About Robin Edgar

Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft

DARPA Open Sources Resources to Aid Evaluation of Adversarial AI Defenses

[…]DARPA’s Guaranteeing AI Robustness against Deception (GARD) program […] focuses on a few core objectives. One of which is the development of a testbed for characterizing ML defenses and assessing the scope of their applicability […]

Ensuring that emerging defenses are keeping pace with – or surpassing – the capabilities of known attacks is critical to establishing trust in the technology and ensuring its eventual use. To support this objective, GARD researchers developed a number of resources and virtual tools to help bolster the community’s efforts to evaluate and verify the effectiveness of existing and emerging ML models and defenses against adversarial attacks.

“Other technical communities – like cryptography – have embraced transparency and found that if you are open to letting people take a run at things, the technology will improve,” said Bruce Draper, the program manager leading GARD.

[…]

GARD researchers from Two Six Technologies, IBM, MITRE, University of Chicago, and Google Research have collaboratively generated a virtual testbed, toolbox, benchmarking dataset, and training materials to enable this effort. Further, they have made these assets available to the broader research community via a public repository

[…]

Central to the asset list is a virtual platform called Armory that enables repeatable, scalable, and robust evaluations of adversarial defenses. The Armory “testbed” provides researchers with a way to pit their defenses against known attacks and relevant scenarios. It also provides the ability to alter the scenarios and make changes, ensuring that the defenses are capable of delivering repeatable results across a range of attacks.

Armory utilizes a Python library for ML security called Adversarial Robustness Toolbox, or ART. ART provides tools that enable developers and researchers to defend and evaluate their ML models and applications against a number of adversarial threats, such as evasion, poisoning, extraction, and inference. The toolbox was originally developed outside of the GARD program as an academic-to-academic sharing platform.

[…]

The Adversarial Patches Rearranged In COnText, or APRICOT, benchmark dataset is also available via the repository. APRICOT was created to enable reproducible research on the real-world effectiveness of physical adversarial patch attacks on object detection systems. The dataset lets users project things in 3D so they can more easily replicate and defeat physical attacks, which is a unique function of this resource. “Essentially, we’re making it easier for researchers to test their defenses and ensure they are actually solving the problems they are designed to address,” said Draper.

[…]

Often, researchers and developers believe something will work across a spectrum of attacks, only to realize it lacks robustness against even minor deviations. To help address this challenge, Google Research has made the Google Research Self-Study repository that is available via the GARD evaluation toolkit. The repository contains “test dummies” – or defenses that aren’t designed to be the state-of-the-art but represent a common idea or approach that’s used to build defenses. The “dummies” are known to be broken, but offer a way for researchers to dive into the defenses and go through the process of properly evaluating their faults.

[…]

The GARD program’s Holistic Evaluation of Adversarial Defenses repository is available at https://www.gardproject.org/. Interested researchers are encouraged to take advantage of these resources and check back often for updates.

Source: DARPA Open Sources Resources to Aid Evaluation of Adversarial AI Defenses

minDALL-E creates images based on text input

minDALL-E on Conceptual Captions

minDALL-E, named after minGPT, is a 1.3B text-to-image generation model trained on 14 million image-text pairs for non-commercial purposes.

a painting of a bird in the style of asian painting
a photo of san francisco's golden gate bridge in black and white tone

Environment Setup

  • Basic setup
PyTorch == 1.8.0
CUDA >= 10.1
  • Other packages
pip install -r requirements.txt

Model Checkpoint

  • Model structure (two-stage autoregressive model)
    • Stage1: Unlike the original DALL-E [1], we replace Discrete VAE with VQGAN [2] to generate high-quality samples effectively. We slightly fine-tune vqgan_imagenet_f16_16384, provided by the official VQGAN repository, on FFHQ [3] as well as ImageNet.
    • Stage2: We train our 1.3B transformer from scratch on 14 million image-text pairs from CC3M [4] and CC12M [5]. For the more detailed model spec, please see configs/dalle-1.3B.yaml.
  • You can download the pretrained models including the tokenizer from this link. This will require about 5GB space.

Sampling

  • Given a text prompt, the code snippet below generates candidate images and re-ranks them using OpenAI’s CLIP [6].
  • This has been tested under a single V100 of 32GB memory. In the case of using GPUs with limited memory, please lower down num_candidates to avoid OOM.

[…]

Samples (Top-K=256, Temperature=1.0)

  • “a painting of a {cat, dog} with sunglasses in the frame”
  • “a large {pink, black} elephant walking on the beach”
  • “Eiffel tower on a {desert, mountain}”

More

There’s dalle-mini, a colab where you can run it to test it

This App Will Tell Android Users If an AirTag Is Tracking Them

Apple’s AirTags and Find My service can be helpful for finding things you lose—but they also introduce a big privacy problem. While those of us on iOS have had some tools for fighting those issues, Apple left those of us on Android without much to work with. A new Android AirTag finder app finally addresses some of those concerns.

How AirTags work

[…]

The Find My network employs the passive use of hundreds of millions of Apple devices to help expand your search. That way, you can locate your lost items even if they’re too far away for traditional wireless tracking. Your lost AirTag may be out of your own phone’s Bluetooth range, but it may not be far from another Apple device.

[…]

The Tracker Detect app comes out of a need for better security in the Find My network. Having such a wide network to track a tiny, easy-to-miss device could make it easy for someone to use AirTags to track someone.

People pointed out this vulnerability pretty soon after Apple announced the AirTags. With more than 113 million iPhones in the U.S., not to mention other Apple devices, the Find My network could be one of the widest tracking systems available. A device as small and easy-to-use as an AirTag on that network could make stalking easier than ever.

