Monthly Archives: April 2024

Critical bugs in LG TVs could allow complete device takeover

Posted on by

A handful of bugs in LG smart TVs running WebOS could allow an attacker to bypass authorization and gain root access on the device.

Once they have gained root, your TV essentially belongs to the intruder who can use that access to do all sorts of nefarious things including moving laterally through your home network, dropping malware, using the device as part of a botnet, spying on you — or at the very least severely screwing up your streaming service algorithms.

Bitdefender Labs researcher Alexandru Lazăr spotted the four vulnerabilities that affect WebOS versions 4 through 7. In an analysis published today, the security firm noted that while the vulnerable service is only intended for LAN access, more than 91,000 devices are exposed to the internet, according to a Shodan scan.

Here’s a look at the four flaws:

  • CVE-2023-6317: a PIN/prompt bypass that allows an attacker to set a variable and add a new user account to the TV without requiring a security PIN. It has a CVSS rating of 7.2.
  • CVE-2023-6318: a critical command injection flaw with a 9.1 CVSS rating that allows an attacker to elevate an initial access to root-level privileges and take over the TV.
  • CVE-2023-6319: another 9.1-rated command injection vulnerability that can be triggered by manipulating the music-lyrics library.
  • CVE-2023-6320: a critical command injection vulnerability that can be triggered by manipulating an API endpoint to allow execution of commands on the device as dbus, which has similar permissions as root. It also received a 9.1 CVSS score.

In order to abuse any of the command injection flaws, however, the attacker must first exploit CVE-2023-6317. This issue is down to WebOS running a service on ports 3000/3001 that allows users to control their TV on their smartphone using a PIN. But, there’s a bug in the account handler function that sometimes allows skipping the PIN verification:

The function that handles account registration requests uses a variable called skipPrompt which is set to true when either the client-key or the companion-client-key parameters correspond to an existing profile. It also takes into consideration what permissions are requested when deciding whether to prompt the user for a PIN, as confirmation is not required in some cases.

After creating an account with no permissions, an attacker can then request a new account with elevated privileges “but we specify the companion-client-key variable to match the key we got when we created the first account,” the team reports.

The server confirms that the key exists, but doesn’t verify which account it belongs to, we’re told. “Thus, the skipPrompt variable will be true and the account will be created without requesting a PIN confirmation on the TV,” the team reports

And then, after creating this account with elevated privileges, an attacker can use that access to exploit the other three flaws that lead to root access or command execution as the dbus user.

Lazăr responsibly reported the flaws to LG on November 1, 2023, and LG asked for a time extension to fix them. The electronics giant issued patches on March 22. It’s a good idea to check your TV for software updates and apply the WebOS patch now.

Source: Critical bugs in LG TVs could allow complete device takeover

Dutch investigation into Android smartphones leads to new lawsuit against Google Play Services Constant Surveillance

Posted on by

The Mass Damage & Consumer Foundation today announced that it has initiated a class action lawsuit against Google over its Android operating system. The reason is a new study that shows how Dutch Android smartphones systematically transfer large amounts of information about device use to Google. Even with the most privacy-friendly options enabled, user data cannot be prevented from ending up on Google’s servers. According to the foundation, this is not clear to Android users, let alone whether they have given permission for this.

For the research, a team of scientists purchased several Android phones between 2022 and 2024 and captured, decrypted and analyzed the outgoing traffic on a Dutch server. This shows that a bundle of processes called ‘Google Play Services’ runs silently in the background and cannot be disabled or deleted. These processes continuously record what happens on and around the phone. For example, Google shares which apps someone uses, products they order and even whether users are sleeping.

More than nine million Dutch people

The Mass Damage & Consumer Foundation states that Google’s conduct violates a large number of Dutch and European rules that must protect consumers. The foundation wants to use a lawsuit to force Google to implement fundamental (privacy) changes to the Android platform and to offer an opt-out option for every form of data it collects, not just a few.

[…]

Identity can be easily traced

The research paid specific attention to the use of unique identifiers (UIDs). These are characteristics that Google can link to the collected data, such as an e-mail address or Android ID, a unique serial number with which someone is known to Google. The use of these features is sensitive. For example, Google advises against the use of unique features in its own guidelines for app developers: users could unintentionally be tracked across multiple apps. However, one or more of these unique features were found in the data transmissions examined – without exception. The researchers point out that this makes it easy to trace someone’s identity to virtually everything that happens on and around an Android device.

[…]

Source: Dutch investigation into Android smartphones leads to new lawsuit against Google – Mass Damage & Consumer Foundation

Long covid linked to signs of ongoing inflammatory responses in blood

Posted on by

People who develop long covid after being hospitalised with severe covid-19 have raised levels of many inflammatory immune molecules compared with those who recovered fully after such a hospitalisation, according to a study of nearly 700 people.

The findings show that long covid has a real biological basis, says team member Peter Openshaw at Imperial College London. “People are not imagining it,” he says. “It’s genuinely happening to them.”

[…]

The study by Liew and her colleagues involved measuring the levels of 368 immune molecules in the blood of 659 people who were hospitalised with covid-19, mostly early on in the pandemic. The 426 people who were still reporting symptoms more than three months later were compared with the 233 who reported being fully recovered.

The study found that the patterns of immune activation reflected the main kinds of symptoms people with long covid reported. The five main symptom types were fatigue; cognitive impairment; anxiety and depression; cardiorespiratory symptoms; and gastrointestinal symptoms.

For instance, people with gastrointestinal symptoms had higher blood levels of SCG3, a signalling protein that is also elevated in the faeces of people with irritable bowel syndrome.

The findings won’t help with diagnosing whether people have long covid or not, says team member Chris Brightling at the University of Leicester in the UK. But once the condition has been diagnosed, testing for these molecules could help reveal what kind of long covid people have, and thus what kind of interventions might help, he says.

A study last year estimated that 36 million people in Europe had or have long covid. “Many people are still suffering,” says Brightling.

[…]

Journal reference:

Nature Immunology DOI: 10.1038/s41590-024-01778-0

Source: Long covid linked to signs of ongoing inflammatory responses in blood | New Scientist

Breaking out of kiosk environments using keyboard media buttons via a BadUSB type attack

Posted on by

In early 2023 an awesome colleague (Andreas) spoke about an incident response case featuring thugs plugging a media keyboard into an ATM, and breaking out of its ATM kiosk software to install malware causing it to dispense $$$. This prompted me to spend some time during spring and summer of 2023 looking into Consumer Control, a subset of USB functionality, which is what allows media keyboards to launch and control various applications over USB with the press of single buttons; so called Consumer Control Buttons (CCBs). This writeup describes my research on the matter, and what I have nicknamed the USB HID & Run attack (credit to Roman for helping out with the name).

[…]

An attacker with access to the USB port of the kiosk, could potentially leverage this access to break out of the kiosk using keyboard shortcuts or CCBs.

