Monthly Archives: July 2024

Sonos apologized months too late for messing up its app and has offered a roadmap for fixing everything which has already slipped

Posted on by

Sonos seriously stepped in it a couple of months back when it released an overhauled first-party mobile app that shipped with a number of missing features. These included core functions like sleep timers and alarms. Many of the company’s speakers would not appear as a pairing option and it became extremely difficult to precisely adjust the volume level of a paired speaker.Additionally, music search and playback were both negatively impacted by the change, leading to numerous customer complaints.

Now, the company has apologized for releasing the half-baked app. CEO Patrick Spence whipped up a blog post to address the “significant problems” with the new software.

“There isn’t an employee at Sonos who isn’t pained by having let you down, and I assure you that fixing the app for all of our customers and partners has been and continues to be our number one priority,” he wrote.

Spence also wrote that the company had planned to quickly incorporate the missing features and patch up any errors, but these fixes were delayed by a “number of issues” that were unique to the update. He did confirm that Sonos has been actively pushing out patches approximately every two weeks to address a wide variety of concerns.

[…]

Source: Sonos apologized for messing up its app and has offered a roadmap for fixing everything

Etsy goes USA level prude and will kill Artisanal sex toy businesses – without having told them that their policies were changing. Surprise!

Posted on by

Simply Elegant Glass has been selling hand-crafted sex toys on Etsy for nearly a decade. In that time, the shop has made over 7,000 sales and racked up more than 1,500 mostly five-star reviews. The Etsy shop — which offers glass dildos, anal plugs and other insertable items — drives the majority of the small business’ overall sales. But as of Monday July 29, the bulk of the shop’s catalog won’t be allowed on the marketplace anymore under Etsy’s new restrictions around sex toys.

The Adult Nudity and Sexual Content policy, which was quietly published at the end of June to the platform’s “House Rules,” states that “Etsy prohibits the sale of adult toys that are: inserted into the body; applied to the genitalia; designed for genitals to be inserted into them.” Among other things, it specifically forbids vendors from selling “dildos, vibrators, anal plugs, sex dolls and fleshlights.” The policy update, spotted first by Mashable, came in tandem with a community forum post by Etsy’s head of Trust & Safety, Alice Wu Paulus, who wrote that it was designed to reflect “evolving industry standards and best practices so that we can continue to keep our users safe.”

The note about the impending change said Etsy would, in the coming weeks, “communicate directly with sellers who may need to update their listing images to be compliant.” Enforcement would begin on July 29, it said, and non-compliant listings would be removed. But up to three weeks after the new policy was published online, sellers that spoke to Engadget said they were never contacted directly by Etsy. All of them found out about the ban through social media or other means.

[…]

Source: Artisanal sex toy businesses might not survive Etsy’s new seller policies

Posted in Sex

Samsung starts blocking sideloading, so Epic Games pulls Fortnite from the Galaxy Store

Posted on by

After it was discovered that Samsung would begin blocking any attempt to sideload apps Epic Games has made the decision to remove Fortnite, among other titles, from the Galaxy Store.

When the Galaxy Z Fold 6 began to land in the hands of users, the loaded version of One UI touted a brand-new attempt to block unverified apps from being sideloaded. Samsung’s One UI 6.1.1 asks if the user wants to turn on the “Auto Blocker,” a function that will block not only apps from unverified sources but also commands or software updates via USB cable.

Related: Samsung Galaxy phones now stop you from sideloading Android apps by default

Epic Games views this as poor behavior on Samsung’s part, citing it as one reason the company is pulling Fortnite from the Galaxy Store in One UI. A blog post notes that the decision was also made because of “ongoing Google proposals to Samsung to restrain competition in the market for Android app distribution.”

[…]

Source: Epic Games pulls Fortnite from the Galaxy Store

Come on Samsung,  blocking sideloading and USB? Really, one of the advantages of Android is that it is a (more) open system.

Crowdstrike apologises for breaking the world to own IT Workers With $10 Uber Eats Coupons that are flagged by Uber as Fraudulent

Posted on by

Last week, the world reacted as 8.5 million computers crashed to bluescreen, grounding flights, crippling hospitals, and bringing down 911 services. This week, the world is reacting to the company responsible—Crowdstrike—offering its staff and the companies it works with a $10 Uber Eats voucher as way of apology for all their extra work over the weekend. People are not pleased.

[…]

Given Crowdstrike’s day-job is to help companies respond in the event of a cyberattack, you might imagine damage control was a concept with which it had some manner of familiarity. However, in an email sent out to its staff and partner companies, it managed the most impressively cloth-eared response, saying,

To express our gratitude, your next cup of coffee or late night snack is on us!

The email came with a code that would unlock a $10 Uber Eats voucher. A figure just low enough to be next to useless.

It would be very reasonable to suspect that this was one of very many fraudulent emails and links that have gone around since Friday’s incident, attempting to take advantage of the situation for malware, phishing and all manner of scams. However, according to CNN, a Crowdstrike spokesperson confirmed the emails were legitimate.

However, CNN reports that the spike in uses of the particular code caused Uber to flag it as fraud! Just perfect.

[…]

Source: Crowdstrike Says Sorry To IT Workers With $10 Uber Eats Coupons

A Hacker ‘Ghost’ Network Is Quietly Spreading Malware on GitHub

Posted on by

A secretive network of around 3,000 “ghost” accounts on GitHub has quietly been manipulating pages on the code-hosting website to promote malware and phishing links, according to new research seen by WIRED.

Since at least June last year, according to researchers at cybersecurity company Check Point, a cybercriminal they dubbed “Stargazer Goblin” has been hosting malicious code repositories on the Microsoft-owned platform. GitHub is the world’s largest open-source code website, hosting millions of developers’ work. As well as uploading malicious repositories, Stargazer Goblin has been boosting the pages by using GitHub’s own community tools.

Antonis Terefos, a malware reverse engineer at Check Point who discovered the nefarious behavior, says the persona behind the network uses their false accounts to “star,” “fork,” and “watch” the malicious pages.