That said, Apple has a built-in feature designed to prevent tracking. If your iPhone senses that a strange AirTag, separated from its owner, is following you, it will send you an alert. If that AirTag is not found, it will start to make a sound anywhere from 8 to 24 hours after being separated from its owner.

However, Android users haven’t had these protections. That’s where Tracker Detect comes in; with this new Android AirTag app, you can scan the area to see if anyone may be tracking your location with an AirTag or other Find My-enabled accessory.

How to use Tracker Detect

If you’re concerned about people tracking you, download the Tracker Detect app from the Google Play Store. You don’t need an Apple account or any Apple devices to use it.

The app won’t scan automatically, so you’ll have to look for devices manually. To do that, open the app and tap Scan. Apple says it may take up to 15 minutes to find an AirTag that’s separated from its owner. You can tap Stop Scanning to end the search if you feel safe, and if the app detects something, it will mark it as Unknown AirTag.

Once the app has detected an AirTag, you can have it play a sound through the tag for up to ten minutes to help you find it. When you find the AirTag, you can scan it with an NFC reader to learn more about it.

[…]

 

Source: This App Will Tell Android Users If an AirTag Is Tracking Them

Researchers Teach Human Brain Cells in a Dish to Play “Pong”

[…] Researchers at the biotechnology startup Cortical Labs have created “mini-brains“ consisting of 800,000 to one million living human brain cells in a petri dish, New Scientist reports. The cells are placed on top of a microelectrode array that analyzes the neural activity.

[…]

To teach the mini-brains the game, the team created a simplified version of “Pong” with no opponent. A signal is sent to either the right or left of the array to indicate where the ball is, and the neurons from the brain cells send signals back to move the paddle.

“We often refer to them as living in the Matrix,” Kagan told the magazine, in a horrifyingly reference to the 1999 movie in which humans are enslaved by AI overlords in an all-encompassing simulation. “When they are in the game, they believe they are the paddle.”

Well, that’s a scary enough concept to cause some existential panic for anyone.

Faster Than AI

Kagan said that while the mini-brains can’t play the game as well as a human, they do learn faster than some AIs.

“The amazon aspect is how quickly it learns, in five minutes, in real time,” he told New Scientist. “That’s really an amazing thing that biology can do.”

While this is certainly some amazing Twitch fodder, the team at Cortical Labs hope to use their findings to develop sophisticated technology using “live biological neurons integrated with traditional silicon computing,” according to the outfit’s website.

[…]

Source: Researchers Teach Human Brain Cells in a Dish to Play “Pong”

Cryptocurrency ‘rug pulls’ cheated investors out of ‘$8bn’

First, come up with a catchy name for a cryptocurrency project. Next, convince the credulous to buy associated digital tokens. Finally, abandon the project and keep investors’ funds.

This “rug pulling” scam lacks sophistication but evidently it works. According to Chainalysis, a blockchain data biz, separating cryptocoin buyers from their money in this manner has become particularly popular in the DeFi (decentralized finance) ecosystem and has contributed to a scam surge.

In a post previewing the company’s 2022 Crypto Crime Report, Chainalysis said scams constituted the largest form of cryptocurrency-based crime, as measured by transaction volume. Cryptocurrency investors – if that’s the right term – lost over $7.7bn worth of digital whatever in 2021.

That’s up 81 per cent from 2020, but 2020, amid the COVID-19 pandemic, was an unusual year. This year was not quite as bad as 2019, which was close to $10bn worth of scams. But there were more scams overall (3,300 in 2021, up from 2,052 in 2020), albeit with shorter lifespans (~70 days in 2021, compared to ~192 in 2020 and to around ~2,369 in 2013).

Take-the-money-and-run gambits should not to be confused with losses attributable to security shortcomings at DeFi services that let hackers steal funds, like the recent theft of some $120m in tokens from BadgerDAO or the $31m taken from MonoX. That’s a separate dumpster fire.

Source: Cryptocurrency ‘rug pulls’ cheated investors out of ‘$8bn’ • The Register

Bitcoin’s Inequality Problem Is Putting the Dollar to Shame 0.01% owns 27% of all BTC

[…]

new research detailed in The Wall Street Journal suggests its inequality problems are worse than the United States’ disgraceful performance under the dollar. An incredible feat considering income inequality in 2020 America was the highest of all G7 nations according to data from Organization for Economic Cooperation and Development viewed by Pew Research.

That illustration, of a vanishingly small bitcoin financial elite, was revealed in a new National Bureau of Economic Research study written by professors from the MIT Sloan School of Management and London School of Economics. It found that of the 19 million bitcoin currently in circulation, just 0.01% of buyers control around 27% of the total supply. That 27% percent figure amounts to around 5 million bitcoins, which in turn comes out to about $232 billion USD. The top 1% wealthiest U.S. individuals, by comparison, control “only” about a third of all the country’s wealth, the Journal notes.

The professors conducted their research by, for the first time, mapping out and analyzing every single bitcoin transaction over its 13 years of existence.

[…]

there have been experts and academics sounding their own alarm bells around bitcoin’s potential inequality-inducing tendencies. In an interview with CNBC Cornell University, economics professor and author of The Future of Money Eswar Prasad granted cryptocurrencies may make digital payments more accessible but said that doesn’t guarantee any lessening of inequality.