[…]

Attacks on kiosks often focus on breaking out of the kiosk model to perform other actions on the underlying systems. Typical means of achieving this, either in the case of a kiosk equipped with a keyboard or with an on-screen keyboard, is to leverage either operating system-specific or application-specific keyboard shortcuts to trigger an event exposing unintended functionality. Examples of this include:

  • Leveraging built-in Windows shortcuts (e.g. Win+E to launch the File Explorer).
  • Leveraging application-specific shortcuts (e.g. ctrl+p which in many applications opens a print dialog from which the underlying file system can be reached).
  • Going completely bananas and doing “weird shit” with the hope of triggering an error that can be leveraged to access further functionality.

Often times, access to the underlying file system is enough to execute arbitrary code on the system. While details of this is beyond the scope of this project, Windows-based readers are encouraged to pause momentarily and do the following:

  • Press Win+E
  • Press ctrl+l
  • Type cmd
  • Press enter

Now imagine this was a kiosk instead, and you hopefully get the concept. Congratulations, you are now a computer hacker with the ability to execute arbitrary code on the system.

For kiosks that are not equipped with either a physical or on-screen keyboard, this becomes much more difficult. However, with physical access to a USB port, you can plug in your own keyboard and do the same thing.

A plethora of resources exist on the matter of breaking out of kiosks, documenting many of the methods I have used myself on real assessments. [1] is a generic but comprehensive resource, and [2] is a more in-depth article written by a kiosk lockdown software manufacturer that even goes into great detail on physical USB attacks. However, the topic of CCBs is not covered.

[…]

Media Keyboards and USB

What sets media keyboards apart from traditional keyboards is the presence of keys that automagically launch a new application, or control elements of a currently running application.

[…]

Manufacturers can choose to include these keys to for example launch a local file explorer, a web browser or a calculator application; all through USB.

[…]

The functionality that USB HID vendors can include in their devices is defined in the USB HID Usage Tables for USB document [7].

[…]

The Consumer Page of the USB HID usage tables [7, Ch. 15] defines multiple usage names. The following two look especially interesting:

  • Application Launch Buttons, used to launch applications (configured by the operating system vendor, e.g. Microsoft)
  • Generic GUI Application Controls, used to replicate control actions found in typical GUI applications such as pressing buttons and scrolling

[…]

In order to address the first objective set out by this project, I had to be able to send USB CCBs. As it would turn out, implementation of a "media keyboard" capable of sending arbitrary CCBs was trivial using a Teensyduino [10].

[…]

The following is a simple proof of concept, showcasing some interesting CCBs enabled by default in Windows 10 and 11.

/* 
Simple CCB cycling example wherein the Teensyduino becomes a USB media keyboard and cycles through CCBs that have an action in Windows 10/11.
Values for keypresses are taken from the USB HID Class specification.
Before compiling, select "Keyboard" from the "Tools > USB Type" menu.
*/

void setup() {
}

void loop() {
    Keyboard.press(( 0x183 | 0xE400 )); // Default media player
    Keyboard.release(( 0x183 | 0xE400 ));
    delay(500);
    
    Keyboard.press(( 0x18A | 0xE400 )); // Default email client
    Keyboard.release(( 0x18A | 0xE400 ));
    delay(500);

    Keyboard.press(( 0x192 | 0xE400 )); // Pop calc!
    Keyboard.release(( 0x192 | 0xE400 ));
    delay(500);

    Keyboard.press(( 0x194 | 0xE400 )); // File Explorer (This PC)
    Keyboard.release(( 0x194 | 0xE400 ));
    delay(500);

    Keyboard.press(( 0x223 | 0xE400 )); // Microsoft Edge
    Keyboard.release(( 0x223 | 0xE400 ));
    delay(500);
}

Compiling and uploading the above code to the Teensyduino board and subsequently plugging it into the USB port of a computer running a fresh Windows 10 launched the applications indicated by the comments in the code. That’s right, we just popped calc using CCBs. Note that these specific keys are the same as those defined in [9].

A small side note here is that I tried this using both a Teensyduino 2.0 and 3.2, they both work. However, I could only the latter of them to spoof Vendor ID and Product ID.

Distinguishing CCBs From Windows Keyboard Shortcuts

Equipped with the ability to send arbitrary CCBs using a Teensyduino, I set out to find out if CCBs are inherently different from builtin keyboard shortcuts in Windows, aiming to fulfill the second objective. To verify this, I disabled Windows keyboard shortcuts with the following command:

reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoWinKeys /t REG_DWORD /d 1 /f

After rebooting the machine for the registry change to take effect, I plugged in the Teensyduino. Lo and behold, Keyboard.press(( 0x194 | 0xE400 )); caused This PC to pop up, whereas Win+E did nothing (except put a smile on my face).

[…]

The following is a list of systems/devices I have experimented on with CCBs, with limited success:

  • Windows 10/11 single-app kiosk [11]: CCBs seem to have no effect in a kiosk with Microsoft Edge
  • Windows 10/11 digital signage mode [12]: The key AC Home (0x223) opens up an InPrivate window
  • Various Samsung TVs: Possible to open and navigate the menu using CCBs

Additionally, I recently had the opportunity to experiment with an Android-based meeting room controller. With a regular keyboard, I was unable to perform any unintended action. However, when using CCBs (specifically the keys AL Contacts/Address Book (0x18D), AL Calendar/Schedule (0x18E), and AL Internet Browser (0x196)), I observed that they triggered the launch of the Android Contacts application, the Android Calendar application, and the default Internet browser of the tablet.

[…]

Source: USB Hid And Run | Github

Also: USB Consumer Control – POC for Flipper | Github

Russia accused of using chemical gas attacks against Ukrainian soldiers

Posted on by

[…] Ukrainian troops told the Daily Telegraph that they have been subjected to regular attacks from small drones dropping teargas and other chemicals.

The use of such substances, which is known as CS, is banned during wartime under the Chemical Weapons Convention.

Moscow was accused of using chemical weapons in a drone assault on the port of Mariupol in the early stages of its invasion in February 2022.

Slava, a senior lieutenant whose unit is deployed near Lyman, in Donetsk oblast, said some Ukrainian units in his area were coming under “almost daily” gas attacks.

A CS gas grenade was provided to the Telegraph for verification by Rebekah Maciorowski, an American combat medic and a qualified nurse serving in the Ukrainian army.

Maciorowski has been routinely called to provide medical aid to Ukrainian soldiers in the three brigades she works with in Donetsk oblast after chemical weapon attacks, which she described as “systematic”.

The grenade was originally retrieved by soldiers in the 53rd Mechanised Brigade, one of the units with which she works.

Maciorowski said: “My guys retrieved it while under fire because nobody believed they were being attacked with chemical weapons.”