[…]

The Stargazers Ghost Network, which Check Point named after one of the first accounts they spotted, has been spreading malicious GitHub repositories that offer downloads of social media, gaming, and cryptocurrency tools. For instance, pages might be claiming to provide code to run a VPN or license a version of Adobe’s Photoshop. These are mostly targeting Windows users, the research says, and aim to capitalize on people potentially searching for free software online.

The operator behind the network charges other hackers to use their services, which Check Point call “distribution as a service.” The harmful network has been spotted sharing various types of ransomware and info-stealer malware, Check Point says, including the Atlantida Stealer, Rhadamanthys, and the Lumma Stealer. Terefos says he discovered the network while researching instances of the Atlantida Stealer. The researcher says the network could be bigger than he expects, as he has also seen legitimate GitHub accounts being taken over using stolen login details.

[…]

The Stargazer Goblin threat actor identified by Check Point sells their services through ads on cybercrime forums and also through a Telegram account. A posts on a Russian-language cybercrime forum advertises 100 stars for $10 and 500 for $50 and says they can provide clones of existing repositories and trusted accounts. “For GitHub, the process looks organic,”

[…]

The Check Point engineer also says he identified one YouTube “ghost” account that was sharing malicious links via video, indicating that the network could be more encompassing. “I think this is not the whole picture,” Terefos says.

Source: A Hacker ‘Ghost’ Network Is Quietly Spreading Malware on GitHub | WIRED

US Congress Wants To Let Private Companies Own The Law – set standards you must comply with but can’t actually find or see easily

Posted on by

It sounds absolutely batty that there is a strong, bipartisan push to lock up aspects of our law behind copyright. But it’s happening. Even worse, the push is on to include this effort to lock up the law in the “must pass” National Defense Authorization Act (NDAA). This is the bill that Congress lights up like a Christmas tree with the various bills they know they can’t pass normally, every year.

And this year, they’re pushing the Pro Codes Act, a dangerous bill to lock up the law that has bipartisan support.

[…]

There are lots of standards out there, often developed by industry groups. These standards can be on all sorts of subjects, such as building codes or consumer safety or indicators for hazardous materials. The list goes on and on and on. Indeed, the National Institute of Standards and Technology has a database of over 27,000 such standards that are “included by reference” into law.

This is where things get wonky. Since many of these standards are put together by private organizations (companies, standards bodies, whatever), some of them could qualify for copyright. But, then, lawmakers will often require certain products and services to meet those standards. That is, the laws will “reference” those standards (for example, how to have a building be built in a safe or non-polluting manner).

Many people, myself included, believe that the law must be public. How can the rule of law make any sense at all if the public cannot freely access and read the law? Thus, we believe that when a standard gets “incorporated by reference” into the law, it should become public domain, for the simple fact that the law itself must be public domain.

[…]

Two years ago, there was a pretty big victory, noting that his publishing of standards that are “incorporated by reference” is fair use.

But industry standards bodies hate this, because often a large part of their own revenue stream comes from selling access to the standards they create, including those referenced by laws.

So they lobbied Congress to push this Pro Codes Act, which explicitly says that technical standards incorporated by reference retain copyright. To try to stave off criticism (and to mischaracterize the bill publicly), the law says that standards bodies retain the copyright if the standards body makes the standard available on a free publicly accessible online source.

[…]

They added this last part to head off criticism that the law is “locked up.” They say things like “see, under this law, the law has to be freely available online.”

But that’s missing the point. It still means that the law itself is only available from one source, in one format. And while it has to be “publicly accessible online at no monetary cost,” that does not mean that it has to be publicly accessible in an easy or useful manner. It does not mean that there won’t be limitations on access or usage.

It is locking up the law.

But, because the law says that those standards must be released online free of cost, it allows the supporters of this law, like Issa, to falsely portray the law as “enhancing public access” to the laws.

That’s a lie.

[…]

t flies in the face of the very fundamental concept that “no one can own the law,” as the Supreme Court itself recently said. And to try and shove it into a must pass bill about funding the military is just ridiculously cynical, while demonstrating that its backers know it can’t pass through regular process.

Instead, this is an attempt by Congress to say, yes, some companies do get to own the law, so long as they put up a limited, difficult to use website by which you can see parts of the law.

Library groups and civil society groups are pushing back on this (disclaimer: we signed onto this letter). Please add your voice and tell Congress not to lock up the law.

Source: Congress Wants To Let Private Companies Own The Law | Techdirt

FTC asks 8 big names to explain surveillance pricing tech

Posted on by

The US Federal Trade Commission (FTC) has launched an investigation into “surveillance pricing,” a phenomenon likely familiar to anyone who’s had to buy something in an incognito browser window to avoid paying a premium.

Surveillance pricing, according to the FTC, is the use of algorithms, AI, and other technologies – most crucially combined with personal information about shoppers like location, demographics, credit, the computer used, and browsing/shopping history – “to categorize individuals and set a targeted price for a product or service.”

In other words, the regulator is concerned about the use of software to artificially push up prices for people based on their perceived circumstances, something that incognito mode can counter by more or less cloaking your online identity.

[…]

But don’t mistake this for legal action – at this point it’s all about “helping the FTC better understand the opaque market for [surveillance pricing] products by third-party intermediaries,” the government watchdog said.

“Firms that harvest Americans’ personal data can put people’s privacy at risk,” FTC boss Lina Khan opined. “Now firms could be exploiting this vast trove of personal information to charge people higher prices.”

It’s not exactly a secret that sellers manipulate online prices, or that consumers know about it – recommendations to shop online in an incognito browser window are plentiful and go back years.

In this case, the FTC wants to know more about how Mastercard, JPMorgan Chase, Accenture and McKinsey & Co are offering surveillance pricing products. It also wants the same information from some names you may not have heard of, like Revionics, which offers surveillance pricing services to companies like The Home Depot and Tractor Supply; Task Software, which counts McDonald’s and Starbucks among its customers; PROS, which supports Nestle, DigiKey and others; and Bloomreach, which provides similar services like Williams Sonoma, Total Wine, and Virgin Experience Days.