“Because of existing inequalities in digital access and financial literacy, they [cryptocurrencies] could end up worsening inequality,

[…]

Despite all of this, mentions of “decentralization” and “democracy” and “independence” in relation to crypto abound as a new wave of Web3 investors and enthusiasts spend millions locking in NFTs and forming DAOs to make collective purchases.

Source: Bitcoin’s Inequality Problem Is Putting the Dollar to Shame

Malaysia in pocket of big business: Passes Bill to Imprison Illegal Streaming (even devices!) for 20 years

Laws that forbid the illegal uploading and downloading of copyrighted content are common around the world but the rise of streaming has sometimes exposed gaps in legislation.

Piracy-equipped Kodi devices, illegal streaming apps, and similar tools have led legal specialists to attempt to apply laws that didn’t envision the technology. In Malaysia, for example, it took a decision by the High Court last May to determine that the sale and distribution of streaming devices configured for piracy purposes does indeed constitute infringement under the Copyright Act.

But Malaysia was far from done. After previously informing the United States Patent and Trademark Office (USPTO) that the economic harm being caused to broadcasters and rightsholders in the country was a “serious problem”, Malaysia said it had amendments on the table to more directly tackle the illegal uploading, provision, and sharing of access to copyright works.

House of Representatives Passes Copyright Amendment Bill

This week Malaysia’s Dewan Rakyat (House of Representatives) passed the Copyright (Amendment) Bill 2021 which, among other things, will more directly address the challenges of illegal streaming.

“Act 332 is amended to ensure copyright laws implemented will provide more efficient and effective protection in line with current demands and to fulfill the needs of the business community and stakeholders,” said Domestic Trade and Consumer Affairs Minister Datuk Seri Alexander Nanta Linggi.

The amendments are focused on those involved in the provision or facilitation of illegal streams. The term “streaming technology” is repeatedly referenced and for the purposes of the act this includes computer programs (apps and other software tools), devices (streaming hardware of all kinds) that, in whole or in part, are used to infringe copyright in a protected work.

How the amendments will be used in practice remains to be seen but the scope appears to be intentionally broad and could result in significant punishments for those found to be in breach of the law.

Punishments for Illegal Streaming Facilitators

The first section of the amendment deals with those who “commit or facilitate infringement” of copyright by manufacturing a streaming technology for sale or hire, importing a streaming technology, selling or letting for hire (including offering, exposing or advertising for sale or hire), and/or possessing or distributing a streaming technology in the course of a business.

It expands to include distributing or offering to the public an infringing streaming technology or service other than in the course of a business, to such an extent “as to affect prejudicially the owner of the copyright.”

Anyone who contravenes these amendments will be guilty of an offense and upon conviction shall be liable to a fine of not less than 10 thousand ringgit (US$2,377) but not more than two hundred thousand ringgit (US$47,545). In addition to the possibility of fines, there are also custodial sentences that could reach a staggering 20 years imprisonment in the most serious of cases.

Those hoping to use a corporate structure as a shield are also put on notice. When any offenses are committed by a corporate body or by a person who is a partner in a firm, everyone from directors to managers will be deemed guilty of the offense and may be charged severally or jointly, unless they can show they had no knowledge and conducted due diligence to prevent the offense.

The details of the amendments can be found here (pdf)

Source: Malaysia Passes Bill to Imprison Illegal Streaming Pirates For Up To 20 Years * TorrentFreak

Considering the broadness of this law, it looks like selling a mobile phone, PC or laptop – which are all capable of streaming illegal content – could become punishable.

Bad things come in threes: Apache reveals another Log4J bug

The Apache Software Foundation (ASF) has revealed a third bug in its Log4 Java-based open-source logging library Log4j.

CVE-2021-45105 is a 7.5/10-rated infinite recursion bug that was present in Log4j2 versions 2.0-alpha1 through 2.16.0. The fix is version 2.17.0 of Log4j.

That’s the third new version of the tool in the last ten days.

In case you haven’t been paying attention, version 2.15.0 was created to fix CVE-2021-44228, the critical-rated and trivial-to-exploit remote code execution flaw present in many versions up to 2.14.0.

But version 2.15.0 didn’t address another issue – CVE-2021-45046 – which allowed a remote attacker with control over Thread Context Map (MDC) to cook up malicious input using a JNDI Lookup pattern. The result could be remote code execution, thankfully not in all environments.

Version 2.16.0 fixed that problem.

But it didn’t fix CVE-2021-45105, which the ASF describes as follows:

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups. When the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}), attackers with control over Thread Context Map input data can craft malicious input data that contains a recursive lookup, resulting in a StackOverflowError that will terminate the process.

Vendor-agnostic bug bounty program the Zero Day Initiative has described the flaw as follows.

When a nested variable is substituted by the StrSubstitutor class, it recursively calls the substitute() class. However, when the nested variable references the variable being replaced, the recursion is called with the same string. This leads to an infinite recursion and a DoS condition on the server.

[…]

Source: Bad things come in threes: Apache reveals another Log4J bug • The Register

Researchers uncover the surprising cause of the Little Ice Age in 1300s

New research from the University of Massachusetts Amherst provides a novel answer to one of the persistent questions in historical climatology, environmental history and the earth sciences: what caused the Little Ice Age? The answer, we now know, is a paradox: warming.

The Little Ice Age was one of the coldest periods of the past 10,000 years, a period of cooling that was particularly pronounced in the North Atlantic region. This cold spell, whose precise timeline scholars debate, but which seems to have set in around 600 years ago, was responsible for crop failures, famines and pandemics throughout Europe, resulting in misery and death for millions. To date, the mechanisms that led to this harsh climate state have remained inconclusive. However, a new paper published recently in Science Advances gives an up-to-date picture of the events that brought about the Little Ice Age. Surprisingly, the cooling appears to have been triggered by an unusually warm episode.

