finally free Windows users from Bing (but not Edge) and allow 3rd parties into the widgets

Posted on by

Microsoft will soon let Windows 11 users in the European Economic Area (EEA) disable its Bing web search, remove Microsoft Edge, and even add custom web search providers — including Google if it’s willing to build one — into its Windows Search interface.

All of these Windows 11 changes are part of key tweaks that Microsoft has to make to its operating system to comply with the European Commission’s Digital Markets Act, which comes into effect in March 2024. Microsoft will be required to meet a slew of interoperability and competition rules, including allowing users “to easily un-install pre-installed apps or change default settings on operating systems, virtual assistants, or web browsers that steer them to the products and services of the gatekeeper and provide choice screens for key services.”

Alongside clearly marking which apps are system components in Windows 11, Microsoft is also responding by adding the ability to uninstall the following apps:

  • Camera
  • Cortana
  • Web Search from Microsoft Bing, in the EEA
  • Microsoft Edge, in the EEA
  • Photos

Only Windows 11 users in the EEA will be able to fully remove Microsoft Edge and the Bing-powered web search from Windows Search. Microsoft could easily extend this to all Windows 11 users, but it’s limiting this extra functionality to EEA markets to comply with the rules. “Windows uses the region chosen by the customer during device setup to identify if the PC is in the EEA,” explains Microsoft in a blog post. “Once chosen in device setup, the region used for DMA compliance can only be changed by resetting the PC.”

In EEA markets — which includes EU countries and also Iceland, Liechtenstein, and Norway — Windows 11 users will also get access to new interoperability features for feeds in the Windows Widgets board and web search in Windows Search. This will allow search providers like Google to extend the main Windows Search interface with their own custom web searches.

[…]

We had hoped Microsoft would finally stop forcing Windows 11 users in Europe into Edge if they clicked a link from the Windows Widgets panel or from search results, but Microsoft appears to have changed exactly how it’s implementing this. The software maker previously said it would start testing a change to Windows 11 that would see “Windows system components use the default browser to open links” in EEA markets, but that change never appeared in Windows Insider builds.

“In the EEA, Windows will always use the customers’ configured app default settings for link and file types, including industry standard browser link types (http, https),” says Microsoft. “Apps choose how to open content on Windows, and some Microsoft apps will choose to open web content in Microsoft Edge.”

[…]

Source: The EU will finally free Windows users from Bing – The Verge

Zimbra email vulnerability let hackers steal gov data – fix (and exploit) was easily visible on repository before updates

Posted on by

Google’s Threat Analysis Group revealed on Thursday that it discovered and worked to help patch an email server flaw used to steal data from governments in Greece, Moldova, Tunisia, Vietnam and Pakistan. The exploit, known as CVE-2023-37580, targeted email server Zimbra Collaboration to pilfer email data, user credentials and authentication tokens from organizations.

It started in Greece at the end of June. Attackers that discovered the vulnerability and sent emails to a government organization containing the exploit. If someone clicked the link while logged into their Zimbra account, it automatically stole email data and set up auto-forwarding to take control of the address.

While Zimbra published a hotfix on open source platform Github on July 5, most of the activity deploying the exploit happened afterward. That means targets didn’t get around to updating the software with the fix until it was too late. It’s a good reminder to update the devices you’ve been ignoring now, and ASAP as more updates become available. “These campaigns also highlight how attackers monitor open-source repositories to opportunistically exploit vulnerabilities where the fix is in the repository, but not yet released to users,” the Google Threat Analysis Group wrote in a blog post.

Around mid-July, it became clear that threat group Winter Vivern got ahold of the exploit. Winter Vivern targeted government organizations in Moldova and Tunisia. Then, a third unknown actor used the exploit to phish for credentials from members of the Vietnam government. That data got published to an official government domain, likely run by the attackers. The final campaign Google’s Threat Analysis Group detailed targeted a government organization in Pakistan to steal Zimbra authentication tokens, a secure piece of information used to access locked or protected information.

Zimbra users were also the target of a mass-phishing campaign earlier this year. Starting in April, an unknown threat actor sends an email with a phishing link in an HTML file, according to ESET researchers. Before that, in 2022, threat actors used a different Zimbra exploit to steal emails from European government and media organizations.

As of 2022, Zimbra said it had more than 200,000 customers, including over 1,000 government organizations. “The popularity of Zimbra Collaboration among organizations expected to have lower IT budgets ensures that it stays an attractive target for adversaries,” ESET researchers said about why attackers target Zimbra.

Source: An email vulnerability let hackers steal data from governments around the world

The Oura Ring Is a $300 Sleep Tracker Suddenly needs a Subscription

Posted on by

[…] Now in its third iteration, the Oura Ring tracks and analyzes a host of metrics, including your heart-rate variability (HRV), blood oxygen rate, body temperature, and sleep duration. It uses this data to give you three daily scores, tallying the quality of your sleep, activity, and “readiness.” It can also determine your chronotype (your body’s natural preferences for sleep or wakefulness), give insight into hormonal factors that can affect your sleep, and (theoretically) alert you when you’re getting sick.