The FTC wants to probe what types of surveillance pricing products exist, the services they offer, how they’re collecting customer data and where it’s coming from, information about who they offered services to, and what sort of impacts these may have on consumers and the prices they pay.

[…]

Source: FTC asks 8 big names to explain surveillance pricing tech • The Register

Switzerland now requires all government software to be open source. Sort of.

Posted on by

Several European countries are betting on open-source software. In the United States, eh, not so much. In the latest news from across the Atlantic, Switzerland has taken a major step forward with its “Federal Law on the Use of Electronic Means for the Fulfillment of Government Tasks” (EMBAG). This groundbreaking legislation mandates using open-source software (OSS) in the public sector.

This new law requires all public bodies to disclose the source code of software developed by or for them unless third-party rights or security concerns prevent it. This “public money, public code” approach aims to enhance government operations’ transparency, security, and efficiency.

[…]

Source: Switzerland now requires all government software to be open source | ZDNET

The Netherlands has a similar law, but you would be amazed how flimsy the accepted excuses are that claim that software should be delivered under a closed-source exception.

Google’s reCAPTCHAv2 is just labor exploitation, boffins say

Posted on by

Google promotes its reCAPTCHA service as a security mechanism for websites, but researchers affiliated with the University of California, Irvine, argue it’s harvesting information while extracting human labor worth billions.

The term CAPTCHA stands for “Completely Automated Public Turing test to tell Computers and Humans Apart,” and, as Google explains, it refers to a challenge-response authentication scheme that presents people with a puzzle or question that a computer cannot solve.

[…]

The utility of reCAPTCHA challenges appears to be significantly diminished in an era when AI models can answer CAPTCHA questions almost as well as humans.

Show me the money

UC Irvine academics contend CAPTCHAs should be binned.

In a paper [PDF] titled “Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2,” authors Andrew Searles, Renascence Tarafder Prapty, and Gene Tsudik argue that the service should be abandoned because it’s disliked by users, costly in terms of time and datacenter resources, and vulnerable to bots – contrary to its intended purpose.

“I believe reCAPTCHA’s true purpose is to harvest user information and labor from websites,” asserted Andrew Searles, who just completed his PhD and was the paper’s lead author, in an email to The Register.

“If you believe that reCAPTCHA is securing your website, you have been deceived. Additionally, this false sense of security has come with an immense cost of human time and privacy.”

The paper, released in November 2023, notes that even back in 2016 researchers were able to defeat reCAPTCHA v2 image challenges 70 percent of the time. The reCAPTCHA v2 checkbox challenge is even more vulnerable – the researchers claim it can be defeated 100 percent of the time.

reCAPTCHA v3 has fared no better. In 2019, researchers devised a reinforcement learning attack that breaks reCAPTCHAv3’s behavior-based challenges 97 percent of the time.

[…]

The authors’ research findings are based on a study of users conducted over 13 months in 2022 and 2023. Some 9,141 reCAPTCHAv2 sessions were captured from unwitting participants and analyzed, in conjunction with a survey completed by 108 individuals.

Respondents gave the reCAPTCHA v2 checkbox puzzle 78.51 out of 100 on the System Usability Scale, while the image puzzle rated only 58.90. “Results demonstrate that 40 percent of participants found the image version to be annoying (or very annoying), while <10 percent found the checkbox version annoying,” the paper explains.

But when examined in aggregate, reCAPTCHA interactions impose a significant cost – some of which Google captures.

“In terms of cost, we estimate that – during over 13 years of its deployment – 819 million hours of human time has been spent on reCAPTCHA, which corresponds to at least $6.1 billion USD in wages,” the authors state in their paper.

“Traffic resulting from reCAPTCHA consumed 134 petabytes of bandwidth, which translates into about 7.5 million kWhs of energy, corresponding to 7.5 million pounds of CO2. In addition, Google has potentially profited $888 billion from cookies [created by reCAPTCHA sessions] and $8.75–32.3 billion per each sale of their total labeled data set.”

Asked whether the costs Google shifts to reCAPTCHA users in the form of time and effort are unreasonable or exploitive, Searles pointed to the original white paper on CAPTCHAs by Luis von Ahn, Manuel Blum, and John Langford – which includes a section titled “Stealing cycles from humans.”

[…]

As the paper points out, image-labeling challenges have been around since 2004 and by 2010 there were attacks that could beat them 100 percent of the time. Despite this, Google introduced reCAPTCHA v2 with a fall-back image recognition security challenge that had been proven to be insecure four years earlier.

This makes no sense, the authors argue, from a security perspective. But it does make sense if the goal is obtaining image labeling data – the results of users identifying CAPTCHA images – which Google happens to sell as a cloud service.

“The conclusion can be extended that the true purpose of reCAPTCHA v2 is a free image-labeling labor and tracking cookie farm for advertising and data profit masquerading as a security service,” the paper declares.

[…]

Source: Google’s reCAPTCHAv2 is just labor exploitation, boffins say • The Register

UN Cybercrime Treaty does not define cybercrime, allows any definition and forces all signatories to secretly surveil their own population on request by any other signatory (think totalitarian states spying on people in democracies with no recourse)

Posted on by

[…] EFF colleague, Katitza Rodriguez, about the Cybercrime Treaty, which is about to pass, and which is, to put it mildly, terrifying:

https://www.eff.org/deeplinks/2024/07/un-cybercrime-draft-convention-dangerously-expands-state-surveillance-powers

Look, cybercrime is a real thing, from pig butchering to ransomware, and there’s real, global harms that can be attributed to it. Cybercrime is transnational, making it hard for cops in any one jurisdiction to handle it. So there’s a reason to think about formal international standards for fighting cybercrime.

But that’s not what’s in the Cybercrime Treaty.

Here’s a quick sketch of the significant defects in the Cybercrime Treaty.