When lead author Francois Lapointe, postdoctoral researcher and lecturer in geosciences at UMass Amherst and Raymond Bradley, distinguished professor in geosciences at UMass Amherst began carefully examining their 3,000-year reconstruction of North Atlantic sea surface temperatures, results of which were published in the Proceedings of the National Academy of Sciences in 2020, they noticed something surprising: a sudden change from very warm conditions in the late 1300s to unprecedented cold conditions in the early 1400s, only 20 years later.

Using many detailed marine records, Lapointe and Bradley discovered that there was an abnormally strong northward transfer of warm in the late 1300s which peaked around 1380. As a result, the waters south of Greenland and the Nordic Seas became much warmer than usual. “No one has recognized this before,” notes Lapointe.

Normally, there is always a transfer of warm water from the tropics to the arctic. It’s a well-known process called the Atlantic Meridional Overturning Circulation (AMOC), which is like a planetary conveyor belt. Typically, warm water from the tropics flows north along the coast of Northern Europe, and when it reaches and meets colder arctic waters, it loses heat and becomes denser, causing the water to sink at the bottom of the ocean. This deep-water formation then flows south along the coast of North America and continues on to circulate around the world.

But in the late 1300s, AMOC strengthened significantly, which meant that far more warm water than usual was moving north, which in turn cause rapid arctic ice loss. Over the course of a few decades in the late 1300s and 1400s, vast amounts of ice were flushed out into the North Atlantic, which not only cooled the North Atlantic waters, but also diluted their saltiness, ultimately causing AMOC to collapse. It is this collapse that then triggered a substantial cooling.

Fast-forward to our own time: between the 1960s and 1980s, we have also seen a rapid strengthening of AMOC, which has been linked with persistently high pressure in the atmosphere over Greenland. Lapointe and Bradley think the same atmospheric situation occurred just prior to the Little Ice Age—but what could have set off that persistent high-pressure event in the 1380s?

The answer, Lapointe discovered, is to be found in trees. Once the researchers compared their findings to a new record of solar activity revealed by radiocarbon isotopes preserved in tree rings, they discovered that unusually high solar activity was recorded in the late 1300s. Such solar activity tends to lead to high atmospheric pressure over Greenland.

At the same time, fewer volcanic eruptions were happening on earth, which means that there was less ash in the air. A “cleaner” atmosphere meant that the planet was more responsive to changes in solar output. “Hence the effect of high solar activity on the atmospheric circulation in the North-Atlantic was particularly strong,” said Lapointe.

Lapointe and Bradley have been wondering whether such an abrupt cooling event could happen again in our age of global climate change. They note that there is now much less arctic sea ice due to global warming, so an event like that in the early 1400s, involving sea ice transport, is unlikely. “However, we do have to keep an eye on the build-up of freshwater in the Beaufort Sea (north of Alaska) which has increased by 40% in the past two decades. Its export to the subpolar North Atlantic could have a strong impact on oceanic circulation”, said Lapointe. “Also, persistent periods of over Greenland in summer have been much more frequent over the past decade and are linked with record-breaking ice melt. Climate models do not capture these events reliably and so we may be underestimating future ice loss from the ice sheet, with more freshwater entering the North Atlantic, potentially leading to a weakening or collapse of the AMOC.” The authors conclude that there is an urgent need to address these uncertainties.


Explore further

The Coastal Northeastern US is a global warming hotspot


More information: Francois Lapointe, Little Ice Age abruptly triggered by intrusion of Atlantic waters into the Nordic Seas, Science Advances (2021). DOI: 10.1126/sciadv.abi8230. www.science.org/doi/10.1126/sciadv.abi8230

Source: Winter is coming: Researchers uncover the surprising cause of the Little Ice Age

How China Uses Western Influencers As Pawns In Its Propaganda War

According to the New York Times, China is recruiting YouTubers to report on the country in a positive light and counter the West’s increasingly negative perceptions. “The videos have a casual, homespun feel. But on the other side of the camera often stands a large apparatus of government organizers, state-controlled news media and other official amplifiers — all part of the Chinese government’s widening attempts to spread pro-Beijing messages around the planet,” the report says. “State-run news outlets and local governments have organized and funded pro-Beijing influencers’ travel, according to government documents and the creators themselves. They have paid or offered to pay the creators. They have generated lucrative traffic for the influencers by sharing videos with millions of followers on YouTube, Twitter and Facebook.” An anonymous reader shares an excerpt from Techdirt, which summarizes the Times’ findings: Typically, the Chinese government support comes in the form of free organized trips around China, particularly in Xinjiang. By showing the influencers a carefully sanitized image of life in the country, the authorities don’t need to worry about negative stories. They simply make it easy for the YouTubers to present images of jolly peasants and happy city-dwellers, because that’s all they are allowed to see. One of the authors of the New York Times piece, Paul Mozur, noted on Twitter another important way that the authorities are able to help their influencer guests. Once produced, the China-friendly videos are boosted massively by state media and diplomatic Facebook and Twitter accounts: “One video by Israeli influencer Raz Gal-Or portraying Xinjiang as ‘totally normal’ was shared by 35 government connected accounts with a total of 400 million followers. Many were Chinese embassy Facebook accounts, which posted about the video in numerous languages.”