Ihor, the commander of a Ukrainian reconnaissance team deployed near the frontline city of Chasiv Yar, in Donetsk oblast, told the Telegraph: “Nearly every position in our area of the front was getting one or two gas grenades dropped on them a day.”

[…]

Source: Russia accused of using chemical gas attacks against Ukrainian soldiers | Russia | The Guardian

OpenAI and Google train AIs on transcriptions of YouTube videos – YouTube and NYTimes desperately try to profit somehow without doing anything except lawsuit

Posted on by

OpenAI and Google trained their AI models on text transcribed from YouTube videos, potentially violating creators’ copyrights, according to The New York Times.

Note – the New York Times is embroiled in copyright lawsuits over AI, where they clearly show they don’t understand that an AI reading content is the same as a person reading content; that content being offered up for free with no paywall is free for everyone and that entering content and then asking for it back doesn’t mean that copyright is infringed.

[…]

It comes just days after YouTube CEO Neal Mohan said in an interview with Bloomberg Originals that OpenAI’s alleged use of YouTube videos to train its new text-to-video generator, Sora, would go against the platform’s policies.

According to the NYT, OpenAI used its Whisper speech recognition tool to transcribe more than one million hours of YouTube videos, which were then used to train GPT-4. The Information previously reported that OpenAI had used YouTube videos and podcasts to train the two AI systems. OpenAI president Greg Brockman was reportedly among the people on this team. Per Google’s rules, “unauthorized scraping or downloading of YouTube content” is not allowed

[…]

The way the data is stored in an ML model means that the data is not scraped or downloaded – unless you consider every view downloading or scraping though.

What this shows is a determination to ride the AI hype and find a way to monetise content that has already been released into the public domain without any extra effort apart from hiring a bunch of lawyers. The players are big and the payoff is potentially huge in terms of cash, but in terms of setting back progress, throwing everything under the copyright bus is a staggering disaster.

Source: OpenAI and Google reportedly used transcriptions of YouTube videos to train their AI models

Academics Try to Figure Out Apple’s default apps Privacy Settings and Fail

Posted on by

A study has concluded that Apple’s privacy practices aren’t particularly effective, because default apps on the iPhone and Mac have limited privacy settings and confusing configuration options.

The research was conducted by Amel Bourdoucen and Janne Lindqvist of Aalto University in Finland. The pair noted that while many studies had examined privacy issues with third-party apps for Apple devices, very little literature investigates the issue in first-party apps – like Safari and Siri.

The aims of the study [PDF] were to investigate how much data Apple’s own apps collect and where it’s sent, and to see if users could figure out how to navigate the landscape of Apple’s privacy settings.

[…]

“Our work shows that users may disable default apps, only to discover later that the settings do not match their initial preference,” the paper states.

“Our results demonstrate users are not correctly able to configure the desired privacy settings of default apps. In addition, we discovered that some default app configurations can even reduce trust in family relationships.”

The researchers criticize data collection by Apple apps like Safari and Siri, where that data is sent, how users can (and can’t) disable that data tracking, and how Apple presents privacy options to users.

The paper illustrates these issues in a discussion of Apple’s Siri voice assistant. While users can ostensibly choose not to enable Siri in the initial setup on macOS-powered devices, it still collects data from other apps to provide suggestions. To fully disable Siri, Apple users must find privacy-related options across five different submenus in the Settings app.

Apple’s own documentation for how its privacy settings work isn’t good either. It doesn’t mention every privacy option, explain what is done with user data, or highlight whether settings are enabled or disabled. Also, it’s written in legalese, which almost guarantees no normal user will ever read it.

[…]

The authors also conducted a survey of Apple users and quizzed them on whether they really understood how privacy options worked on iOS and macOS, and what apps were doing with their data.

While the survey was very small – it covered just 15 respondents – the results indicated that Apple’s privacy settings could be hard to navigate.

Eleven of the surveyed users were well aware about data tracking and that it was mostly on by default. However, when informed about how privacy options work in iOS and macOS, nine of the surveyed users were surprised about the scope of data collection.

[…]

Users were also tested on their knowledge of privacy settings for eight default apps – including Siri, Family Sharing, Safari, and iMessage. According to the study, none could confidently figure out how to work their way around the Settings menu to completely disable default apps. When confused, users relied on searching the internet for answers, rather than Apple’s privacy documentation.

[…]

Assuming Apple has any interest in fixing these shortcomings, the team made a few suggestions. Since many users first went to operating system settings instead of app-specific settings when attempting to disable data tracking, a change could assist users. Centralizing these options would also prevent users from getting frustrated and giving up on finding the settings they’re looking for.

Informing users what specific settings do would also be an improvement – many settings are labelled with just a name, but no further details. The researchers suggest replacing Apple’s jargon-filled privacy policy with descriptions that are in the settings menu itself, and maybe even providing some infographic illustrations as well. Anything would be better than legalese.

While this study probably won’t convince Apple to change its ways, lawsuits might have better luck. Apple has been sued multiple times for not transparently disclosing its data tracking. One of the latest suits calls out Apple’s broken promises about privacy, claiming that “Apple does not honor users’ requests to restrict data sharing.”

[…]

Reminder: Apple has a multi-billion-dollar online ads business that it built while strongly criticizing Facebook and others for their privacy practices.

Source: Academics reckon Apple’s default apps have privacy pitfalls • The Register

Roku’s New Idea to Show You Ads When You Pause Your Video Game and spy on the content on your hdmi cable Is Horrifying

Posted on by

[…]

Roku describes its idea in a patent application, which largely flew under the radar when it was filed in November, and was recently spotted by the streaming newsletter Lowpass. In the application, Roku describes a system that’s able to detect when users pause third-party hardware and software and show them ads during that time.

According to the company, its new system works via an HDMI connection. This suggests that it’s designed to target users who play video games or watch content from other streaming services on their Roku TVs. Lowpass described Roku’s conundrum perfectly:

“Roku’s ability to monetize moments when the TV is on but not actively being used goes away when consumers switch to an external device, be it a game console or an attached streaming adapter from a competing manufacturer,” Janko Roettgers, the newsletter’s author, wrote. “Effectively, HDMI inputs have been a bit of a black box for Roku.”

In addition, Roku wouldn’t just show you any old ads. The company states that its innovation can recognize the content that users have paused and deliver customized related ads. Roku’s system would do this by using audio or video-recognition technologies to analyze what the user is watching or analyze the content’s metadata, among other methods.

[…]

In the case of gaming, there’s also the danger of Roku mistaking a long moment of pondering for a pause and sticking an ad right when you’re getting ready to face the final boss. The company is aware of this potential failure and points out that its system will monitor the frames of the content being watched to ensure there was a phase. It also plans on using other methods, such as analyzing the audio feed on the TV for extended moments of silence, to confirm there has been a pause.