The treaty has an extremely loose definition of cybercrime, and that looseness is deliberate. In authoritarian states like China and Russia (whose delegations are the driving force behind this treaty), “cybercrime” has come to mean “anything the government disfavors, if you do it with a computer.” “Cybercrime” can mean online criticism of the government, or professions of religious belief, or material supporting LGBTQ rights.

Nations that sign up to the Cybercrime Treaty will be obliged to help other nations fight “cybercrime” – however those nations define it. They’ll be required to provide surveillance data – for example, by forcing online services within their borders to cough up their users’ private data, or even to pressure employees to install back-doors in their systems for ongoing monitoring.

These obligations to aid in surveillance are mandatory, but much of the Cybercrime Treaty is optional. What’s optional? The human rights safeguards. Member states “should” or “may” create standards for legality, necessity, proportionality, non-discrimination, and legitimate purpose. But even if they do, the treaty can oblige them to assist in surveillance orders that originate with other states that decided not to create these standards.

When that happens, the citizens of the affected states may never find out about it. There are eight articles in the treaty that establish obligations for indefinite secrecy regarding surveillance undertaken on behalf of other signatories. That means that your government may be asked to spy on you and the people you love, they may order employees of tech companies to backdoor your account and devices, and that fact will remain secret forever. Forget challenging these sneak-and-peek orders in court – you won’t even know about them:

https://www.eff.org/deeplinks/2024/06/un-cybercrime-draft-convention-blank-check-unchecked-surveillance-abuses

Now here’s the kicker: while this treaty creates broad powers to fight things governments dislike, simply by branding them “cybercrime,” it actually undermines the fight against cybercrime itself. Most cybercrime involves exploiting security defects in devices and services – think of ransomware attacks – and the Cybercrime Treaty endangers the security researchers who point out these defects, creating grave criminal liability for the people we rely on to warn us when the tech vendors we rely upon have put us at risk.

[…]

When it comes to warnings about the defects in their own products, corporations have an irreconcilable conflict of interest. Time and again, we’ve seen corporations rationalize their way into suppressing or ignoring bug reports. Sometimes, they simply delay the warning until they’ve concluded a merger or secured a board vote on executive compensation.

Sometimes, they decide that a bug is really a feature

Note: Responsible disclosure is something people should really “get” by now.

[…]

The idea that users are safer when bugs are kept secret is called “security through obscurity” and no one believes in it – except corporate executives

[…]

The spy agencies have an official doctrine defending this reckless practice: they call it “NOBUS,” which stands for “No One But Us.” As in: “No one but us is smart enough to find these bugs, so we can keep them secret and use them attack our adversaries, without worrying about those adversaries using them to attack the people we are sworn to protect.”

NOBUS is empirically wrong.

[…]

The leak of these cyberweapons didn’t just provide raw material for the world’s cybercriminals, it also provided data for researchers. A study of CIA and NSA NOBUS defects found that there was a one-in-five chance of a bug that had been hoarded by a spy agency being independently discovered by a criminal, weaponized, and released into the wild.

[…]

A Cybercrime Treaty is a good idea, and even this Cybercrime Treaty could be salvaged. The member-states have it in their power to accept proposed revisions that would protect human rights and security researchers, narrow the definition of “cybercrime,” and mandate transparency. They could establish member states’ powers to refuse illegitimate requests from other countries:

https://www.eff.org/press/releases/media-briefing-eff-partners-warn-un-member-states-are-poised-approve-dangerou

 

Source: Pluralistic: Holy CRAP the UN Cybercrime Treaty is a nightmare (23 Jul 2024) – Pluralistic: Daily links from Cory Doctorow

Dual action antibiotic could make bacterial resistance nearly impossible

Posted on by

A new antibiotic that works by disrupting two different cellular targets would make it 100 million times more difficult for bacteria to evolve resistance, according to new research from the University of Illinois Chicago.

For a new paper in Nature Chemical Biology, researchers probed how a class of synthetic drugs called macrolones disrupt bacterial cell function to fight infectious diseases. Their experiments demonstrate that macrolones can work two different ways—either by interfering with protein production or corrupting DNA structure.

Because would need to implement defenses to both attacks simultaneously, the researchers calculated that is nearly impossible.

“The beauty of this antibiotic is that it kills through two different targets in bacteria,” said Alexander Mankin, distinguished professor of pharmaceutical sciences at UIC. “If the antibiotic hits both targets at the same concentration, then the bacteria lose their ability to become resistant via acquisition of random mutations in any of the two targets.”

[…]

More information: Elena V. Aleksandrova et al, Macrolones target bacterial ribosomes and DNA gyrase and can evade resistance mechanisms, Nature Chemical Biology (2024). DOI: 10.1038/s41589-024-01685-3

Source: Dual action antibiotic could make bacterial resistance nearly impossible

Google isn’t killing third-party cookies in Chrome after all in move that surprises absolutely no-one.

Posted on by

Google won’t kill third-party cookies in Chrome after all, the company said on Monday. Instead, it will introduce a new experience in the browser that will allow users to make informed choices about their web browsing preferences, Google announced in a blog post. Killing cookies, Google said, would adversely impact online publishers and advertisers. This announcement marks a significant shift from Google’s previous plans to phase out third-party cookies by early 2025.

[…]

Google will now focus on giving users more control over their browsing data, Chavez wrote. This includes additional privacy controls like IP Protection in Chrome’s Incognito mode and ongoing improvements to Privacy Sandbox APIs.

Google’s decision provides a reprieve for advertisers and publishers who rely on cookies to target ads and measure performance. Over the past few years, the company’s plans to eliminate third-party cookies have been riding on a rollercoaster of delays and regulatory hurdles. Initially, Google aimed to phase out these cookies by the end of 2022, but the deadline was pushed to late 2024 and then to early 2025 due to various challenges and feedback from stakeholders, including advertisers, publishers, and regulatory bodies like the UK’s Competition and Markets Authority (CMA).

In January 2024, Google began rolling out a new feature called Tracking Protection, which restricts third-party cookies by default for 1% of Chrome users globally. This move was perceived as the first step towards killing cookies completely. However, concerns and criticism about the readiness and effectiveness of Google’s Privacy Sandbox, a collection of APIs designed to replace third-party cookies, prompted further delays.