I wore the Oura Ring for six months; it gave me tons of data about myself and helped me pinpoint areas in my sleep and health that I could improve. It’s also more comfortable and discreet to wear than most wristband wearable trackers.

However, the ring costs about $300 or more, depending on the style and finish, and Oura’s app now requires a roughly $72 yearly subscription to access most of the data and reports.

(Oura recently announced that the cost of the ring is eligible for reimbursement through a flexible spending account [FSA] or health spending account [HSA]. The subscription is not.)

If you just want to track your sleep cycles and get tips, a free (or modestly priced) sleep-tracking app may do the trick.

[…]

Source: The Oura Ring Is a $300 Sleep Tracker That Provides Tons of Data. But Is It Worth It? | Reviews by Wirecutter

So what do you get with the membership?

  • In-depth sleep analysis, every morning
  • Personalized health insights, 24/7
  • Live & accurate heart rate monitoring
  • Body temperature readings for early illness detection and period prediction (in beta)
  • Workout Heart Rate Tracking
  • Sp02 Monitoring
  • Rest Mode
  • Bedtime Guidance
  • Track More Movement
  • Restorative Time
  • Trends Over Time
  • Tags
  • Insights from Audio Sessions

And what if you want to continue for free?

Non-paying members have access to 3 simple daily scores: Sleep, Readiness, and Activity, as well as our interactive and educational Explore content.

Source: More power to you with Oura Membership.

This is a pretty stunning turn of events:

one because it was supposed to be the privacy friendly option, so what data are they sending to central servers and why (that’s the only way they can justify a subscription) and

two why is data that doesn’t need to be sent to the servers not being shown in the free version of the app?!

For the price of the ring this is a pretty shameless money grab.

The Netherlands wants EU measures against misleading “discounts” on altered prices

Posted on by

From January 1, 2023, a seller may no longer increase the price of a product for a short period of time, then reduce the price and then present this ‘before’ price as an offer or a significant discount.

Despite this tightening, consumers are still faced with misleading discounts, especially in the run-up to the holidays. Unfortunately, according to the regulator ACM, the new rules are not being sufficiently complied with. In addition, sellers often refer to a suggested retail price when offering offers instead of the original retail price of the product.

That is why Minister Adriaansens is calling for a new EU rule. This should no longer allow companies to mention the suggested retail prices suggested by manufacturers in discount promotions if sellers do not actually use them. The use of completely invented recommended prices is already legally prohibited.

The Netherlands also wants the EU to make it possible for a Member State to ban door sales and/or telemarketing.

[…]

Source: Nederland wil maatregelen tegen misleiding bij kortingen door adviesprijzen – Emerce

Cracking group files SEC complaint on hacked company for failure to disclose breach

Posted on by

affiliates of ransomware gang AlphV (aka BlackCat) claimed to have compromised digital lending firm MeridianLink – and reportedly filed an SEC complaint against the fintech firm for failing to disclose the intrusion to the US watchdog.

First reported by DataBreaches, the break-in apparently happened on November 7. AlphaV’s operatives claimed they did not encrypt any files but did steal some data – and MeridianLink was allegedly aware of the intrusion the day it occurred.

In screenshots shared with The Register and posted on social media, the AlphaV SEC submission claims MeridianLink made a “material misstatement or omission” in its filings and financial statements, “or a failure to file.”

The thoughtful folks at AlphV asserted they are simply filing the paperwork for MeridianLink – and giving it “24 hours before we publish the data in its entirety.”

The Register asked the SEC about the AlphV complaint. “We decline to comment,” the spokesperson replied.

Source: Clorox CISO flushes self after multi-million-dollar attack • The Register

The Epic Vs. Google Courtroom Battle Shows Google Routinely Hiding and Deleting Chats and Documents They Should (legally) Keep

Posted on by

[…] back in 2020 Epic added an option to Fortnite on mobile that let players buy Fortnite’s in-game V-Bucks currency directly from the company at a discount, bypassing both Apple’s and Google’s app store fees. This violated Apple and Google policies Epic agreed to and quickly led to both companies removing Fortnite from their respective mobile phone app stores. That triggered a lawsuit from Epic and led to a protracted 2021 legal fight against Apple over how Apple ran its app store, the monopoly it may have had, and the fees it charged app developers on in-app purchases. And now Epic is waging a similar legal battle against Google.

[…]

As reported by The Verge on November 6, the first day of the trial, Epic was allowed to tell the jury that Google may have destroyed or hidden relevant evidence. And throughout the first six-days of the trial, Epic’s lawyers have continued to bring up how few chatlogs Google provided during discovery and grilled Google execs over deleted chats and jokes about hiding conversations.

On November 7, Google Information Governance Lead Genaro Lopez was questioned multiple times about the seemingly missing chatlogs, and the company’s policy of telling employees to chat “off the record” about sensitive issues that could cause problems later down the line. Epic’s legal team also went after Google’s chat system, which includes a tool that lets its employees prevent chat history from being saved, and pointed out that Google employees were doing this even after a legal hold was put on the company following the Fortnite lawsuit. Asked if Google could have changed this policy and forced chats to be saved, Lopez agreed that it could have been altered, but wasn’t.

