Author Archives: Robin Edgar

About Robin Edgar

Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft

Europe’s top court confirms no mass surveillance without limits

Posted on by

Europe’s top court has delivered another slap-down to indiscriminate government mass surveillance regimes.

In a ruling today the CJEU has made it clear that national security concerns do not exclude EU Member States from the need to comply with general principles of EU law such as proportionality and respect for fundamental rights to privacy, data protection and freedom of expression.

However the court has also allowed for derogations, saying that a pressing national security threat can justify limited and temporary bulk data collection and retention — capped to ‘what is strictly necessary’.

While threats to public security or the need to combat serious crime may also allow for targeted retention of data provided it’s accompanied by ‘effective safeguards’ and reviewed by a court or independent authority.

 

The reference to the CJEU joined a number of cases, including legal challenges brought by rights advocacy group Privacy International to bulk collection powers baked into the UK’s Investigatory Powers Act; a La Quadrature du Net (and others’) challenge to a 2015 French decree related to specialized intelligence services; and a challenge to Belgium’s 2016 law on collection and retention of comms data.

Civil rights campaigners had been eagerly awaiting today’s judgements from the Grand Chamber, following an opinion by an advisor to the court in January which implied certain EU Member States’ surveillance regimes were breaching the law.

At the time of writing key complainants had yet to issue a response.

Of course a government agency’s definition of how much data collection is ‘strictly necessary’ in a national security context (or, indeed, what constitutes an ‘effective safeguard’) may be rather different to the benchmark of civil rights advocacy groups — so it seems unlikely this ruling will be the last time the CJEU is asked to clarify where the legal limits of mass surveillance lie.

 

Additionally, the judgement raises interesting questions over the UK’s chances of gaining a data protection adequacy agreement from the European Commission — as it leaves the EU in 2021 at the end of the brexit transition process this year — something it needs for digital data flows from the EU to continue uninterrupted as now.

The problem is the UK’s Investigatory Powers Act (IPA) gives government agencies broad powers to intercept and retain digital communications — but here the CJEU is making it clear that such bulk powers must be the exception, not the statutory rule.

So, again, a battle over definitions could be looming…

[…]

Another interesting component of today’s CJEU judgement suggests that in EU states with indiscriminate mass surveillance regimes there could be grounds for overturning individual criminal convictions which are based on evidence obtained via such illegal surveillance.

On this, the court writes in a press release: “As EU law currently stands, it is for national law alone to determine the rules relating to the admissibility and assessment, in criminal proceedings against persons suspected of having committed serious criminal offences, of information and evidence obtained by the retention of data in breach of EU law. However, the Court specifies that the directive on privacy and electronic communications, interpreted in the light of the principle of effectiveness, requires national criminal courts to disregard information and evidence obtained by means of the general and indiscriminate retention of traffic and location data in breach of EU law, in the context of such criminal proceedings, where those persons suspected of having committed criminal offences are not in a position to comment effectively on that information and evidence.”

Update: Privacy International has now responded to the CJEU judgements, saying the UK, French and Belgian surveillance regimes must be amended to be brought within EU law.

In a statement, legal director Caroline Wilson Palow said: “Today’s judgment reinforces the rule of law in the EU. In these turbulent times, it serves as a reminder that no government should be above the law. Democratic societies must place limits and controls on the surveillance powers of our police and intelligence agencies.

“While the Police and intelligence agencies play a very important role in keeping us safe, they must do so in line with certain safeguards to prevent abuses of their very considerable power. They should focus on providing us with effective, targeted surveillance systems that protect both our security and our fundamental rights.”

Source: Europe’s top court confirms no mass surveillance without limits | TechCrunch

Smart male chastity hack could lock all dicks up permanently, require grinder to unlock. Also tells anyone where you are

Posted on by
  • Smart Bluetooth male chastity lock, designed for user to give remote control to a trusted 3rd party using mobile app/API
  • Multiple API flaws meant anyone could remotely lock all devices and prevent users from releasing themselves
  • Removal then requires an angle grinder or similar, used in close proximity to delicate and sensitive areas
  • Precise user location data also leaked by API, including personal information and private chats
  • Vendor initially responsive, then missed three remediation deadlines they set themselves over a 6 month period
  • Then finally refused to interact any further, even though majority of issues were resolved in migration to v2 API, yet API v1 inexcusably left available
  • This post is published in coordination with Internet of Dongs.

Smart adult toys and us

We haven’t written about smart adult toys in a long time, but the Qiui Cellmate chastity cage was simply too interesting to pass by. We were tipped off about the adult chastity device, designed to lock-up the wearer’s appendage.

There are other male chastity devices available but this is a Bluetooth (BLE) enabled lock and clamp type mechanism with a companion mobile app. The idea is that the wearer can give control of the lock to someone else.

We are not in the business of kink shaming. People should be able to use these devices safely and securely without the risk of sensitive personal data being leaked.

The security of the teledildonics field is interesting in its own right. It’s worth noting that sales of smart adult toys has risen significantly during the recent lockdown.

What is the risk to users?

We discovered that remote attackers could prevent the Bluetooth lock from being opened, permanently locking the user in the device. There is no physical unlock. The tube is locked onto a ring worn around the base of the genitals, making things inaccessible. An angle grinder or other suitable heavy tool would be required to cut the wearer free.

Location, plaintext password and other personal data was also leaked, without need for authentication, by the API.