The CMA and other regulatory bodies have expressed concerns about Google’s Privacy Sandbox, fearing it might limit competition and give Google an unfair advantage in the digital advertising market. These concerns have led to extended review periods and additional scrutiny, complicating Google’s timeline for phasing out third-party cookies. Shortly after Google’s Monday announcement, the CMA said that it was “considering the impact” of Google’s change of direction.

Source: Google isn’t killing third-party cookies in Chrome after all

Intel has finally figured out its long-standing desktop CPU instability issues, hopefully patches in August

Posted on by

The first reports of instability issues with the 13th-gen Intel desktop CPUs started popping up in late 2022, mere months after the models came out. Those issues persisted, and over time, users reported dealing with unexpected and sudden crashes on PCs equipped with the company’s 14th-gen CPUs, as well. Now, Intel has announced that it finally found the reason why its 13th and 14th-gen desktop processors have been causing crashes and giving out on users, and it promises to roll out a fix by next month.

In its announcement, Intel said that based on extensive analysis of the processors that had been returned to the company, it has determined that elevated operating voltage was causing the instability issues. Apparently, it’s because a microcode algorithm — microcodes, or machine codes, are sets of hardware-level instructions — has been sending incorrect voltage requests to the processor.

Intel has now promised to release a microcode patch to address the “root cause of exposure to elevated voltages.” The patch is still being validated to ensure that it can address all “scenarios of instability reported to Intel,” but the company is aiming to roll it out by mid-August.

As wccftech notes, while Intel’s CPUs have been causing issues with users for at least a year and a half, a post on X by Sebastian Castellanos in February put the problem in the spotlight. Castellanos wrote that there was a “worrying trend” of 13th and 14th-gen Intel CPUs having stability issues with Unreal Engine 4 and 5 games, such as Fortnite and Hogwarts Legacy. He also noticed that the issue seems to affect mostly higher-end models and linked to a discussion on Steam Community. The user that wrote the post on Steam wanted to issue a warning to those experiencing “out of video memory trying to allocate a rendering resource” errors that it was their CPU that was faulty. They also linked to several Reddit threads with people experiencing the same problem and who had determined that their issue lied with their Intel CPUs.

More recently, the indie studio Alderon Games published a post about “encountering significant problems with Intel CPU stability” while developing its multiplayer dinosaur survival game Path of Titans. Its founder, Matthew Cassells, said the studio found that the issue affected end customers, dedicated game servers, developers’ computers, game server providers and even benchmarking tools that use Intel’s 13th and 14th-gen CPUs. Cassells added that even the CPUs that initially work well deteriorate and eventually fail, based on the company’s observations. “The failure rate we have observed from our own testing is nearly 100 percent,” the studio’s post reads, “indicating it’s only a matter of time before affected CPUs fail.”

Source: Intel has finally figured out its long-standing desktop CPU instability issues

Nvidia’s third-party RTX 40-series GPUs are losing performance over time thanks to rubbish factory-installed thermal paste

Posted on by

Modern graphics cards use lots of power and all of it is turned into heat. So if you’re paying many hundreds of dollars for a powerful GPU, you’d expect no expense to be spared on the cooling system. It turns out that for many Nvidia RTX 40-series vendors, the expense is being spared and cheap, poorly applied thermal paste is leading to scorching high hotspot temperatures and performance degradation over time.

That’s the conclusion hardware tester Igor’s Lab has come to after testing multiple GeForce RTX cards, analysing temperatures and performance, and discovering that the thermal paste used by many graphics card vendors is not only sub-standard for the job but is also poorly applied.

I have four RTX 40-series cards in my office (RTX 4080 Super, 4070 Ti, and two 4070s) and all of them have quite high hotspots—the highest temperature recorded by an individual thermal sensor in the die. In the case of the 4080 Super, it’s around 11 °C higher than the average temperature of the chip. I took it apart to apply some decent quality thermal paste and discovered a similar situation to that found by Igor’s Lab.

In the space of a few months, the factory-applied paste had separated and spread out, leaving just an oily film behind, and a few patches of the thermal compound itself. I checked the other cards and found that they were all in a similar state.

[…]

Removing the factory-installed paste from another RTX 4080 graphics card, Igor’s Lab applied a more appropriate amount of a high-quality paste and discovered that it lowered the hotspot temperature by nearly 30 °C.

But it’s not just about the hotspots. Cheap, poorly applied thermal paste will cause the performance of a graphics card to degrade over time because GPUs lower clock speeds when they reach their thermal limits. PC enthusiasts are probably very comfortable with replacing a CPU’s thermal paste regularly but it’s not a simple process with graphics cards.

[…]

While Nvidia enjoys huge margins on its GPUs, graphics card vendors aren’t quite so lucky, but they’re not so small that spending a few more dollars on better thermal paste isn’t going to bankrupt the company.

Mind you, if they all started using PTM7950, then none of this would be an issue—the cards would run cooler and would stay that way for much longer. The only problem then is that you’d hear the coil whine over the reduced fan noise.

Source: Nvidia’s third-party RTX 40-series GPUs are losing performance over time thanks to rubbish factory-installed thermal paste | PC Gamer

“Smart soil” grows 138% bigger crops using 40% less water

Posted on by

[…]

in areas where water is more scarce it can be hard to grow crops and feed populations, so scientists are investigating ways to boost efficiency.

Building on earlier work, the new study marks a good step in that direction. The soil gets its “smart” moniker thanks to the addition of a specially formulated hydrogel, which works to absorb more water vapor from the air overnight, then releasing it to the plants’ roots during the day. Incorporating calcium chloride into the hydrogel also provides a slow release of this vital nutrient.

A diagram of how the hydrogel works to improve the growth of crops
A diagram of how the hydrogel works to improve the growth of crops
University of Texas at Austin

The team tested the new smart soil in lab experiments, growing plants in 10 grams of soil, with some including 0.1 g of hydrogel. A day/night cycle was simulated, with 12 hours of darkness at 25 °C (77 °F) and either 60% or 90% relative humidity, followed by 12 hours of simulated sunlight at 35 °C (95 °F) and 30% humidity.