[…]

Source: Roku’s New Idea to Show You Ads When You Pause Your Video Game Is Horrifying

It’s Not Just You, Google Pixels Are Glitching Right Now

Posted on by

[…] As reported by Android Authority, more and more users are complaining about their Pixel phones not working as, well, phones. Users will miss phone calls entirely, and only notice after they see the call went directly to voicemail, while text messages don’t appear as they’re received, but rather pop in all at once in batches. It’s affecting multiple types of Pixel, as well, including Pixel 7a, Pixel 7, Pixel 7 Pro, Pixel 8, and Pixel 8 Pro.

In a Google Support thread about the issue, users blame the March 2024 update for causing this chaos, and suggest the April 2024 update didn’t include a patch for it, either. (It isn’t present in the release notes.) One alleges this update somehow messed with the phone’s IMS (IP Multimedia Subsystem), which is responsible for powering different communication standards on the Pixel. One commenter goes so far as to say the SMS issues have nearly driven them to iPhone, saying, “Google – are you getting the message?”

We don’t know exactly what is causing this network issue with Pixel, and it’s not affecting each and every Pixel user, as this Android Police commenter would like readers to know. But there are enough Pixel devices experiencing network problems around the world that this seems to be an issue Google can address.

[…]

it seems like the only temporary workaround is to toggle wifi off and on again, to essential toggle wifi calling off and on again as well. Reports suggest the workaround will allow calls and texts through as normal, but only temporarily, as the issue does seem to come back in time.

Source: It’s Not Just You, Google Pixels Are Glitching Right Now | Lifehacker

Ubisoft At The Center Of A Fight To Stop Online Game Shutdowns – help out yourself

Posted on by

In an increasingly digital age, owning media outright has become less and less possible. Whether it’s movies, music, books, or video games, the pivot to digital has made it harder for consumers to own permanent, physical copies of their favorite pieces of media. In video games, myriad titles that players have spent time and money on have been taken offline by publishers, never to be played again. Legislation around this is spotty worldwide, and some companies have gotten away with raking in consumer money just to pull the plug on a game months or years down the line. However, YouTube channel Accursed Farms is starting a coordinated campaign to force stronger legislation against this practice, with Ubisoft’s racing game The Crew at the center of it.

The growing lack of ownership in video games

Ross Scott, who runs Accursed Farms, posted a 31-minute video on the channel, which outlines the problem and how he believes drawing attention to The Crew’s April 1 shutdown could cause governments to enact greater consumer protections for people who purchase online games. As laid out in the video, consumer rights for these situations vary in different countries. France, however, has some pretty robust consumer laws, and Ubisoft is based there.

“This isn’t really about The Crew or even Ubisoft,” Scott says in the video. “It’s about trying to find a weak link in the industry so governments can examine this practice to stop publishers from destroying our games.”

Accursed Farms

According to a since-deleted blog post by Ubisoft, The Crew had over 12 million players before it was delisted in December of last year. Even if most of those people weren’t actively playing the game by the end of its lifetime, that still means that millions of copies of the game were sold—zero of which can be played today. This has become pretty common practice for a lot of online games from some of the biggest companies in the industry, like when Square Enix shut down Final Fantasy VII: The First Soldier in January 2023 or Electronic Arts sunsetting the mobile version of Apex Legends the following May. However, Scott hypothesizes that players don’t form substantial collective action to save these games because, by the time a company makes a decision to shut a game down, most of its player base has already moved on. This is why he’s formed the Stop Killing Games initiative, which is attempting to rally concerned video game fans into pushing local governments to examine the situation with The Crew. The hope is that this can spark broader change.

How the Stop Killing Games initiative is coordinating action

The Stop Killing Games website includes step-by-step instructions for different countries and regions on how to support the cause, whether by contacting local representatives and government bodies or just spreading the word.

[…]

The Stop Killing Games’ end goal is that governments will implement legislation to ensure the following:

  • Games sold must be left in a functional state
  • Games sold must require no further connection to the publisher or affiliated parties to function
  • The above also applies to games that have sold microtransactions to customers
  • The above cannot be superseded by end user license agreements

As Scott lays out, the ideal outcome is that legislation will require online games to be run on player-hosted servers after developers stop supporting it, rather than publishers shouldering the burden of hosting servers internally. This is often a leading cause for games and services being shut down.

[…]

Ubisoft’s director of subscriptions, Philippe Tremblay, recently said the company wants players to be more comfortable not owning the games they buy the same way people have grown accustomed to not owning albums on Spotify or films on Netflix:

One of the things we saw is that gamers are used to, a little bit like DVD, having and owning their games. That’s the consumer shift that needs to happen. They got comfortable not owning their CD collection or DVD collection. That’s a transformation that’s been a bit slower to happen [in games]. As gamers grow comfortable in that aspect… you don’t lose your progress. If you resume your game at another time, your progress file is still there. That’s not been deleted. You don’t lose what you’ve built in the game or your engagement with the game. So it’s about feeling comfortable with not owning your game.

Source: Ubisoft At The Center Of A Fight To Stop Online Game Shutdowns

Window coating blocks sun heat from any angle but not view

Posted on by

Windows welcome light into interior spaces, but they also bring in unwanted heat. A new window coating blocks heat-generating ultraviolet and infrared light and lets through visible light, regardless of the sun’s angle. The coating can be incorporated onto existing windows or automobiles and can reduce air-conditioning cooling costs by more than one-third in hot climates.

[…]

Window coatings used in many recent studies are optimized for light that enters a room at a 90-degree angle. Yet at noon, often the hottest time of the day, the sun’s rays enter vertically installed windows at oblique angles.

Luo and his postdoctoral associate Seongmin Kim previously fabricated a transparent window coating by stacking ultra-thin layers of silica, alumina and titanium oxide on a glass base. A micrometer-thick silicon polymer was added to enhance the structure’s cooling power by reflecting thermal radiation through the atmospheric window and into outer space.

Additional optimization of the order of the layers was necessary to ensure the coating would accommodate multiple angles of solar light.

[…]

Their model produced a coating that both maintained transparency and reduced temperature by 5.4 to 7.2 degrees Celsius in a model room, even when light was transmitted in a broad range of angles. The lab’s results were recently published in Cell Reports Physical Science.

[…]

Story Source:

Materials provided by University of Notre Dame. Original written by Karla Cruise. Note: Content may be edited for style and length.

Journal Reference:

  1. Seongmin Kim, Serang Jung, Alexandria Bobbitt, Eungkyu Lee, Tengfei Luo. Wide-angle spectral filter for energy-saving windows designed by quantum annealing-enhanced active learning. Cell Reports Physical Science, 2024; 5 (3): 101847 DOI: 10.1016/j.xcrp.2024.101847

Source: Sunrise to sunset, new window coating blocks heat — not view | ScienceDaily

Stanford: Biomarkers predict weight loss on either low carb or low fat diet (one of these will work best for you) – suggest personalized diets

Posted on by

Strictly following a diet – either healthy low-carb or healthy low-fat – was what mattered for short-term weight loss during the first six months. But people who maintained long-term weight loss for a year ate the same number of calories as those who regained weight or who did not lose weight during the second six months.