We had particular problems during the disclosure process, as we would usually ask the vendor to take down a leaky API whilst remediation was being implemented. However, anyone currently using the device when the API was taken offline would also be permanently locked in!

As you will see in the disclosure timeline at the bottom of this post, some issues were remediated but others were not, and the vendor simply stopped replying to us, journalists, and retailers. Given the trivial nature of finding some of these issues, and that the company is working on another device that poses even greater potential physical harm (an “internal” chastity device), we have felt compelled to publish these findings at this point.

Source: Smart male chastity lock cock-up | Pen Test Partners

The IRS Is Being Investigated for Using Bought Location Data Without a Warrant – Wait there’s a company called Venntel that sells this and that’s OK?

Posted on by

The body tasked with oversight of the IRS announced in a letter that it will investigate the agency’s use of location data harvested from ordinary apps installed on peoples’ phones, according to a copy of the letter obtained by Motherboard.

The move comes after Senators Ron Wyden and Elizabeth Warren demanded a formal investigation into how the IRS used the location data to track Americans without a warrant.

“We are going to conduct a review of this matter, and we are in the process of contacting the CI [Criminal Investigation] division about this review,” the letter, signed by J. Russell George, the Inspector General, and addressed to the Senators, reads. CI has a broad mandate to investigate abusive tax schemes, bankruptcy fraud, identity theft, and many more similar crimes. Wyden’s office provided Motherboard with a copy of the letter on Tuesday.

In June, officials from the IRS Criminal Investigation unit told Wyden’s office that it had purchased location data from a contractor called Venntel, and that the IRS had tried to use it to identify individual criminal suspects. Venntel obtains location data from innocuous looking apps such as games, weather, or e-commerce apps, and then sells access to the data to government clients.

A Wyden aide previously told Motherboard that the IRS wanted to find phones, track where they were at night, use that as a proxy as to where the individual lived, and then use other data sources to try and identify the person. A person who used to work for Venntel previously told Motherboard that Venntel customers can use the tool to see which devices are in a particular house, for instance.

The IRS’ attempts were not successful though, as the people the IRS was looking for weren’t included in the particular Venntel data set, the aide added.

But the IRS still obtained this data without a warrant, and the legal justification for doing so remains unclear. The aide said that the IRS received verbal approval to use the data, but stopped responding to their office’s inquiries.

[…]

Source: The IRS Is Being Investigated for Using Location Data Without a Warrant

Facebook revenue chief says ad-supported model is ‘under assault’ – boo hoo, turns out people like their privacy

Posted on by

Facebook Chief Revenue Officer David Fischer said Tuesday that the economic models that rely on personalized advertising are “under assault” as Apple readies a change that would limit the ability of Facebook and other companies to target ads and estimate how well they work.

The change to Apple’s identifier for advertisers, or IDFA, will give iPhone users the option to block tracking when opening an app. It was originally planned for iOS 14, the version of the iPhone operating system that was released last month. But Apple said last month it was delaying the rollout until 2021 “to give developers time to make necessary changes.”

Fischer, speaking at a virtual Advertising Week session Tuesday, spoke about the changes after being asked about Facebook’s vulnerability to the companies that control mobile platforms, such as Apple and Google, which runs Android.

Fischer argued that though there’s “angst and concern” about the risks of technology, personalized and targeted advertising has been essential to help the internet grow.

“The economic model that not just we at Facebook but so many businesses rely on, this model is worth preserving, one that makes content freely available, and the business that makes it run and hum, is via advertising,” he said.

“And right now, frankly, some of that is under assault, that the very tools that entrepreneurs, that businesses are relying on right now are being threatened. To me, the changes that Apple has proposed, pretty sweeping changes, are going to hurt developers and businesses the most.”

Apple frames the change as preserving users’ privacy, rather than as an attack on the advertising industry, and has been promoting its privacy features as a core reason to get an iPhone. It comes as consumers are increasingly wary about their online privacy following scandals with various companies, including Facebook.

[…]

Source: Facebook revenue chief says ad-supported model is ‘under assault’

Apple, Facebook, Google, Amazon Are Monopolies: Antitrust Committee

Posted on by

Just as you suspected, Big Tech is dominated by monopolies, a House Judiciary antitrust subcommittee found.

After more than a year of investigating Apple, Facebook, Google, and Amazon’s behavior, lawmakers released a 449-page report with their findings on Tuesday, complete with recommendations that the four companies be broken up to make the market more competitive.

The committee found that each company dominated its respective markets—Facebook in social networking, Google in general online search and search advertising, Amazon in online retail, and Apple in mobile operating systems—to such an extent as to be anticompetitive. The companies “abuse their power by charging exorbitant fees, imposing oppressive contract terms, and extracting valuable data from the people who rely on them,” the Democratic-led committee’s report outlined.

The report goes on to eviscerate the four companies: “To put it simply, companies that once were scrappy, underdog startups that challenged the status quo have become the kinds of monopolies we last saw in the era of oil barons and railroad tycoons. Although these firms have delivered clear benefits to society, the dominance of Amazon, Apple, Facebook, and Google has come at a price. These firms typically run the marketplace while also competing in it — a position that enables them to write one set of rules for others, while they play by another, or to engage in a form of their own private quasi regulation that is unaccountable to anyone but themselves.”