Sure enough, plants growing in the hydrogel soil showed a 138% boost to their stem length, compared to the control group. Importantly, the hydrogel-grown plants achieved this even while requiring 40% less direct watering.

[…]

The research was published in the journal ACS Materials Letters.

Source: University of Texas at Austin

Source: “Smart soil” grows 138% bigger crops using 40% less water

Space Force tests small satellite jammer to protect against a ‘space-enabled attack’

Posted on by

The U.S. Space Force is testing a new ground-based satellite jamming weapon to help keep U.S. military personnel safe from potential “space-enabled” attacks.

The tests were conducted by Space Training and Readiness Command, or STARCOM, which is responsible for educating and training U.S. Space Force personnel. The satellite jammer is known as the Remote Modular Terminal (RMT) and, like other jammers, is designed to deny, degrade, or disrupt communications with satellites overhead, typically through overloading specific portions of the electromagnetic spectrum with interference.

The RMT is “small form-factor system designed to be fielded in large numbers at low-cost and operated remotely” according to Space Force statement. Specifically, the RMT will “unlock the scale to provide counterspace electronic warfare capability to all of the new Space Force components globally,” Lt. Col. Gerrit Dalman said in the statement, meaning it can be used from virtually anywhere to deny adversaries the use of satellites orbiting overhead.

Related: US needs new space tech or it ‘will lose,’ Space Force chief says

Details about the test are scarce, but Space Force’s statement explains that two RMT units were installed at separate locations and controlled by a third. The jammer was evaluated according to metrics such as “system latency” and “target engagement accuracy,” as well as for how secure its communications were.

Guardians and an Airman during a test of the Space Force’s Remote Modular Terminal (RMT) in Colorado Springs, Colo., April 4, 2024.  (Image credit: U.S. Air Force photo by Capt. Charles Rivezzo)

The need for new space-based and counterspace technologies has been stressed by Space Force leadership in recent months.

[…]

According to a slide deck the Space Rapid Capabilities Office presented to industry in October 2023, these jammers are “small transportable systems that can be emplaced in both garrison and austere environments,” meaning they can be used whether infrastructure is present or not.

[…]

Source: Space Force tests small satellite jammer to protect against a ‘space-enabled attack’ | Space

MS tries to blame EU for Crowdstrike Fail

Posted on by

Did the EU force Microsoft to let third parties like CrowdStrike run riot in the Windows kernel as a result of a 2009 undertaking? This is the implication being peddled by the Redmond-based cloud and software titan.

As the tech industry deals with the fallout from the CrowdStrike incident, Microsoft is facing questions. Why is software like CrowdStrike permitted to run at such a low level, where a failure could spell disaster for the operating system?

To be clear, Microsoft is not to blame for the now-pulled update that continues to cause chaos. However, the underlying architecture that allows third parties to run deeply integrated software merits closer examination.

According to a report in the Wall Street Journal, a Microsoft spokesperson pointed to a 2009 undertaking by the company with the European Commission as a reason why the Windows kernel was not as protected as that of the current Apple Mac operating system, for example.

The agreement [DOC] is about interoperability and came as Microsoft was subject to European scrutiny. The undertaking seeks a level playing field and includes the following clause:

Microsoft shall ensure on an ongoing basis and in a Timely Manner that the APIs in the Windows Client PC Operating System and the Windows Server Operating System that are called on by Microsoft Security Software Products are documented and available for use by third-party security software products that run on the Windows Client PC Operating System and/or the Windows Server Operating System.

In other words, third-party security vendors must get the same access as Microsoft’s own products. Which, on the face of it, is fair enough.

However, nothing in that undertaking would have prevented Microsoft from creating an out-of-kernel API for it and other security vendors to use. Instead, CrowdStrike and its ilk run at a low enough level in the kernel to maximize visibility for anti-malware purposes. The flip side is this can cause mayhem should something go wrong.

The Register asked Microsoft if the position reported by the Wall Street Journal was still the company’s stance on why a CrowdStrike update for Windows could cause the chaos it did. The company has yet to respond.

Windows is far from the only operating system that permits software to run at a level low enough to crash a kernel. However, failures of third-party software running at a low level in Windows can be embarrassingly public, even if Microsoft is not directly to blame. ®

Source: EU gave CrowdStrike keys to Windows kernel, Microsoft claims • The Register

And indeed it did happen to Linux as well, where Crowdstrike caused kernel panics at startup. Being open has a good and a bad side, but overall the good side is a whole lot better than the bad sides.

First trial on British Army vehicle for high-powered laser weapon

Posted on by

For the first time scientists and engineers have successfully fired a high powered laser energy weapon from a British Army combat vehicle.

This ground-breaking test, conducted at Dstl’s range in Porton Down, saw the laser weapon neutralise targets at distances in excess of 1km.

The high-energy laser weapon mounted on to a British Army Wolfhound armoured vehicle, represents a major leap forward in the UK Ministry of Defence’s Land Laser Directed Energy Weapon (LDEW) Demonstrator programme, providing increased operational advantage on the battlefield.

The lightweight portable high energy laser system is the first laser weapon integrated on a land vehicle to be fired in the UK.

[…]

Matt Cork, Dstl Programme Lead, said:

The joint working between Dstl, DE&S and industry has enabled rapid evolution of this laser demonstrator. The successful testing of this high-powered laser weapon marks a pivotal moment in our ongoing efforts to enhance the future operational capabilities of the British Army. This technology offers a precise, powerful and cost effective means to defeat aerial threats, ensuring greater protection for our forces.

[…]

The system operates with a command and control system and can be integrated with wider battle management radar and surveillance systems. The weapon can be mounted on various platforms to meet different operational needs.

First trial on British Army vehicle for high-powered laser system

The British supply chain includes: Raytheon UK, Frazer-Nash, NP Aerospace, LumOptica, Blighter Surveillance Systems, and Cambridge Pixel.