A new report from the Australian Strategic Policy Institute, “Borrowing mouths to speak on Xinjiang,” has some more statistics on this practice: “Our data collection has found that, between January 2020 and August 2021, 156 Chinese state-controlled accounts on US-based social media platforms have published at least 546 Facebook posts, Twitter posts and shared articles from [China Global Television Network], Global Times, Xinhua or China Daily websites that have amplified Xinjiang-related social media content from 13 influencer accounts. More than 50% of that activity occurred on Facebook.” Mozur says that the use of Western influencers in this way also allows employees of Beijing-controlled media, like the journalist Li Jingjing, to present themselves as independent YouTubers. On Twitter, however, she is labeled as “China state-affiliated media.” The Australian Strategic Policy Institute sees this as part of a larger problem (pdf): “labelling schemes adopted by some video-sharing and social media platforms to identify state-affiliated accounts are inconsistently applied to media outlets and journalists working for those outlets. In addition, few platforms appear to have clear policies on content from online influencers or vloggers whose content may be facilitated by state-affiliated media, through sponsored trips, for example.”

According to Mozur, China’s state broadcaster is actively looking for more influencers, offering bonuses and publicity for those who sign up. In the US, China’s consulate general is paying $300,000 to a firm to recruit influencers for the Winter Olympics, ranging from Celebrity Influencers with millions of Instagram or TikTok followers, to Nano Influencers, with merely a few thousand. The ultimate goal of deploying these alternative voices is not to disprove negative stories appearing in Western media, but something arguably worse, as the New York Times report explains: “China is the new super-abuser that has arrived in global social media,” said Eric Liu, a former content moderator for Chinese social media. “The goal is not to win, but to cause chaos and suspicion until there is no real truth.”

Source: How China Uses Western Influencers As Pawns In Its Propaganda War – Slashdot

The FDA Just Approved Eye Drops to Correct Aging near sighted Vision

[…] It’s estimated that a quarter of the world’s population is affected by the condition known as presbyopia, which is one of the many unfortunate side effects of aging that typically starts affecting people in their 40s. The condition limits a person’s ability to focus on nearby objects, such as small print

[…]

he use of eye drops once every morning.

The active ingredient in Vuity is pilocarpine, which is often used to treat dry mouth because it stimulates the production of saliva, but it also causes the eye to reduce the size of the pupil’s opening. Like reducing the size of the aperture on a camera, this increases the eye’s depth of field, resulting in more of what’s seen being in focus, including close-up objects.

In human studies where a total of 750 participants aged 40-55 diagnosed with presbyopia were either given Vuity or a placebo, those using the Vuity eye drops gained the ability to read three or more additional lines of text on an optometrist’s reading chart (where each subsequent line contains smaller and smaller samples of text) and maintain those improvements after 30 days of use without affecting distance vision. However, Vuity was found to be considerably less helpful for patients over 65, who would need to rely on more traditional approaches to correcting vision issues.

The studies were conducted three hours after doses were administered, and it takes about that long for the full effect of Vuity to kick in, but the effect typically lasts for about a full day, which means the eye drops really only need to be applied once every morning. A reduction in pupil size does mean less light is entering the eye and hitting the retina, but it shouldn’t have an effect on users’ vision, given the eye’s impressive ability to adapt to changing lighting conditions.

[…]

Source: The FDA Just Approved Eye Drops to Correct Aging Vision

Banks, ISPs Increasingly Embrace ‘Voice Print’ Authentication Despite Growing Security Risk

While it’s certainly possible to sometimes do biometrics well, a long line of companies frequently… don’t. Voice print authentication is particularly shaky, especially given the rise of inexpensive voice deepfake technology. But, much like the continued use of text-message two-factor authentication (which is increasingly shown to not be secure), it apparently doesn’t matter to a long list of companies.

Banks and telecom giants alike have started embracing voice authentication tech at significant scale despite the added threat to user privacy and security. And they’re increasingly collecting user “voice print” data without any way to opt out:

“despite multiple high-profile cases of scammers successfully stealing money by impersonating people via deepfake audio, big banks and ISPs are rolling out voice-based authentication at scale. The worst offender that I could find is Chase. There is no “opt in”. There doesn’t even appear to be a formal way to “opt out”! There is literally no way for me to call my bank without my voice being “fingerprinted” without my consent.”

[…]

Source: Banks, ISPs Increasingly Embrace ‘Voice Print’ Authentication Despite Growing Security Risk | Techdirt

Why our electronics break: what we can learn from nearly 10 years of repairs over 50k broken items

We now have data on over 21,000 broken items and what was done to fix them. This information comes from volunteers at our own events and others who use our community repair platform, restarters.net.

Thanks to our partners in the Open Repair Alliance who also collect this kind of data, we were able to include extra data from other networks around the world.

Together, this brought the total to nearly 50,000 broken items.

Want to see this data for yourself? Download the full dataset here
(Note: Links to the datasets that contain fault types are further down this page)

That’s a lot of data. So to analyse it, we focused on three types of products that the European Commission would be investigating:

  • Printers
  • Tablets
  • The batteries that power many of our gadgets.

[…]

Thanks to this collective effort, we were able to identify the most common reasons printers, tablets and batteries become unusable.

A diagram showing the most common tablet problems
These findings are based on the analysis of problems in 647 tablets brought to community repair events, but don’t include 131 tablets with poor data quality, making it impossible to confirm the main fault.

In addition, many of the items we looked at were fairly old, demonstrating that people really want to keep using their devices for longer.

But we also found that there are lots of barriers to repair that make this tricky. Some of the biggest are the lack of spare parts and repair documentation as well as designs that make opening the product difficult without causing extra damage.