Not only do those companies acquire smaller ones, either to hire their talent or to kill or incorporate their products, but their mere existence chills potential investment to start-ups that may be considered competitive, the committee found.

The committee also noted that Big Tech’s acquisitions haven’t been closely vetted by regulators. For example, Facebook has snatched up nearly 100 smaller companies over the years, and just one, its deal to acquire Instagram in 2012, received scrutiny from the Federal Trade Commission.

That lack of oversight, according to the findings, has degraded the user experience in many cases because tech companies don’t have any competition to do better—particularly when it comes to privacy.

“In the absence of adequate privacy guardrails in the United States, the persistent collection and misuse of consumer data is an indicator of market power online,” the committee noted. “Online platforms rarely charge consumers a monetary price—products appear to be ‘free’ but are monetized through people’s attention or with their data. In the absence of genuine competitive threats, dominant firms offer fewer privacy protections than they otherwise would, and the quality of these services has deteriorated over time. As a result, consumers are forced to either use a service with poor privacy safeguards or forego the service altogether.”

In addition to recommending that the companies effectively be broken up, the committee recommended that antitrust laws and federal antitrust agencies be restored “to full strength.” Specifically, the committee advised that strengthening Section 7 of the Clayton Act and Section 2 of the Sherman Act would go a long way toward giving antitrust legislation more teeth.

Of course, the Big Four aren’t going to take this lying down. Amazon released a lengthy statement in which it argued that being a big company doesn’t necessarily make it an anticompetitive one, and that it comprises just 4% of the U.S. retail market. (Frankly, I am not at all sure how it arrived at that number—the antitrust committee pegged Amazon as controlling more than 40% of all online U.S. retail sales.) The company also argued that it helps consumers find low prices and small businesses find new markets. The committee noted that 37% of all third-party sellers on Amazon rely on the platform exclusively for income.

Source: Apple, Facebook, Google, Amazon Are Monopolies: Antitrust Committee

I have been talking about exactly this since the beginning of 2019 – it’s good to see others agree with me!

They are effectively accountable to no one and as a result “wield their dominance in ways that erode entrepreneurship, degrade Americans’ privacy online, and undermine the vibrancy of the free and diverse press. The result is less innovation, fewer choices for consumers, and a weakened democracy.”

[…]

It uses Facebook’s internal documents to argue that its “monopoly power is firmly entrenched and unlikely to be eroded by competitive pressure from new entrants or existing firms.” And it attacks the social network, arguing that “in the absence of competition, Facebook’s quality has deteriorated over time, resulting in worse privacy protections for its users and a dramatic rise in misinformation on its platform.”

Google, it says upfront, “has a monopoly in the markets for general online search and search advertising.” And, it finds, it has “maintained its monopoly over general search through a series of anti-competitive tactics,” including undermining other search providers, stealing content “to boost Google’s own inferior vertical offerings,” and penalizing competitors.

By growing into ever more services and connecting them together, Google “increasingly functions as an ecosystem of interlocking monopolies,” the report states.

Amazon has “engaged in extensive anti-competitive conduct in its treatment of third-party sellers” and has abused its role as both seller and marketplace controller, the report states. Both its Alexa digital assistant and Amazon Web Services (AWS) are identified as potential targets of antitrust activity and possible diversification.

And Apple “exerts monopoly power in the mobile app store market, controlling access to more than 100 million iPhones and iPads in the US.”

The reports notes: “In the absence of competition, Apple’s monopoly power over software distribution to iOS devices has resulted in harms to competitors and competition, reducing quality and innovation among app developers, and increasing prices and reducing choices for consumers.”

The report is also heavy on the impact of these monopolies: it accuses Facebook and Google of being a significant factor in “the decline of trustworthy sources of news, which is essential to our democracy.”

It argues that collectively the tech giants have “materially weakened innovation and entrepreneurship in the US economy.” And that they have undermined Americans’ basic right to privacy by developing and driving business models that work by selling personal data rather than accepting payment directly.

Give me liberty or give me… the FTC

And, in a final punch to the face, the report accuses them of “undermining both political and economic liberties” by instilling fear through the use of their “unaccountable and arbitrary power,” and using their massive resources to direct and influence policy-making “further shaping how they are governed and regulated.”

In order to counteract all these negative impacts, the report makes a long series of recommendations, including, most significantly, “structural separations and prohibitions of certain dominant platforms from operating in adjacent lines of business.” In other words, breaking up companies.

[…]

And it wants the Big Four to feel the force of the US legal system by “strengthening private enforcement, through eliminating obstacles such as forced arbitration clauses, limits on class action formation, judicially created standards constraining what constitutes an antitrust injury, and unduly high pleading standards.”

What now?

In short, the report is everything that Apple, Amazon, Facebook and Google feared it would be; the only surprise however is that what had become obviously during the committee’s investigations was watered down significantly in the final report.

Of course, there is still a long way to go before any of the report’s recommendations become a reality. Even within the committee, there is not unanimity, with some Republican members expressing concerns over breaking up companies in particular. Republicans will also be more ideologically opposed to adding regulations or removing companies’ ability to arbitrate disputes themselves, rather than through the courts.

And then of course there is the enormous collective power of Apple, Amazon, Facebook and Google – some of the world’s largest and richest corporations – who will be willing and able to do anything to protect their markets and profits.