So what explains this difference?

According to the study, the bacteria living in your gut and the amounts of certain proteins your body makes can affect your ability to sustain weight loss. And some people, it turns out, shed more pounds on low-fat diets while others did better on low-carb diets.

Stanford Medicine researchers have identified several biomarkers that predict how successful an individual will be at losing weight and keeping it off long-term. These biomarkers include signatures from the gut microbiome, proteins made by the human body and levels of exhaled carbon dioxide. The researchers published their findings in Cell Reports Medicine Dec. 13.

[…]

The study showed that just cutting calories or exercising were not enough to sustain weight loss over a year. To try and understand why, the team turned their focus to biomarkers of metabolism.

[…]

Throughout the study, the researchers measured the ratio of inhaled oxygen to exhaled carbon dioxide, known as a respiratory quotient, which serves as a proxy for whether carbohydrates or fats are the body’s primary fuel. A lower ratio means the body burns more fat, while a higher ratio means it burns more carbohydrates. So, those who started the diet with a higher respiratory quotient lost more weight on a low-carb diet.

“There are people who can be eating very few calories but still sustain their weight because of how their bodies metabolize fuels. It is not for lack of will: It is just how their bodies work,” Perelman said.

In other words, if your body prefers carbs and you’re predominately eating fat, it will be much harder to metabolize and burn off those calories.

[…]

tracking amounts of certain gut microbe strains will be a way for people to determine which diets are best for weight loss.

We’re not there yet, so until then, according to the researchers, the focus should be on eating high-quality foods that are unprocessed and low in refined flours and sugar.

The research team identified specific nutrients that were correlated with weight loss during the first six months. Low-carb diets should be based on monounsaturated fats — such as those that come from avocados, rather than bacon — and high in vitamins K, C and E. These vitamins are in vegetables, nuts, olives, and avocados. Low-fat diets should be high in fiber, such as is found in whole grains and beans, and avoid added sugars.

“Your mindset should be on what you can include in your diet instead of what you should exclude,” Perelman said. “Figure out how to eat more fiber, whether it is from beans, whole grains, nuts or vegetables, instead of thinking you shouldn’t eat ice cream. Learn to cook and rely less on processed foods. If you pay attention to the quality of food in your diet, then you can forget about counting calories.”

Source: Biomarkers predict weight loss, suggest personalized diets – Scope

Google will delete data collected from private browsing

Posted on by

In hopes of settling a lawsuit challenging its data collection practices, Google has agreed to destroy web browsing data it collected from users browsing in Chrome’s private modes – which weren’t as private as you might have thought.

The lawsuit [PDF], filed in June, 2020, on behalf of plaintiffs Chasom Brown, Maria Nguyen, and William Byatt, sought to hold Google accountable for making misleading statements about privacy.

[…]

“Despite its representations that users are in control of what information Google will track and collect, Google’s various tracking tools, including Google Analytics and Google Ad Manager, are actually designed to automatically track users when they visit webpages – no matter what settings a user chooses,” the complaint claims. “This is true even when a user browses in ‘private browsing mode.'”

Chrome’s Incognito mode only provides privacy in the client by not keeping a locally stored record of the user’s browsing history. It does not shield website visits from Google.

[…]

During the discovery period from September 2020 through March 2022, Google produced more than 5.8 million pages of documents. Even so, it was sanctioned nearly $1 million in 2022 by Magistrate Judge Susan van Keulen – for concealing details about how it can detect when Chrome users employ Incognito mode.

What the plaintiffs’ legal team found might have been difficult to explain at trial.

“Google employees described Chrome Incognito Mode as ‘misleading,’ ‘effectively a lie,’ a ‘confusing mess,’ a ‘problem of professional ethics and basic honesty,’ and as being ‘bad for users, bad for human rights, bad for democracy,'” according to the declaration [PDF] of Mark C Mao, a partner with the law firm of Boies Schiller Flexner LLP, which represents the plaintiffs.

[…]

On December 26 last year the plaintiffs and Google agreed to settle the case. The plaintiffs’ attorneys have suggested the relief provided by the settlement is worth $5 billion – but nothing will be paid, yet.

The settlement covers two classes of people: one of which excludes those using Incognito mode while logged into their Google Account:

  • Class 1: All Chrome browser users with a Google account who accessed a non-Google website containing Google tracking or advertising code using such browser and who were (a) in “Incognito mode” on that browser and (b) were not logged into their Google account on that browser, but whose communications, including identifying information and online browsing history, Google nevertheless intercepted, received, or collected from June 1, 2016 through the present.
  • Class 2: All Safari, Edge, and Internet Explorer users with a Google account who accessed a non-Google website containing Google tracking or advertising code using such browser and who were (a) in a “private browsing mode” on that browser and (b) were not logged into their Google account on that browser, but whose communications, including identifying information and online browsing history, Google nevertheless intercepted, received, or collected from June 1, 2016 through the present.

The settlement [PDF] requires that Google: inform users that it collects private browsing data, both in its Privacy Policy and in an Incognito Splash Screen; “must delete and/or remediate billions of data records that reflect class members’ private browsing activities”; block third-party cookies in Incognito mode for the next five years (separately, Google is phasing out third-party cookies this year); and must delete the browser signals that indicate when private browsing mode is active, to prevent future tracking.

[…]

The class of affected people has been estimated to number about 136 million.

 

Source: Google will delete data collected from private browsing • The Register

10 second Euro Instant payments now mandatory in NL

Posted on by

It will become mandatory for payment service providers, such as banks, that offer standard credit transfers in euros to offer the sending and receipt of instant payments in euros. The regulation relating to this has now been published.

Thanks to the regulation, people will be able to transfer money within 10 seconds at any time of the day.

The situation varies widely from Member State to Member State as regards the availability of instant payments and any associated fees. At the beginning of 2022, only 11 percent of all euro transfers in the EU were instant.

On October 26, 2022, the European Commission presented a proposal for a regulation on instant payments in euros. With the proposal, the Commission fulfilled a key commitment in the Commission’s 2020 Retail Payments Strategy.

The regulation provides for a longer transition period for countries outside the eurozone, as they need more time to adapt to the new rules.

Source: Instant payments in euros now mandatory – Emerce

It’s pretty silly that it’s 2024 and only now are database bits being forced to flip within 10 seconds, but that shows how long overdue this kind of regulation is.

The Digital Identity Wallet approved by parliament and council

Posted on by

On the 28th February, The European Parliament gave its final approval to the Digital Identity Regulation, with 335 votes to 190, with 31 abstentions. It was adopted by the EU Council of Ministers on 26th of March. The next step will be its publication in the Official Journal and its entry into force 20 days later.