“You cannot guarantee that the documents that were destroyed will contradict the testimony we’re going to hear?” asked Epic’s lawyer. Lopez couldn’t make that guarantee.

On November 8, Google Play’s VP of Apps and Games Purnima Kochikar was also questioned about deleted chats and explained that the court won’t ever see her chat logs.

“During this case, you had your default setting to delete chats every 24 hours, correct?” Epic’s legal team asked.

“That was the default,” Kochikar said. She also confirmed she didn’t take any steps to change this setting.

An image shows characters from Fortnite in front of a yellow background.
Image: Epic Games

On November 9, some saved chat messages from Google’s head of platforms & ecosystems strategy for Android, Margaret Lam, showed her directly asking someone to turn off chat history due to “sensitivity with legal these days :)”.

Lam claimed in court that no Google attorney had briefed her on preserving chats during Epic’s legal hold. However, Epic’s lawyers weren’t done, and continued to show messages in which Lam asked people to turn off chat history. The Verge reports that one of these situations included a colleague pushing back and insisting that he was on a legal hold. In response, Lam messaged: “Ok maybe I take you off this convo :)”.

At another point, Lam messaged someone else: “also just realized our history is on 🙊 can we turn it off? Haha”.

Lam did push back, claiming that she went to legal for better advice after these conversations and now understands she failed to comply with the legal hold.

Then on November 13, James Kolotouros, VP of Android platform partnerships, admitted that he can’t remember a single instance when he might have turned on his chat history.

Google’s CEO wasn’t saving evidence, either

And today, during Google CEO Sundar Pichai’s time on the stand, Epic was able to get him to confirm that he also wasn’t saving his chats, letting messages auto-delete after 24 hours. Epic also showed evidence of Pichai asking for chat history to be turned off and then trying to delete that message, though the Google CEO claimed that was a glitch.

Not only that, Pichai confirmed that he has in the past marked documents with attorney/client privilege even when he was not seeking legal advice just so those emails didn’t get forwarded. Pichai told Epic’s lawyers that nobody told him that was wrong, though he now admits that he shouldn’t have done that.

Epic’s goal for all of this has been to show that Google might have been deleting chats or hiding evidence. That would help it make the case to the jury that the Android platform creator is trying to avoid creating a legal paper trail which could imply the company has something to hide from the court. That in turn makes Google seem less trustworthy and helps color all of its actions in a different light, something that could ultimately swing a jury one way or the other.

Regardless of if the jury cares about what has happened, the judge in the case very much seems to. Judge James Donato appears so fed up with the situation that on November 13, he demanded that Google’s chief legal officer show up in court by November 16 to explain what’s going on. If he doesn’t show or can’t give a good enough reason for why so much evidence was seemingly destroyed, the judge is considering instructing the jury to not trust Google as much as they might have before.

Needless to say, such a turn would not be good for Google’s fortunes in its continuing proceedings with Epic.

Source: The Epic Vs. Google Courtroom Battle Sounds Bonkers

Rivian update bricks infotainment – corp comms quickly and publicly on Reddit

Posted on by

Hi All,

We made an error with the 2023.42 OTA update – a fat finger where the wrong build with the wrong security certificates was sent out. We cancelled the campaign and we will restart it with the proper software that went through the different campaigns of beta testing.

Service will be contacting impacted customers and will go through the resolution options. That may require physical repair in some cases.

This is on us – we messed up. Thanks for your support and your patience as we go through this.

* Update 1 (11/13, 10:45 PM PT): The issue impacts the infotainment system. In most cases, the rest of the vehicle systems are still operational. A vehicle reset or sleep cycle will not solve the issue. We are validating the best options to address the issue for the impacted vehicles. Our customer support team is prioritizing support for our customers related to this issue. Thank you.

*Update 2 (11/14, 11:30 AM PT): Hi all, As I mentioned yesterday, we identified an issue in our recent software update 2023.42.0 that impacted the infotainment system on a number of R1T and R1S vehicles. In most cases, the rest of the vehicle systems and the mobile app will remain functional. If you’re an impacted owner, you should have received an email and a text communication. We understand that this is frustrating and we are really sorry for this inconvenience. The team continues to actively work on the best possible solution to fix the impacted vehicles, and we will keep the community updated. In the meantime, our Service team is prioritizing this issue and you can reach out to them at 1-855-748-4265.

*Update 3 (11/14, 7 PM PT): We just emailed the impacted owners with next steps. The team managed to build a solution, and we will start rolling it out tomorrow.

*Update 4 (11/15 11:30 AM PT): the team has been able to build a solution that fixes the issue remotely. Roll out starting today. Thanks to the community for the support.

Source: 2023.42 OTA Update Issue : Rivian

As far as I am concerned well done – everyone was kept informed and a tough problem to fix was rolled out fairly quickly. Mistakes happen everywhere, so it’s more important that they are fixed and that people are informed.

It does, however, highlight the security issues of automatic updates.