[…]

Source: First trial on British Army vehicle for high-powered laser weapon – GOV.UK

So that Global Microsoft IT outage – turns out a Crowdstrike update borked your PC. Here’s some memes to make you feel better.

Posted on by

Businesses worldwide grappled with an ongoing major IT outage Friday, as financial services and doctors’ offices were disrupted, while some TV broadcasters went offline. Air travel has been hit particularly hard, with planes grounded, services delayed and airports issuing advice to passengers.

The outage came as cybersecurity giant CrowdStrike experienced a major disruption early Friday following an issue with a recent tech update.

CrowdStrike CEO George Kurtz has since said that the company is “actively working with customers impacted by a defect found in a single content update for Windows hosts,” stressing that Mac and Linux hosts are not affected.

“This is not a security incident or cyberattack. The issue has been identified, isolated and a fix has been deployed,” he said on social media.

One expert suggested it may be the “largest IT outage in history.”

Separately, Microsoft

cloud services were restored after an outage, the company said on Friday, even as many users continued to report issues.

Source: Global IT outage live updates: Microsoft-CrowdStrike blackout

Yesterday I talked about the Azure and Office 365 outage: Major IT outage hits Microsoft Azure and Office365 users worldwide leading to cancelled flights, stock exchange outages and more chaos. What a great idea cloud is for critical infrastructure!

Meta and Apple are Keeping their Next Big AI things Out of the EU – that’s a good thing

Posted on by

[…]

In a statement to The Verge, Meta spokesperson Kate McLaughlin said that the company’s next-gen Llama AI model is skipping Europe, placing the blame squarely on regulations. “We will release a multimodal Llama model over the coming months,” Mclaughlin said, “but not in the EU due to the unpredictable nature of the European regulatory environment.”

A multimodal model is one that can incorporate data between multiple mediums, like video and text, and use them together while calculating. It makes AI more powerful, but also gives it more access to your device.

The move actually follows a similar decision from Apple, which said in June that it would be holding back Apple Intelligence in the EU due to the Digital Markets Act, or DMA, which puts heavy scrutiny on certain big tech “gatekeepers,” Apple and Meta both among them.

Meta’s concerns here could be less related to the DMA and more to the new AI Act, which recently finalized compliance deadlines and will force companies to make allowances for copyright and transparency starting August 2, 2026. Certain AI use cases, like those that try to read the emotions of schoolchildren, will also be banned. As the company tries to get a hold of AI on its social media platforms, increasing pressure is the last thing it needs.

How this will affect AI-forward Meta products like Ray-Ban smart glasses remains to be seen. Meta told The Verge that future multimodal AI releases will continue to be excluded from Europe, but that text-only model updates will still come to the region.

While the EU has yet to respond to Meta’s decision, EU competition regulator Margrethe Vestager previously called Apple’s plan to keep Apple Intelligence out of the EU a “stunning open declaration” of anticompetitive behavior.

Source: Meta Is Keeping Its Next Big AI Update Out of the EU | Lifehacker

Why is this good? Because the regulatory environment is predictable and run by rules that enforce openness, security, privacy and fair competition. The fact that Apple and Meta don’t want to run this in the EU shows that they are either incapable or unwilling to comply with points that are good for the people. You should not want to do business with shady dealers like that.

Indian WazirX halts withdrawals after losing $230M worth crypto assets – still cowboy country there

Posted on by

[…] The Mumbai-based firm said one of its multisig wallets had suffered a security breach. A multisig wallet requires two or more private keys for authentication. WazirX said its wallet had six signatories, five of whom were with WazirX team. Liminal, which operates a wallet infrastructure firm, said in a statement to TechCrunch that its preliminary investigation had found that a wallet created outside its ecosystem had been compromised.

“The cyber attack stemmed from a discrepancy between the data displayed on Liminal’s interface and the transaction’s actual contents,” said WazirX in a statement on Thursday. “During the cyber attack, there was a mismatch between the information displayed on Liminal’s interface and what was actually signed. We suspect the payload was replaced to transfer wallet control to an attacker.”

Lookchain, a third-party blockchain explorer, reported that more than 200 cryptocurrencies, including 5.43 billion SHIB tokens, over 15,200 Ethereum tokens, 20.5 million Matic tokens, 640 billion Pepe tokens, 5.79 million USDT and 135 million Gala tokens were “stolen” from the platform.

Blockchain data suggests the attackers are trying to offload the assets using the decentralized exchange Uniswap. Risk-management platform Elliptic reported that the hackers have affiliation with North Korea.

About $230 million in missing assets is significant for WazirX, which reported holdings of about $500 million in its June proof-of-reserves disclosure.

[…]

This is the latest setback for WazirX, which separated from Binance in early 2023 after the two crypto exchanges had a public and high-profile fallout in 2022. Two years after Binance announced it had acquired WazirX, the two companies started a dispute over the ownership of the Indian firm. Binance founder Changpeng Zhao eventually said that the two firms hadn’t been able to conclude the deal and moved to terminate Binance’s businesses with the Indian firm.

Source: WazirX halts withdrawals after losing $230M worth crypto assets in security breach | TechCrunch

Critical Cisco bug allows anyone to change all (including admin) passwords

Posted on by

Cisco just dropped a patch for a maximum-severity vulnerability that allows attackers to change the password of any user, including admins.

Tracked as CVE-2024-20419, the bug carries a maximum 10/10 CVSS 3.1 rating and affects the authentication system of Cisco Smart Software Manager (SSM) On-Prem.

Cisco hasn’t disclosed too many details about this, which is more than understandable given the nature of the vulnerability. However we know that an unauthenticated remote attacker can exploit this to change passwords. It’s hardly ideal, and should be patched as soon as possible.

Digging into the severity assessment, the attack complexity was deemed “low”: no privileges or user interaction would be required to pull it off, and the impact on the product’s integrity, availability, and confidentiality is all designated “high.”