Source: Big Tech to face its Ma Bell moment? US House Dems demand break-up of ‘monopolists’ Apple, Amazon, Facebook, Google

SmartShooter ‘Automatically’ Shoots Drones Out of the Sky using Colt personal gun

Posted on by

The Air Force was already familiar with the possibilities of the ‘SmartShooter’ smart aiming system. The only thing that was unknown was whether it is also effective in combination with the Colt C7 5.56mm long-range automatic rifle.

Operation

The system uses video analysis. A shooter aims his weapon at the target with the SmartShooter. So far, it is the same as with a normal aiming system. With the SmartShooter, the shooter selects the target by pulling the trigger, and holds the pulled trigger while continuing to aim at the target.

As soon as the system ‘sees’ that the target will be hit, the SmartShooter automatically will fire the weapon. So, it does not work autonomously, and the shooter selects the target, aims and pulls the trigger.

Effective

When the Dutch Army organized a shooting day to experiment with the SmartShooter system, the Air Force joined in to test its effectiveness against drones. A section of the top ten UAS detected by the Air Force in the Netherlands was fired.

The Colt rifle in combination with the SmartShooter system proved to be very effective: all targets were eliminated with a few rounds.

Source: SmartShooter ‘Automatically’ Shoots Drones Out of the Sky

Former Patent Litigator Becomes Federal Judge And Begins Advertising For Patent Trolls To Come To His Court (And They Have In Droves)

Posted on by

For years, you may recall that we would write about the insane nature of forum shopping for patent trolls, in which the trolls would flock to the federal courts in East Texas. Going back nearly 15 years, we wrote about how East Texas courts became grand central for patent troll cases, leading to all sorts of sketchy behavior. There are a bunch of empty office buildings setup in small Texas cities (mainly Marshall and Tyler) just to “pretend” to have offices there. Companies engaged in many patent cases started to try to suck up to residents of those small cities, in case they might be on a jury. TiVo literally bought a “Grand Champion Steer” just weeks before a jury was set to rule on a massive TiVo trolling case. Samsung threw so much money at the local “Stagecoach Days” event that it was renamed “Samsung Stagecoach Days,” and built a Samsung ice rink right next to the courthouse in Marshall.

For years, people pressured Congress to fix this mess, but instead, the Supreme Court finally stepped in, with the TC Heartland ruling, and said that the proper jurisdiction should be where defendants actually are incorporated. Of course, this seemed to have the reverse effect — as companies no longer want to be in East Texas. Apple shut down its stores there to avoid the jurisdiction.

Of course, if you thought that the judges would go quietly, you’d be wrong. It’s always felt like a few judges in East Texas loved the reputation they’d built up as being super friendly to patent trolls. For a while it was Judge T. John Ward. And when he left the bench (to become a patent lawyer, natch), Judge Rodney Gilstrap stepped into the gap he left. He even tried to ignore the Supreme Court’s TC Heartland decision (though the Federal Circuit appeals court was not impressed).

However, as Patent Progress notes, there’s a new judge vying to be at the top of the patent troll’s Christmas list, and he’s in West Texas. Judge Alan Albright, a former patent litigator, was appointed to the bench in 2018 — and he literally went on a tour to convince companies to bring patent cases in his court:

U.S. District Judge Alan Albright and attorneys who predicted last year that Waco’s federal court would become a hotbed of patent and intellectual property litigation missed their prediction just a bit.

With Albright traveling the country drumming up business and patent attorneys spreading the word that Waco’s new federal judge, a longtime patent litigator, will provide the expertise to create an efficient and welcoming environment in Waco, the response in the past year actually exceeded those predictions.

Since Albright took office in September 2018, more than 250 patent cases have been filed in the federal Western District of Texas, which includes Waco. That total eclipses the number for the previous four years combined and has made the Western District among the busiest in the country for patent cases.

[…]

Source: Former Patent Litigator Becomes Federal Judge And Begins Advertising For Patent Trolls To Come To His Court (And They Have In Droves) | Techdirt

Ring glitch results in global ding dong ditch: Doorbells keep going off with no one pushing them.

Posted on by

Amazon-owned smart home appliance maker Ring has won the world record for biggest game of “ding dong ditch” after a software glitch broadcast erroneous doorbell chimes to countless users yesterday.

The global game of Ring and run (as it’s known in the US) coincided with software issues that prevented owners from viewing archived footage or receiving push notifications. Customers in markets including the UK and US were believed to be affected.

The Timely Information Transmission Suffered Unpredictable Ping-time (TITSUP) led some to believe that Ring’s systems were being targeted deliberately by a malicious third party. “Are the Ring doorbells being hacked? Mine are going off non-stop,” tweeted one confused punter.

“You’re [sic] network has been down for hours. Now I am getting phantom ‘rings’ and it’s driving my Great Dane crazy,” complained another.

Your humble hack also experienced the glitch when a random chime from his overpriced doorbell disturbed a post-work nap. More accurately, it startled his dogs, who then leapt onto his chest.

Speaking to El Reg, Ring’s Europe head of communications, Claudia Fellerman, confirmed the problem and said it has since been fixed.

“Our processing infrastructure was running behind which caused some delays in receiving in-app notifications and Chime motion and ding notifications. However, this has been resolved,” she said.

According to Ring’s status page, no user data was lost, and a fix was applied by late evening. The company warned that users may encounter delayed chimes and notifications while the back-end catches up.

Ring also urged punters to check the battery levels on their devices as the outage may have caused a higher-than-usual power drain.