The regulation introduces the EU Digital Identity Wallet, which will allow citizens to identify and authenticate themselves online to a range of public and private services, as well as store and share digital documents. Wallet users will also be able to create free digital signatures.

The EU Digital Identity Wallet will be used on a voluntary basis, and no one can be discriminated against for not using the wallet. The wallet will be open-source, to further encourage transparency, innovation, and enhance security.

Find out more about the history of the regulation and the project here.

Open-source code and new version of the ARF released for public feedback.

The open-source code of the EU Digital Identity Wallet, and the latest version of the Architecture and Reference Framework (ARF) are now available on our Github.

Version 1.3 of the ARF is now available to the public, to gather feedback before its adoption by the expert group. The ARF outlines how wallets distributed by Member States will function and contains a high level overview of the standards and practices that are needed to build the wallet.

The open-source code of the wallet (also referred to as the reference implementation) is built on the specifications outlined in the ARF. It is based on a modular architecture composed of a set of business agnostic, reusable components which will evolve in incremental steps and can be reused across multiple projects.

[…]

Large Scale Pilot projects are currently test driving the many use cases of the EU Digital Identity Wallet in the real world.

Discover the Large Scale Pilots

Source: The Digital Identity Wallet is now on its way – EU Digital Identity Wallet –

This is an immensely complex project which is very very important to get right. I am very curious if they did.

Aston Martin Show the way forward: Don’t trigger the piss off factor with your touchscreens

Posted on by

To decide how to best implement their cars’ touchscreens, Aston designers went out and sampled a range of vehicles, using their controls and noting the steps necessary to activate certain functions. Any feature expected to be immediately available that wasn’t triggered the “piss-off factor.”

The new Vantage is a good example of Aston’s design philosophy. It has a touchscreen, but it’s accompanied by many physical buttons, switches, and knobs. Nurnberger told CarExpert that Aston considered moving the seat controls into the touchscreen, but owners said they like to adjust their seat on the move depending on how they’re driving, and touchscreen-based settings are cumbersome and unsafe to use on the fly. The same thinking applies to volume and HVAC-related inputs.

“That’s the thing about the piss-off factor. When you want it, you want it instantly,” said Nurnberger. “If you want to turn the volume up and down, temperature absolutely—the minute you’ve got to go into a screen and tap for temperature, you’ve lost the customer. You’ve lost the experience.”

Aston is echoing what so many of us have already been saying. I think we can all agree that more button-heavy interiors are preferred. Touchscreens require more mental effort to use while simultaneously offering zero tactile feedback—frustrating at best and downright dangerous at worst. The automaker’s approach is a simple and sensible one that the entire industry should follow, especially brands that sell cars most of us can actually afford: if it pisses people off, don’t do it.

Source: Aston Martin Created a Metric for Touchscreen-Induced Anger

63 hour GPS jamming attack over Baltics affects 1600 aircraft over Europe

Posted on by

[…]

Since Russia invaded Ukraine in February 2022, Europe has experienced an uptick in the number of large-scale disruptions of GPS and other global navigation satellite systems (GNSS). The disruption has been felt near the Mediterranean and Black Sea, and near the Baltic Sea and Arctic. Since December 2023, for instance, the Baltic region has experienced fairly consistent GPS jamming. That roughly coincided with Russian media reports that the Russian navy’s Baltic Fleet based in Kaliningrad – a Russian enclave located between Lithuania and Poland – was conducting electronic warfare exercises.

Such interference can include jamming of satellite signals to block service. It can also include “spoofing” of signals – a technique that can be used to make aircraft GPS receivers appear to be in completely different locations, says Zach Clements at the University of Texas at Austin. His analysis has shown that the Christmas-time GPS interference in Europe included multiple incidents of GPS jamming, along with a spoofing attack originating from inside Russia.

[…]

The newest record-breaking run of jamming in the Baltic region started on the evening of 22 March and lasted 63 hours and 40 minutes – until the afternoon of 25 March, according to an open-source intelligence analyst who uses the social media account Runradion. The attack included 24 hours of interference patterns spread across parts of Sweden, Germany and Poland, before a switch to more focused interference primarily covering Poland, which lasted for about 40 hours.

More than 1600 aircraft were affected by this record-breaking period of disruption, according to another analyst using the pseudonym Markus Jonsson. In an earlier incident on 13 March, a Royal Air Force aircraft carrying UK Defence Secretary Grant Shapps experienced GPS signal interference on both legs of a journey between the UK and Poland as the aircraft flew near Kaliningrad.

[…]

Improved awareness among airline crews when entering areas with known jamming or spoofing activities has helped reduce the risk, says a spokesperson from the European Union Aviation Safety Agency. The agency has also been working on strengthening GPS alternatives using ground-based or on-board inertial guidance systems.

Source: Unprecedented GPS jamming attack affects 1600 aircraft over Europe | New Scientist

No Man’s Sky gets unique computer-generated space stations and ship customisation

Posted on by

No Man’s Sky is still getting major updates. Developer Hello Games’ “Orbital” update, due Wednesday, adds procedurally generated space stations (so they’ll be different every time), a ship editor and a Guild system to the nearly eight-year-old space exploration sim.

Up until now, space stations have been one of the few parts of No Man’s Sky that weren’t created and randomized by algorithms as something truly unique. That changes with today’s update, which uses game engine upgrades to “create vast interior spaces and exterior spaces, with improved reflection and metallic surfaces.”

The stations’ broader scale will be evident from the outside, while their interiors will include new shops, gameplay and things to do. Hello Games describes them as being “uniquely customized” based on their virtual inhabitants’ system, race and locale.

Interior of new procedurally generated space stations in the game No Man's Sky. Three characters stand in action poses in the foreground of a space hangar as ships whizz by.
Hello Games

Inside the stations, you’ll find the new ship editor. Hello Games says it previously withheld ship customization to maintain the title’s focus on exploration. (If players could build any ship they wanted at any time, it could ruin some of the fun of scouting out existing ones to buy in-game.) In that spirit, you’ll still need to collect, trade and salvage the parts to build yours how you like it.

[…]

Source: Eight years after launch, No Man’s Sky gets computer-generated space stations that are different each time

Completely awesome!

Twitch bans streams overlaid on boobs and butts – because Americans are petrified of sex

Posted on by

[…]

Twitch is putting a stop to its streamers’ shenanigans, though, and will officially prohibit “content that focuses on clothed intimate body parts such as the buttocks, groin, or breasts for extended periods of time” starting on March 29.

In a writeup on the trend, Kotaku explained that it all started when controversial streamer Morgpie projected her Fortnite gaming session on a closeup of her behind. After that, other streamers followed suit, overlaying their games on body parts both real and fictional, like anime thighs or anime boobs breasting boobily on screen while they’re playing. Now, boobs and butts streaming is out.

[…]

unclothed versions are also prohibited, as per Twitch’s policy that doesn’t allow users to broadcast or upload “content that contains depictions of real or fictional nudity, regardless of the medium used to create it.”