You can see our full results and download the data for yourself here:

[…]

We want rules that make products easier to fix. And we’re already using data to push for a real Right to Repair. Just recently, we used previous findings to undermine an industry lobbyist’s anti-repair arguments in an EU policy meeting about upcoming regulations for smartphone and tablet repairability.

As a follow up, we also contributed our findings on common fault types in tablets, making the case for the need for better access to spare parts and repair information for this product category as well.

Next, we hope to increase the pressure on European policymakers for regulating printer repairability and battery-related issues in consumer products. For printers, the European Commission is considering rejecting a “voluntary agreement” proposed by industry, which ignores repairability for consumer printers.

And as for batteries, European institutions are working towards a Batteries Regulation, which must prioritise user-replaceability as well as the availability of spare parts.

[…]

Source: Why our electronics break: what we can learn from nearly 10 years of repairs – The Restart Project

Apple Removes All References to Controversial CSAM Scanning Feature – where they would scan all the pictures you took

Apple has quietly nixed all mentions of CSAM from its Child Safety webpage, suggesting its controversial plan to detect child sexual abuse images on iPhones and iPads may hang in the balance following significant criticism of its methods.

Apple in August announced a planned suite of new child safety features, including scanning users’ iCloud Photos libraries for Child Sexual Abuse Material (CSAM), Communication Safety to warn children and their parents when receiving or sending sexually explicit photos, and expanded CSAM guidance in Siri and Search.

Following their announcement, the features were criticized by a wide range of individuals and organizations, including security researchers, the privacy whistleblower Edward Snowden, the Electronic Frontier Foundation (EFF), Facebook’s former security chief, politicians, policy groups, university researchers, and even some Apple employees.

The majority of criticism was leveled at Apple’s planned on-device CSAM detection, which was lambasted by researchers for relying on dangerous technology that bordered on surveillance, and derided for being ineffective at identifying images of child sexual abuse.

[…]

Source: Apple Removes All References to Controversial CSAM Scanning Feature From Its Child Safety Webpage [Updated] – MacRumors

Hackers Steal $135 Million From Users of Crypto Gaming Company

In the latest hack targeting cryptocurrency investors, hackers stole around $135 million from users of the  blockchain gaming company VulcanForge, according to the company.

The hackers stole the private keys to access 96 wallets, siphoning off 4.5 million PYR, which is VulcanForge’s token that can be used across its ecosystem, the company said in a series of tweets on Sunday and Monday. VulcanForge’s main business involves creating games such as VulcanVerse, which it describes as an “MMORPG,” and a card game called Berserk. Both titles, like pretty much all blockchain games, appear chiefly designed as vehicles to buy and sell in-game items linked to NFTs using PYR.

[…]

This is the third major theft of cryptocurrency in the last eleven days. The total amount of stolen cryptocurrency in these three hacks is around $404 million. On Dec. 2, it was BadgerDAO, a blockchain-based decentralized finance (DeFi) platform, which lost $119 million. The company is asking the hacker to please “do the right thing” and return the money. Then four days later, cryptocurrency exchange BitMart got hacked, losing $150 million.

The VulcanForge hack is notable because, like many new tokens, PYR trades on decentralized exchanges. Decentralized exchanges run on smart contracts, and because there’s no centralized order book, investors trade against “liquidity pools” with funds contributed by users who earn a “staking” reward in return. It also means there’s no central authority to blocklist a malicious account trying to cash out stolen funds.

Since the hack, VulcanForge has advised users to remove their liquidity in order to make it difficult or impossible for the attacker to cash out. As The Block reported, the hacker has so far managed to cash out most of the tokens by trading small amounts at a time, although not without sending PYR’s price into a downward spiral due to the sell pressure. On Discord, a bot message has been asking users every half hour: “Anyone that has LP in uniswap or quickswap remove it ASAP.”

[…]

Source: Hackers Steal $140 Million From Users of Crypto Gaming Company

Ukraine arrests 51 for selling data of 300 million people in US, EU

Ukrainian law enforcement arrested 51 suspects believed to have been selling stolen personal data on hacking forums belonging to hundreds of millions worldwide, including Ukraine, the US, and Europe.

“As a result of the operation, about 100 databases of personal data relevant for 2020-2021 were seized,” the Cyberpolice Department of the National Police of Ukraine said.

“The seized databases contained information on more than 300 million citizens of Ukraine, Europe and the United States”

Following this large-scale operation, Ukrainian police also shut down one of the largest sites used to sell personal information stolen from both Ukrainians and foreigners (the site’s name was not revealed in the press release).

On the now shutdown illegal marketplace, suspects were selling a wide range of stolen personal data, including telephone numbers, surnames, names, addresses, and, in some cases, vehicle registration info.

[…]

Source: Ukraine arrests 51 for selling data of 300 million people in US, EU

Gumtree users’ locations were visible by pressing F12, wouldn’t pay bug bounty to finder

UK online used goods bazaar Gumtree exposed its users’ home addresses in the source code of its webpages, and then tried to squirm out of a bug bounty after infosec bods alerted it to the flaw.

British company Pen Test Partners (PTP) spotted the data leakage, which meant anyone could view a Gumtree user’s name and location (either postcode or GPS coordinates) by pressing F12 in their web browser.

In both Firefox and Chrome, F12 opens the “view page source” developer tools screen, showing the code that generates the webpage you see. This meant that anyone could view the precise location of any of the site’s 1.7 million monthly sellers.

PTP claimed it encountered a brick wall of indifference in its first attempts to alert Gumtree to the data breach.