Source: Ring glitch results in global ding dong ditch: Doorbell bling flings out random pings but they’re not the real thing • The Register

Yay cloud!

Tokyo Stock Exchange breaks new record. Sadly, not a good one… its longest ever outage

Posted on by

Tokyo’s Stock Exchange (TSE) went offline for most of Thursday, its longest-ever outage and a very unwelcome one as it is the world’s third-largest bourse, when measured by market capitalisation.

The exchange yesterday morning posted news that “a technical glitch occurred to distribution of market data,” and the market therefore stopped all trading. Later in the day the bourse also took down its after-hours trading platform, ToSTNeT, and then issued warnings that some market data distributed to investors was invalid.

The exchange explained the cause of the outage in a statement that said it experienced “hardware failure,” followed by a failure-to-failover.

The statement continued: “the switchover from the failed device to the backup device did not work properly, and as a result, market information could not be distributed.”

Which sounds very like someone hasn’t run a disaster recovery simulation for a while.

While the exchange thought it could replace the hardware and resume trading, doing so would have required a reboot that it felt “would cause confusion for investors and market participants, which would make it difficult to execute smooth trading.”

After talks with stakeholders, it was decided to just give up on the day and resume on Friday. At the time of writing – a few minutes after Friday’s opening bell – that plan appears to have worked.

The exchange has apologised for the outage, and taken responsibility for the situation, and also made it plain that mess was the result of its own mistakes and key technology provider Fujitsu was not at fault.

Fujitsu promotes TSE’s use of “approximately 200” of its Primergy servers and the Primesoft in-memory data management software.

That combo can apparently handle 100 million orders a day, at a rate of 1.4 million order-per-minute, all with transaction time of 300 microseconds apiece. Well, sometimes.

Fujitsu has reportedly apologised for its role in the outage.

The exchange continues to do so at every opportunity, with its notification that it expects normal trading today ending with: “We would like to express our sincerest apologies for the inconvenience caused by the system failure of Tokyo Stock Exchange, and we would like to ask for your continued support and cooperation in the operation of the market.”

Source: Tokyo Stock Exchange breaks new record. Sadly, not a good one… its longest ever outage • The Register

US govt wins right to snaffle Edward Snowden’s $5m+ book royalties, speech fees – and all future related earnings

Posted on by

The US government’s Department of Justice has won its multi-million-dollar claim to Edward Snowden’s Permanent Record book royalties as well as any future related earnings.

A federal district court in eastern Virginia this week ruled that Uncle Sam was entitled to the proceeds of Snowden’s bestseller, an estimated $5.2m, and “any further monies, royalties, or other financial advantages derived by Snowden from Permanent Record.” It can also grab Snowden’s appearance fees from 56 speeches, thought to exceed $1m.

The court came to this conclusion after deciding Snowden broke his non-disclosure agreements with the NSA and CIA. It noted the super-leaker did not offer up his book for a review by official censors nor did he clear speeches on intelligence matters with the US government as required by his employment contract from the time he worked for Uncle Sam.

“The United States’ lawsuit did not seek to stop or restrict the publication or distribution of Permanent Record,” the Dept of Justice’s spokespeople said on Thursday of the decision.

“Rather, under well-established Supreme Court precedent, Snepp v. United States, the government sought to recover all proceeds earned by Snowden because of his failure to submit his publication for pre-publication review in violation of his alleged contractual and fiduciary obligations.”

That the US government would crack down on Snowden is hardly unexpected. Officials filed suit in September 2019 to claim a cut of Snowden’s public persona on the grounds he broke his agreement with the No Such Agency by going public.

“Edward Snowden violated his legal obligations to the United States, and therefore, his unlawful financial gains must be relinquished to the government,” said Deputy Attorney General Jeffrey Rosen.

“As this case demonstrates, the Department of Justice will not overlook the wrongful actions of those who seek to betray the trust reposed in them and to personally profit from their access to classified national security information.”

Source: US govt wins right to snaffle Edward Snowden’s $5m+ book royalties, speech fees – and all future related earnings • The Register

Wow, apparently these employment contracts are more like permanent indenture – last I looked, Snowden wasn’t exactly in the employ of the NSA any more… in as much as he was ever as a contractor…

Grindr security flaw let anyone take over any accounts easily

Posted on by

Grindr, one of the world’s largest dating and social networking apps for gay, bi, trans, and queer people, has fixed a security vulnerability that allowed anyone to hijack and take control of any user’s account using only their email address.

Wassime Bouimadaghene, a French security researcher, found the vulnerability and reported the issue to Grindr. When he didn’t hear back, Bouimadaghene shared details of the vulnerability with security expert Troy Hunt to help.

The vulnerability was fixed a short time later.

Hunt tested and confirmed the vulnerability with help from a test account set up by Scott Helme, and shared his findings with TechCrunch.

Bouimadaghene found the vulnerability in how the app handles account password resets.

To reset a password, Grindr sends the user an email with a clickable link containing an account password reset token. Once clicked, the user can change their password and is allowed back into their account.

But Bouimadaghene found that Grindr’s password reset page was leaking password reset tokens to the browser. That meant anyone could trigger the password reset who had knowledge of a user’s registered email address, and collect the password reset token from the browser if they knew where to look.