[…]

Source: Twitch bans streams overlaid on boobs and butts

Posted in Sex

Song lyrics really are getting simpler, more repetitive

Posted on by

You’re not just getting older. Song lyrics really are becoming simpler and more repetitive, according to a study published on Thursday.

Lyrics have also become angrier and more self-obsessed over the last 40 years, the study found, reinforcing the opinions of cranky aging music fans everywhere.

A team of European researchers analyzed the words in more than 12,000 English-language songs across the genres of rap, country, pop, R&B and from 1980 to 2020.

[…]

For the study in the journal Scientific Reports, the researchers looked at the emotions expressed in lyrics, how many different and complicated words were used, and how often they were repeated.

[…]

The results also confirmed previous research which had shown a decrease in positive, joyful lyrics over time and a rise in those that express anger, disgust or sadness.

Lyrics have also become much more self-obsessed, with words such as “me” or “mine” becoming much more popular.

‘Easier to memorize’

The number of repeated lines rose most in rap over the decades, Zangerle said—adding that it obviously had the most lines to begin with.

“Rap music has become more angry than the other genres,” she added.

The researchers also investigated which songs the fans of different genres looked up on the lyric website Genius.

Unlike other genres, rock fans most often looked up lyrics from older songs, rather than new ones.

Rock has tumbled down the charts in recent decades, and this could suggest fans are increasingly looking back to the genre’s heyday, rather than its present.

Another way that music has changed is that “the first 10-15 seconds are highly decisive for whether we skip the song or not,” Zangerle said.

Previous research has also suggested that people tend to listen to music more in the background these days, she added.

Put simply, songs with more choruses that repeat basic appear to be more popular.

“Lyrics should stick easier nowadays, simply because they are easier to memorize,” Zangerle said.

“This is also something that I experience when I listen to the radio.”

More information: Eva Zangerle, Song lyrics have become simpler and more repetitive over the last five decades, Scientific Reports (2024). DOI: 10.1038/s41598-024-55742-x. www.nature.com/articles/s41598-024-55742-x

Source: Song lyrics are getting simpler, more repetitive: Study

Posted in Art

In-app browsers still a privacy, security, and choice issue

Posted on by

[…] Open Web Advocacy (OWA), a group that supports open web standards and fair competition, said in a post on Tuesday that representatives “recently met with both the [EU’s] Digital Markets Act team and the UK’s Market Investigation Reference into Cloud Gaming and Browsers team to discuss how tech giants are subverting users’ choice of default browser via in-app browsers and the harm this causes.”

OWA argues that in-app browsers, without notice or consent, “ignore your choice of default browser and instead automatically and silently replace your default browser with their own in-app browser.”

The group’s goal isn’t to ban the technology, which has legitimate uses. Rather it’s to prevent in-app browsers from being used to thwart competition and flout user choice.

In-app browsers are like standalone web browsers without the interface – they rely on the native app for the interface. They can be embedded in native platform apps to load and render web content within the app, instead of outside the app in the designated default browser.

[…]

The problem with in-app browsers is that they play by a different set of rules from standalone browsers. As noted by OWA in its 62-page submission [PDF] to regulators:

  • They override the user’s choice of default browser
  • They raise tangible security and privacy harms
  • They stop the user from using their ad-blockers and tracker blockers
  • Their default browsers privacy and security settings are not shared
  • They are typically missing web features
  • They typically have many unique bugs and issues
  • The user’s session state is not shared so they are booted out of websites they have logged into in their default browser
  • They provide little benefit to users
  • They create significant work and often break third-party websites
  • They don’t compete as browsers
  • They confuse users and today function as dark patterns

Since around 2016, software engineers involved in web application development started voicing concerns about in-app browsers at some of the companies using them. But it wasn’t until around 2019 when Google engineer Thomas Steiner published a blog post about Facebook’s use of in-app browsers in its iOS and Android apps that the privacy and choice impact of in-app browsers began to register with a wider audience.

Steiner observed: “WebViews can also be used for effectively conducting intended man-in-the-middle attacks, since the IAB [in-app browser] developer can arbitrarily inject JavaScript code and also intercept network traffic.” He added: “Most of the time, this feature is used for good.”

[…]

In August 2022, developer Felix Krause published a blog post titled “Instagram and Facebook can track anything you do on any website in their in-app browser.” A week later, he expanded his analysis of in-app browsers to note how TikTok’s iOS app injects JavaScript to subscribe to “every keystroke (text inputs) happening on third party websites rendered inside the TikTok app”

[…]

Even assuming one accepts Meta’s and TikTok’s claims that they’ve not misused the extraordinary access granted by in-app browsers – a difficult ask in light of allegations raised in ongoing Meta litigation – the issue remains that companies implementing in-app browsers may be overriding the choices of users regarding their browser and whatever extensions they have installed.

However, Meta does provide a way to opt out of having its in-app browser open links clicked in its Facebook and Instagram apps.

[…]

As for the Competition and Markets Authority (CMA), the UK watchdog appears to be willing to consider allowing developer choice to supersede user choice, or at least that was the case two years ago. In its 2022 response to the CMA’s Interim Report, Google observed [PDF] that the competition agency itself had conceded that in an Android native app, the choice of browser belongs to the app developer rather than to Google.

“The Interim Report raises concerns about in-app browsers overriding users’ chosen default browsers,” Google said in its response. “However, as the CMA rightly notes, the decision on whether a native app launches an in-app browser, and if so, which browser, lies with the respective app developer, not Google. Having control over whether or not an in-app browser is launched allows app developers to customize their user interfaces, which can in turn improve the experience for users. There is therefore, to some extent, a trade-off between offering developers choice and offering end users choice.”

Source: In-app browsers still a privacy, security, and choice issue • The Register

However, in-app browsers are a horrible security breach and the choice should belong to the user – not Google, not an app developer.

Soofa Digital Kiosks Snatch Your Phone’s Data When You Walk By, sell it on

Posted on by

Digital kiosks from Soofa seem harmless, giving you bits of information alongside some ads. However, these kiosks popping up throughout the United States take your phone’s information and location data whenever you walk near them, and sell them to local governments and advertisers, first reported by NBC Boston Monday.

“At Soofa, we developed the first pedestrian impressions sensor that measures accurate foot traffic in real-time,” says a page on the company’s website. “Soofa advertisers can check their analytics dashboard anytime to see how their campaigns are tracking towards impressions goals.”

While data tracking is commonplace online, it’s becoming more pervasive in the real world. Whenever you walk past a Soofa kiosk, it collects your phone’s unique identifier (MAC address), manufacturer, and signal strength. This allows it to track anyone who walks within a certain, unspecified range. It then creates a dashboard to share with advertisers and local governments to display analytics about how many people are walking and engaging with its billboards.