“This vulnerability is due to improper implementation of the password-change process,” Cisco’s advisory reads, providing the last few details about the vulnerability.

“An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.”

There are no workarounds for this vulnerability, so get those patches applied if you’re in the business of keeping your passwords safe and secure. Fortunately, there are no signs of this being exploited in the wild yet, but now the cat’s out of the bag it likely won’t be long before that changes.

CVE-2024-20419 affects both SSM On-Prem and SSM Satellite. They’re different names for the same product, only the latter refers to versions before release 7.0.

[…]

Source: Critical Cisco bug allows crims to change admin passwords • The Register

How to unsnarl a tangle of threads, according to physics

Posted on by

Physicists may have found a solution for the rage-inducing tangles that crop up in everything from electronics cords to necklaces: to free a single thread from a tangle of many, you must shake it not too fast and not too slow but with just the right frequency.

Ishant Tiwari at the Georgia Institute of Technology in Atlanta and his colleagues created a vibrating robot to determine how to best jiggle a single thread from such a tangle.

 

Read more

Human cells have a resonant frequency – and it’s just barely audible

 

The researchers gathered cotton fibres into balls by rolling them around in a box. This ensured that all the tangles they tested would be similar. The tangles were each attached to a piston on a robot by a single thread.

Tiwari and his colleagues set the robot to jerk up and down at various frequencies and vibrate the tangle, which revealed that there is a sweet spot for the perfect untangling frequency.

 

New Scientist. Science news and long reads from expert journalists, covering developments in science, technology, health and the environment on the website and the magazine.

The robot identified an ideal shaking frequency of 17 hertz (shown in the middle)

Ishant Tiwari, Bhamla Lab

 

When the shaking frequency was low – just a few shakes each second, or a few hertz – the thread that was attached to the piston moved together with the tangle and it stayed stuck. At the high end, greater than around 37 shakes per second, the tangle also remained jumbled. The energy of the shaking was diverted into damped oscillations across the whole tangle, so it tugged less on the specific thread they were trying to release from the ball.

But at about 17 shakes per second, the tangle jumped and jerked more chaotically, and each twitch contributed a small pull on the thread. When the effect of these pulls accumulated, the thread came loose from the tangle.

The researchers have presented results on only one type of thread so far, but their work may help unravel a more general property of the fibre tangles that pervade our daily lives – and how to deal with them.

 

Journal reference:

Physical Review E DOI: 10.1103/PhysRevE.110.010001

Source: How to unsnarl a tangle of threads, according to physics | New Scientist

Major IT outage hits Microsoft Azure and Office365 users worldwide leading to cancelled flights, stock exchange outages and more chaos. What a great idea cloud is for critical infrastructure!

Posted on by

Companies and banks worldwide have been reportedly hit by a mass IT outage, leading to grounded flights.

A major IT outage has reportedly hit banks, media outlets, and airlines on Friday, causing chaos at airport check-in and cancelled flights.

The outage is believed to be caused by an outage of Microsoft’s Azure and Office365 services.

Airlines such as Qantas in Australia and at least two low-cost carriers in the US – Frontier and Sun Country Airlines – have been forced to ground flights.

In Europe, users of Ryanair’s app and website also complained and not being able to check in on Friday morning, with a surge of reports noted on the outage tracking website Downdetector.com.

Source: Major IT outage hits Microsoft users worldwide leading to cancelled flights and chaos | Euronews

The tinyPod transforms your old Apple Watch into an iPod-like minimalist phone

Posted on by

The tinyPod is a case for your Apple Watch, which probably doesn’t sound too exciting on its own. However, its unique angle — a click wheel that controls the watch’s Digital Crown — makes Apple’s wearable look and feel (at least in its marketing) like the company’s first breakthrough product of the 21st century: the iPod. Although you can use it as a music player, it also works with everything else in watchOS, transforming Apple’s smartwatch into a minimalist, distraction-free “phone.”

The $80 tinyPod works with Apple Watch models in Series 4 through 9, along with the Apple Watch SE. (The 41/40mm and 45/44mm Apple Watches have separate tinyPods.) Meanwhile, another 49mm version for the Apple Watch Ultra — because who wouldn’t want to turn their $800 wearable into a minimalist phone? — costs $90. There’s also tinyPod lite, a $30 case sans click wheel.

That click wheel is its core gimmick, and its creator apparently believes it will be safe from Apple’s lawyers. (The fact that it relies on an Apple product probably doesn’t hurt.) The case’s wheel syncs its movement with the Apple Watch’s Digital Crown via “carefully mechanized components inside” that make “direct rotation contact with your Apple Watch crown.” In other words, anywhere on watchOS that lets you scroll with the crown will be scrollable with the tinyPod click wheel. In theory, anyway.

Marketing screenshot for the tinyPod. The iPod-like device sits next to icons for Phone, Music, Messaging and Mail, demonstrating its capabilities. White background.
Newar / tinyPod

The tinyPod website says it can support multi-day battery life by turning off the watch’s wrist detection (which you don’t need here). But living up to that may be a tall order, given how short the battery life of cellular Apple Watches tends to be when used without a phone in Bluetooth range. Of course, you could use a GPS-only model (or turn off cellular) and stick to locally stored music, but that would also limit what it can do.

tinyPod is the product of Newar, a former Snap designer and one-time jailbreak guru. In May, the creator posted that it began as a side project before being transformed into “a real, shipping product for one reason: Whenever I left the house with it, I loved how I felt.”

Whether the tinyPod lives up to its billing as a minimalist, distraction-free and nostalgia-laden “phone” or not, its creator appears to have put significant thought into aesthetics, clarity of purpose and consistency in marketing. Its website demonstrates an eye for detail that relishes in its iPod inspiration, including era-appropriate Apple fonts and a teaser video in a classic 4:3 aspect ratio. (Cue silhouettes dancing to Gorillaz.)

The tinyPod is available for pre-order ahead of shipments “this summer.” You can reserve one today at the product website.

Source: The tinyPod transforms your old Apple Watch into an iPod-like minimalist phone