Secret tokens used to reset Grindr account passwords, which are only supposed to be sent to a user’s inbox, were leaking to the browser. (Image: Troy Hunt/supplied)

The clickable link that Grindr generates for a password reset is formatted the same way, meaning a malicious user could easily craft their own clickable password reset link — the same link that was sent to the user’s inbox — using the leaked password reset token from the browser.

With that crafted link, the malicious user can reset the account owner’s password and gain access to their account and the personal data stored within, including account photos, messages, sexual orientation and HIV status and last test date.

“This is one of the most basic account takeover techniques I’ve seen,” Hunt wrote.

Many ways to optimise your HOTAS set up at home: desk and chair mounts

Posted on by

We are living in a golden age of flight and space simulation, with Flight Simulator, Star Wars Squadrons just out and Elite Dangerous and No Mans Sky fully established and finally Star Citizen playable to some degree. This means you can take out that old flight stick and throttle and TrackIR 5 that have been gathering dust for the last ten years and get it working again. Or you can buy a new one, together with a set of VR goggles.

What doesn’t show on the pictures though, is the amount of desk space these things take up and the tangle of wires that comes along with it. Ergonomically, having them on your desk is not the best place to have them as you sit to attention in order the get to them.

There are basically three philosophies to having a better home HOTAS setup: mounting them on your office chair, mounting them on your table and buying a dedicated chair setup.

Buying a dedicated chair (and not quite going the full cockpit route)

The nicest system I have seen is the Obutto, which is a system of not just chair, keyboard, mouse, joystick and throttle mounts, but also of monitor and speaker mounts. Expect to start at around EUR 900.

Wolf Hardware has blue and Red chairs as well as an armrest kit that will set you back around $375,-

In this category, Monstertech has a stand as well for EUR 255,-

GT Omega has a GT Omega Steering Wheel Stand PRO for Logitech G29 G920 with Shifter Mount V2, Thrustmaster T500 T300 TX & TH8A for GBP 110,-

GT-Omega-Racing

You can get the unit from GT Omega Directly

This can be combined with the GT Omega ART Racing Simulator Cockpit RS6 Gaming Console Seat for Logitech G920, G29, G27, G25 Steering Wheel Pedals & Shifter Mount V2 PS4 Xbox One 360 TMX, with Stand & Reclinable for GBP 360,- if you really want to go the cockpit route

This can be upgrade with the ART Flight stick stand for EUR 80,-

Attaching your HOTAS to your desk

Your stick / throttle manufacturer will sell you under desk mounts but these can be prohibitively large and expensive.

Fortunately there are aftermarket sellers. Undoubtably the main player in this realm is Monstertech. They have attachment arms for your HOTAS but also for your MFD’s and tablets as well as a mount to put up your joystick in the centre position

Their table mounts are sized for the specific joystic / throttle that you have and start at EUR 89,- for silver and EUR 109,- for black.

Predator mounts offers a selection of very solid desk mounts with accessories in both silver and black. Plates are ordered custom to the jostick model. They will also sell accessories such as cable clips to keep your cabling nice, as well as an attachment plate for the VKB hanging box (in different colours), so that can be neatly clipped to the back of the mount. To unclip these you push downwards, so you knee won’t accidentally bang into them and assembly is very easy. Edit: Sadly, Predator Mounts has gone into receivership. Do not send money that way any more.

A new player to the game is AlphaBravoTango who offers Stowaway Mounts. These fold away easily under your desk when you are not using them. They are metal where it counts and 3d printed covers. The maker has a reddit thread here and you can buy them on Etsy.

AliExpress has similar mounts going for EUR 50,- a piece though that come with a mousepad

J-PEIN costs around $90 and is supposed to be solid too

They have an extension for the warthog (10/15/20cm)

From the LichiETC 3C store at EUR 41,-

There’s a company called Foxxmount which makes mounts that look a lot like the old Predator ones.

Amazon US has the J-PEIN (upgraded) desk mount for $70,-. This is the goto Korean cheaper version. These come with a lot of bolts.

Hikig is another manufacturer that looks like J-PEIN selling for around EUR 80,- on Amazon.

MEZA has a set of two mounts for $179,99 at Amazon, which look a lot like the J-PEIN. You can find the Meza website here. These come with a lot of bolts.

Stowable Mounts

Mach1Mounts from Australia has excellent heavy duty aluminium mounts that fold down and away: https://www.etsy.com/shop/mach1mounts/?etsrc=sdt

You can find a reddit review here: https://www.reddit.com/r/hotas/comments/1no88wl/stowable_hotas_mounts/

r/hotas - Stowable Hotas Mounts
THTL-1v2 Stowable Fold-Away HOTAS Throttle Mount (Qty 1)

Loading

THTL-1v2 Stowable Fold-Away HOTAS Throttle Mount (Qty 1)

€164.12

Reddit user Sessine has an excellent writeup of a DIY HOTAS under desk folding attachment system which can be stowed away easily

Reddit User dlongwing has an alternate method of having a foldaway HOTAS rig under his desk

r/hotas - I have a fold-away HOTAS rig hiding under my desk (Round 2)
r/hotas - I have a fold-away HOTAS rig hiding under my desk (Round 2)
r/hotas - I have a fold-away HOTAS rig hiding under my desk (Round 2)

SciMonster has created a Thingiverse rail which you can 3D print yourself and allows you to slide the hotas to the sides and lock the joystick to the right and in the centre

Mount your Virpil Throttle and Stick to linear rails so you can slide them along your desk.
This allows you to move your HOTAS aside when you use the computer for other work.
When flying your aircraft or spaceship, a spring-loaded locking meachanism holds your HOTAS securely in place.