The bug bounty policy specified €500-€5,000, PTP added, and “after the issue was fixed, [it was] informed that no reward was payable because – ‘This is a Responsible Disclosure report, meaning that receiving a reward is a bonus in itself.'”

In a blog post about the kerfuffle, a PTP rsearcher said: “After I queried which of their rules I’d broken on responsible disclosure, they changed their mind and paid the minimum.”

[…]

Source: Gumtree users’ locations were visible by pressing F12 • The Register

Don’t Buy an HDMI 2.1 TV Before You Read the Fine Print

[…]If deciphering every version of HDMI wasn’t already tedious enough, we now know that the latest and greatest HDMI 2.1 standard, well, isn’t very standardized. A TFTCentral investigation revealed that the TV or monitor you purchase with “HDMI 2.1″ might not support any of the latest features.

TFTCentral smelled something fishy when it saw that a Xiaomi monitor with HDMI 2.1 support only reached the specifications for HDMI 2.0. Instead of 4K resolution, the panel was limited to 1080p. And the thing is, Xiaomi technically didn’t do anything wrong. It all comes down to semantics and some murky (and consumer-hostile) guidelines set by the HDMI Licensing Administrator.

[…]

in short, HDMI 2.0 is a subset of HDMI 2.1, meaning its specifications are housed within the newer standard. The standards organization even said it would no longer certify for HDMI 2.0, telling TFTCentral that HDMI 2.0 “no longer exists” and that the features and capabilities of HDMI 2.1 are optional. As long as a monitor supports one of the newer standards, it can be called HDMI 2.1.

As you’d expect, HDMI 2.1 consists of many standards, so TV and monitor makers could theoretically grab the lowest hanging fruit, add it to their (formerly) HDMI 2.0 ports, and slap an HDMI 2.1 label on the box.

The HDMI standards body even confirmed to The Verge that what Xiaomi is doing is perfectly within the rules and that we all depend on manufacturers to be honest about their products. The problem is that they rarely are.

[…]

HDMI 2.1 has made headlines in recent months because of the capabilities it enables on next-gen consoles and gaming PCs—specifically, the ability to run 4K games at 120Hz.

[…]

Source: Don’t Buy an HDMI 2.1 TV Before You Read the Fine Print

New IBM and Samsung transistors could be key to super-efficient vertical chips

IBM and Samsung claim they’ve made a breakthrough in semiconductor design. On day one of the IEDM conference in San Francisco, the two companies unveiled a new design for stacking transistors vertically on a chip. With current processors and SoCs, transistors lie flat on the surface of the silicon, and then electric current flows from side-to-side. By contrast, Vertical Transport Field Effect Transistors (VTFET) sit perpendicular to one another and current flows vertically.

[…]

the design leads to less wasted energy thanks to greater current flow. They estimate VTFET will lead to processors that are either twice as fast or use 85 percent less power than chips designed with FinFET transistors.

[…]

Source: New IBM and Samsung transistors could be key to super-efficient chips (updated) | Engadget

This Air Force Targeting AI Thought It Had a 90% Success Rate. It Was More Like 25%

If the Pentagon is going to rely on algorithms and artificial intelligence, it’s got to solve the problem of “brittle AI.” A top Air Force official recently illustrated just how far there is to go.

In a recent test, an experimental target recognition program performed well when all of the conditions were perfect, but a subtle tweak sent its performance into a dramatic nosedive,

Maj. Gen. Daniel Simpson, assistant deputy chief of staff for intelligence, surveillance, and reconnaissance, said on Monday.

Initially, the AI was fed data from a sensor that looked for a single surface-to-surface missile at an oblique angle, Simpson said. Then it was fed data from another sensor that looked for multiple missiles at a near-vertical angle.

“What a surprise: the algorithm did not perform well. It actually was accurate maybe about 25 percent of the time,” he said.

That’s an example of what’s sometimes called brittle AI, which “occurs when any algorithm cannot generalize or adapt to conditions outside a narrow set of assumptions,” according to a 2020 report by researcher and former Navy aviator Missy Cummings. When the data used to train the algorithm consists of too much of one type of image or sensor data from a unique vantage point, and not enough from other vantages, distances, or conditions, you get brittleness, Cummings said.

[…]

But Simpson said the low accuracy rate of the algorithm wasn’t the most worrying part of the exercise. While the algorithm was only right 25 percent of the time, he said, “It was confident that it was right 90 percent of the time, so it was confidently wrong. And that’s not the algorithm’s fault. It’s because we fed it the wrong training data.”

Source: This Air Force Targeting AI Thought It Had a 90% Success Rate. It Was More Like 25% – Defense One

Scott Morrison urged to end ‘lunacy’ and push UK and US for Julian Assange’s release by Australian PMs

Australian parliamentarians have demanded the prime minister, Scott Morrison, intervene in the case of Julian Assange, an Australian citizen, after the United States won a crucial appeal in its fight to extradite the WikiLeaks founder on espionage charges.

“The prime minister must get Assange home,” the Australian Greens leader, Adam Bandt, told Guardian Australia on Saturday.

“An Australian citizen is being prosecuted for publishing details of war crimes, yet our government sits on its hands and does nothing.”

WikiLeaks founder Julian Assange.
WikiLeaks founder Julian Assange. Photograph: Daniel Leal-Olivas/AFP/Getty Images

The independent MP Andrew Wilkie called on Morrison to “end this lunacy” and demand the US and UK release Assange.

[…]

Source: Scott Morrison urged to end ‘lunacy’ and push UK and US for Julian Assange’s release | Australian politics | The Guardian

‘Cowboy Bebop’ Canceled by Netflix After One Season

That was fast: Netflix has canceled its ambitious, widely hyped and, ultimately, widely disappointing anime adaptation Cowboy Bebop, The Hollywood Reporter has learned.