This can offer local cities new ways to understand how people use public spaces, and how many people are reading notices posted on these digital kiosks. However, it also gives local governments detailed information on how people move throughout society and raises a question of how this data is being used.

[…]

A Soofa spokesperson said it does not share data with any 3rd parties in an email to Gizmodo, and it only offers the dashboard to an organization that bought the kiosk. The company also claims to anonymize your MAC address by the time it gets to advertisers and local governments.

However, Soofa also tells advertisers how to effectively use your location data on its website. It notes that advertisers can track when you’ve been near a physical billboard or kiosk in the real world based on location data. Then, using cookies, the advertisers can send you more digital ads later on. While Soofa didn’t invent this technique, it certainly seems to be promoting it.

[…]

Source: These Digital Kiosks Snatch Your Phone’s Data When You Walk By

Mass claim CUIC against virus scanner (but really tracking sypware) Avast

Posted on by

Privacy First has teamed up with Austrian NOYB (the organisation of privacy activist Max Schrems) to form the new mass claim organisation CUIC founded. CUIC stands for Consumers United in Court, also pronounceable as ‘CU in Court’ (see you in court).

[…]

Millions spied on by virus scanner

CUIC today filed subpoenas against software company Avast that made virus scanners that illegally collected the browsing behaviour of millions of people on computer, tablet or phone, including in the Netherlands. This data was then resold to other companies through an Avast subsidiary for millions of euros. This included data about users’ health, locations visited, political affiliation, religious beliefs, sexual orientation or economic situation. This information was linked to each specific user through unique user IDs. In a press release articulates CUIC president Wilmar Hendriks today as follows: “People thought they were safe with a virus scanner, but its very creator tracked everything they did on their computers. Avast sold this information to third parties for big money. They even advertised the goldmine of data they had captured. Companies like Avast should not be allowed to get away with this. That is why we are bringing this lawsuit. Those who won’t hear should feel.”

Fines

Back in March 2023, the Czech privacy regulator (UOOU) concluded that Avast violated the AVG and fined the company approximately €13.7 million. The US federal consumer authority, the Federal Trade Commission (FTC), also recently ordered Avast to pay USD16.5 million in compensation to users and ordered it to stop selling or making collected data available to third parties, delete that collected data and implement a comprehensive privacy programme.

The lawsuit for which CUIC today sued Avast should lead to compensation for users in the Netherlands

[…]

Source: Mass claim CUIC against virus scanner Avast launched – Privacy First

Software vendors dump open source, go for the cash grab – Redis is the latest

Posted on by

Essentially, all software is built using open source. By Synopsys’ count, 96% of all codebases contain open-source software.

Lately, though, there’s been a very disturbing trend. A company will make its program using open source, make millions from it, and then — and only then — switch licenses, leaving their contributors, customers, and partners in the lurch as they try to grab billions. I’m sick of it.

The latest IT melodrama baddie is Redis. Its program, which goes by the same name, is an extremely popular in-memory database. (Unless you’re a developer, chances are you’ve never heard of it.) One recent valuation shows Redis to be worth about $2 billion — even without an AI play! That, anyone can understand.

What did it do? To quote Redis: “Beginning today, all future versions of Redis will be released with source-available licenses. Starting with Redis 7.4, Redis will be dual-licensed under the Redis Source Available License (RSALv2) and Server Side Public License (SSPLv1). Consequently, Redis will no longer be distributed under the three-clause Berkeley Software Distribution (BSD).”

For those of you who aren’t open-source licensing experts, this means developers can no longer use Redis’ code. Sure, they can look at it, but they can’t export, borrow from, or touch it.

Redis pulled this same kind of trick in 2018 with some of its subsidiary code. Now it’s done so with the company’s crown jewels.

Redis is far from the only company to make such a move. Last year,  HashiCorp dumped its main program Terraform’s Mozilla Public License (MPL) for the Business Source License (BSL) 1.1. Here, the name of the new license game is to prevent anyone from competing with Terraform.

Would it surprise you to learn that not long after this, HashiCorp started shopping itself around for a buyer? It didn’t surprise me.

Before this latest round of license changes, MongoDB and Elastic made similar shifts. Again, you might never have heard of these companies or their programs, but each is worth, at a minimum, hundreds of millions of dollars. And, while you might not know it, if your company uses cloud services behind the scenes, chances are you’re using one or more of their programs

[…]

Software companies are ticked off. At least two Linux distros, Fedora and openSUSE, are considering getting rid of the Redis program. If they do, you can expect their big commercial brothers, Red Hat Enterprise Linux (RHEL) and SUSE Linux Enterprise Server (SLES) to follow suit.

Who’s really furious about this, though, are developers. It’s their work, after all, that’s disappearing into semi-proprietary vaults, never to be touched by them again.

So, as they’ve done before and they’ll do again, at least two sets of programmers are forking it. First off the mark was Drew DeVault, founder and CEO of SourceHut, with Redict. He was quickly followed by Madelyn Olson, principal engineer at Amazon ElastiCache, itself an open-source fork of Elastic. However, as Olson observed, this as-yet-unnamed Redis fork is not an AWS project. AWS is working on its own response.

Source: Software vendors dump open source, go for the cash grab | Computerworld

Why is this a problem? Using open source also means you get free contributions whilst creating the code – that could be programming done for free, but also quality assurance done for free. So basically you take other people’s work and steal it to sell as your own.

Part of the problem is caused by the Free Open Source Software (FOSS) die-hard fundamentalists, a bunch of tenured university based software developers on a payroll, who absolutely refuse to allow other FOSS developers – who may not have a payroll – to make any money whatsoever on a FOSS license. This is a problem I have been addressing for years and which has gained quite a lot of traction since then.

 

Amazon fined almost $8M in Poland over dark patterns

Posted on by

Poland’s competition and consumer protection watchdog has fined Amazon’s European subsidiary around $8 million (31.9 million Zlotys) for “dark patterns” that messed around internet shoppers.

The preliminary ruling applies to Amazon EU SARL, which oversees Amazon’s Polish e-commerce site, Amazon.pl, out of Luxembourg. Poland’s Office of Competition and Consumer Protection said the decision, subject to appeal, reflected misleading practices related to product availability, delivery dates, and drop-off time guarantees.

According to the ruling, Amazon’s Polish operation repeatedly canceled customer orders for e-book readers and other gear. The online souk believed it was within its rights to do so because it considers its sales contract and delivery obligations are active only after an item has shipped, rather than when the customer purchases it.

But these abrupt cancellations left punters who thought they’d successfully paid for stuff and were awaiting delivery disappointed, sparking complaints to the watchdog, which has seemingly upheld the claims.

Not only that, the regulator was unimpressed that the language on Amazon’s website warning this could happen is difficult to read – “it is written in gray font on a white background, at the very bottom of the page.”

[…]

Source: Amazon fined almost $8M in Poland over ‘dark patterns’ • The Register