The files are designed for the VPC Desk Mount V2/V3:
https://virpil-controls.eu/vpc-desk-mount-angled-adapter-mt-50-throttle.html
which is compatible with the VPC MongoosT-50 Throttle.

An adapter plate for Virpil Flightsticks (VPC WarBRD Base) is included (with and without a mounting option for the 15 button Elgato Stream Deck (MK.1). MongoosT Base untested.

Source: https://www.thingiverse.com/thing:4916920

For around GBP 55 you can buy a generic table bolting system from Amazon

Attaching your throttle and stick to your chair

This is the cheapest route which you can do with a fair amount easy of DIY. Although it’s ergonomically very comfortable, the downside, however, is that the wiring moves with your chair and you will always be in a tangle of wires all over the place.

Turn an office chair into an Elite: Dangerous HOTAS with 3D prints

How to mount HOTAS flight sticks to an office chair for Elite: Dangerous and other flight sims is a very clear video showing how to use a simple clamping mechanism to attach everything.

Custom Foldable HOTAS Chair Mount (Made on the cheap!)

Is a good howto

VESA HOTAS mounts for IKEA Markus chair shows how to put the brackets on step by step

Amazon has the bracket for GBP 36,- here

And here

To affix your HOTAS to any boarding you may want to use 3M Dual Lock Reclosable Fasteners Heavy Duty Industrial Use Black TB3550 1″ x 10 ft Mated Strip Indoor/Outdoor Use Great for Metal, Glass, Acrylic, PC, ABS

Naturally Monstertech has these mounts too, starting at EUR 92,-

Reddit user Sarai_Seneschal has this neat setup with a VKB Omnithrottle

https://preview.redd.it/6ew7tkyg5iy51.jpg?width=4032&format=pjpg&auto=webp&s=ddc42beac74fde645074e86e4b50f9b99a112f54

Random other solutions

Some people have used two Mobotron MS-426 Standard Car iPad Laptop Mount Holder Stand ($110,- each). The big advantage of this is that the joystick and throttle can be moved completely out of the way.

KT1 Ergonomic Under-Desk Computer Keyboard Tray. Adjustable height angle negative tilt sliding pull out drawer platform swivels 360 slides office products furniture desktop accessories with mouse pad

YANGHX Ergonomic Adjustable Armrest Wrist Rest-Only Adjustable for Chair for GBP23,-

Further reference

This thread has some interesting ideas

Reddit /r/hotas has some really interesting ideas

And so does /r/homecockpits

Good luck and have fun!

Microsoft Exchange Online goes down – again

Posted on by

Microsoft’s Exchange Online service fell over in the early hours of this morning.The company’s status orifice initially figured that the problem mainly affected users in India as its engineers noted the wobbling at around 0700 BST. Just under an hour later Microsoft had to admit it was another global outage.It is the latest in what appears to be a battle of who can annoy their users more. Azure suffered a major outage earlier this week. Rival Apple then hit back with its own wobble before Microsoft continued the TITSUP* tit-for-tat this morning.The mystery issue afflicted apps using Exchange Online protocols, including Outlook on the desktop, mobile devices, and “those dependant on REST functionality,” Microsoft said. The company was taking a long hard look at what it might have changed in recent days that might have broken something.

[…]

Microsoft eventually pinned the blame on a “recent configuration update”, rolled it back and, at time of writing, was “monitoring the service” for signs of life.

[…]

Users reported problems sending and receiving mails, accessing folders and attachments, or even being able to log into their services. Some noted difficulty synchronising between Azure Active Directory and Exchange Online while there were also isolated reports of SharePoint and Teams struck by the curse of bork.

[…]

Source: Where are we now? Microsoft 363? 362? We’ve lost count because Exchange Online isn’t playing nicely this morning • The Register

Yay cloud!

Indian Startups Explore Alliance and Alternative App Store To Fight Google’s Monopoly

Posted on by

More than 150 startups and firms in India are working to form an alliance and toying with the idea of launching an app store to cut their reliance on Google, five people familiar with the matter told TechCrunch. The list of entrepreneurs includes high-profile names, such as Vijay Shekhar Sharma, co-founder and chief executive of Paytm (India’s most valuable startup), Deep Kalra of travel ticketing firm MakeMyTrip, and executives from PolicyBazaar, RazorPay, and Sharechat. The growing list of founders expressed deep concerns about Google’s “monopolistic” hold on India, home to one of the world’s largest startup ecosystems, and discussed what they alleged was unfair and inconsistent enforcement of Play Store’s guidelines in the country. Their effort comes days after a small group of firms including Epic Games, Spotify, Basecamp, Match Group, ProtonMail forged their own coalition to pressure Apple and Google to make changes to their marketplace rules. The conversations in India, which began in recent weeks, escalated on Tuesday after Google said that starting next year developers with an app on Google Play Store must give the company a cut of as much as 30% of several app-related payments. Dozens of executives “from nearly every top startup and firm” in India attended a call on Tuesday to discuss the way forward, some of the people said, requesting anonymity. A 30% cut to Google is simply unfeasible, people on the call unanimously agreed.