The move comes less than three weeks after the show’s Nov. 19 debut on the streaming service.

The space Western had a rough reception. The 10-episode series garnered only a 46 percent positive critics rating on review aggregator Rotten Tomatoes. Fans seemed to agree, giving the show a 56 percent positive audience score on the site. According to Netflix’s Top 10 site, the series has racked up almost 74 million viewing hours worldwide since its debut — so it got plenty of sampling out of the gate — but it plummeted 59 percent for the week of Nov. 29 to Dec. 5.

Insiders pointed out that Netflix’s renewal rate for scripted series that have two or more seasons stands at 60 percent, in line with industry averages, and, like all Netflix renewal verdicts, the decision was made by balancing the show’s viewership and cost. The streamer also prides itself on taking big swings on projects like Cowboy Bebop and has many other genre shows on the air and in the works.

[…]

Source: ‘Cowboy Bebop’ Canceled by Netflix After One Season – The Hollywood Reporter

What a shame – there seems to have been some fashion in bashing this show, especially from people who were 12 when they watched the original and endowed it with some completely non-existing properties. I liked the original and thought this one was brilliant too. This is why we can’t have nice things.

FAA: No more commercial astronaut wings, too many launching. You still get to be on a list.

Heads up, future space travelers: No more commercial astronaut wings will be awarded from the Federal Aviation Administration after this year.

The FAA said Friday it’s clipping its astronaut wings because too many people are now launching into space and it’s getting out of the astronaut designation business entirely.

The news comes one day ahead of Blue Origin’s planned liftoff from West Texas with former NFL player and TV celebrity Michael Strahan. He and his five fellow passengers will still be eligible for wings since the FAA isn’t ending its long-standing program until Jan. 1.

NASA’s astronauts also have nothing to worry about going forward—they’ll still get their pins from the .

All 15 people who rocketed into space for the first time this year on private U.S. flights will be awarded their wings, according to the FAA. That includes Blue Origin founder Jeff Bezos and Virgin Galactic’s Richard Branson, as well as the other space newbies who accompanied them on their brief up-and-down trips. The companies handed out their own version of astronaut wings after the flights.

All four passengers on SpaceX’s first private flight to orbit last September also qualified for FAA wings.

Adding Blue Origin’s next crew of six will bring the list to 30. The FAA’ s first commercial wings recipient was in 2004.

Earlier this year, the FAA tightened up its qualifications, specifying that awardees must be trained crew members, versus paying customers along for the ride. But with the program ending, the decision was made to be all-inclusive, a spokesman said.

Future space tourists will get their names put on a FAA commercial spaceflight list. To qualify, they must soar at least 50 miles (80 kilometers) on an FAA-sanctioned launch.

Source: FAA: No more commercial astronaut wings, too many launching

The European Commission is making its software open source to benefit society – considering it was paid for by the tax payers it’s the least they could do and should have done this years ago

The European Commission has announced that it’s adopting new rules around open source software which will see it release software under open source licenses. The decision follows a Commission study that found investment in open source software leads on average to four times higher returns. There has also been a push for this type of action from the Public Money, Public Code campaign.

If you’re wondering what sort of code the EC could offer to the world, it gave two examples. First, there’s its eSignature, a set of free standards, tools, and services that can speed up the creation and verification of electronic signatures that are legally valid inside the EU. Another example is LEOS (Legislation Editing Open Software) which is used to draft legal texts.

[…]

Source: The European Commission is making its software open source to benefit society – Neowin

Julian Assange can be extradited to the US, court rules, changes mind because US tells judge to.

Wikileaks founder Julian Assange can be extradited from the UK to the US, the High Court has ruled.

The US won its appeal against a January UK court ruling that he could not be extradited due to concerns over his mental health.

Judges were reassured by US promises to reduce the risk of suicide. His fiancee said they intended to appeal.

Mr Assange is wanted in the US over the publication of thousands of classified documents in 2010 and 2011.

Senior judges found the lower judge had based her decision in January on the risk of Mr Assange being held in highly restrictive prison conditions if extradited.

However, the US authorities later gave assurances that he would not face those strictest measures unless he committed an act in the future that merited them.

Giving the judgement, Lord Chief Justice Lord Burnett said: “That risk is in our judgement excluded by the assurances which are offered.

“It follows that we are satisfied that, if the assurances had been before the judge, she would have answered the relevant question differently.”

Mr Assange’s fiancee Stella Moris called the ruling “dangerous and misguided”, adding that the US assurances were “inherently unreliable”.

[…]

Wikileaks editor-in-chief Kristinn Hrafnsson said in a statement: “Julian’s life is once more under grave threat, and so is the right of journalists to publish material that governments and corporations find inconvenient.

“This is about the right of a free press to publish without being threatened by a bullying superpower.”

Amnesty International described the ruling as a “travesty of justice” and the US assurances as “deeply flawed”.

Nils Muiznieks, the human rights organisation’s Europe director, said it “poses a grave threat to press freedom both in the Unites States and abroad”.

Judges ordered the case must return to Westminster Magistrates’ Court for a district judge to send it formally to Home Secretary Priti Patel.

Mr Assange’s legal team – Birnberg Peirce Solicitors – said any appeal to the Supreme Court would relate to the question of assurances, rather than on issues such as free speech or “the political motivation of the US extradition request”.

Source: Julian Assange can be extradited to the US, court rules – BBC News