Source: Indian Startups Explore Alliance and Alternative App Store To Fight Google’s ‘Monopoly’ – Slashdot

I spoke about this in 2019 and it’s interesting to see where this is going

Help spot planets for NASA or Oxford

Posted on by

. The Transiting Exoplanet Survey Satellite (TESS), which launched in 2018, has snapped hundreds of thousands images of the night sky using its four cameras in the hopes of finding exoplanets. That’s too much data for professional astronomers to pore over, and NASA doesn’t trust computer-vision algorithms to do all the work, so they’ve decided to look to the public for help.

“Automated methods of processing TESS data sometimes fail to catch imposters that look like exoplanets,” said project leader Veselin Kostov, a research scientist at NASA’s Goddard Space Flight Center, and the SETI Institute. “The human eye is extremely good at spotting such imposters, and we need citizen scientists to help us distinguish between the look-alikes and genuine planets.”

[…]

A similar scheme called Planet Hunters TESS, run by the University of Oxford, led to a graduate student finding a binary-star planet at the start of the year.

“Planet Hunters TESS asks volunteers to look at light curves, which are graphs of stars’ brightness over time,” Marc Kuchner, the citizen science officer for NASA’s Science Mission Directorate, noted. “Planet Patrol asks them to look at the TESS image directly, although we plan to also include light curves for those images in the future.”

You can get cracking right here.

Source: Looking for a new hobby to kill the COVID-19 blues? Join NASA’s Planet Patrol to hunt for alien worlds • The Register

From Consensus to Conflict: Understanding Foreign Measures Targeting U.S. Elections

Posted on by

This piece is  very worth reading in its’ entirety. Underneath just the conclusions.

Conclusions and Recommendations

This report reviews some of the research that is relevant to foreign information efforts targeting U.S. elections. It provides a general framework for understanding these efforts and will inform our analysis in future volumes of this series. We focused on efforts by Russia and its proxies because these actors appear to have been the most active in recent years, but we note that other state and nonstate actors also might target the United States. As a result of this work, we reached four general conclusions.

Conclusions

Foreign Interference in U.S. Politics Is Not a New Phenomenon

Foreign influence in U.S. domestic affairs dates back to the founding of this country, and there are several examples in our 244 years of existence.

How the Russians Have Tried to Interfere in Recent U.S. Elections Follows Some Logic

We hypothesize that reflexive control theory—a theoretical research program first developed in the 1960s and used by the Soviet military—is part of the intellectual basis for current Russian efforts. At its core, reflexive control theory assumes that people live in a polarized world defined by either cooperation or conflict and that people make decisions based on these views. We believe that Russia is trying to generate, spread, and amplify falsehoods that distort views of “us” versus “them,” with the desired outcomes of (1) driving people to view each other as either friends or adversaries, or (2) exhausting people to the point that they disengage from civic affairs altogether, with the result of political paralysis.

Russia’s Tactics Aim to Polarize Americans and Paralyze the U.S. Political Process

These tactics consist of attempts at polarizing and disrupting social cohesion. Some tactics aim to exacerbate divisive issues, such as racial inequities or immigration. Others target public confidence in democratic institutions and processes as a way to undermine social trust. Underlying these efforts is a broader tactic of using falsehoods to spread confusion, drive groups of people to extreme positions, and generate collective exhaustion within U.S. society. Finally, there is evidence that Russia has tried—and continues to try—to gain direct influence over the U.S. political decisionmaking process, although we do not know how effective these efforts have been.

Our Sample of Relevant Research Revealed Some Trends for Responding to Falsehoods

Although our sample of studies is not representative of all research on this topic, it does provide some ideas for emerging practices in responding to foreign information efforts. Much of this research is fragmented and cuts across multiple disciplines, causing us to organize it by primary unit of analysis: the production of new falsehoods, the distribution of existing falsehoods, or the consumers of this content.

Research on production largely focused on targeting of falsehoods and the features of this content. For studies on the distribution of existing falsehoods, research focused on the role of social media platforms in preventing the spread of online falsehoods and the role of machine-learning models to mitigate this spread. Finally, research on consumption largely focused on consumer views of content and the impacts of fact-checking.

Recommendations for Responding to Foreign Information Efforts

Democracy depends on citizens finding consensus with people whom they might view as different from them. Foreign adversaries have made attempts at undermining the formation of this consensus and will continue to do so.

Share on Twitter

Foreign interference has occurred throughout U.S. history and likely will continue in the future. Russia seems to have advanced its information efforts in recent years, and we suspect other countries will try to emulate these practices. We offer three recommendations for how to start designing responses to these existing and emerging threats that target U.S. democracy. In future volumes of this series, we will present results with more-specific recommendations for responding to these foreign information efforts.

A Holistic Strategy Is the Optimal Response to Information Efforts by Foreign Countries

During the Cold War, Secretary of State Lawrence Eagleburger recommended a “balanced approach” to Soviet information efforts that neither ignores the threat nor becomes obsessed with it (Eagleburger, 1983). Our assumption is that reflexive control theory is part of the intellectual basis for Russian efforts targeting U.S. elections. The unit of analysis of this theory is broad, spanning the entirety of U.S. society and any particular piece of online content, social media platform, or individual consumer. We recommend that any defensive strategy account for the complex relationships among the production of falsehoods, how others distribute content (particularly online), and the impacts of this content on consumers.

Any Defense Should Anticipate Those Who Are Likely to Become Targets of These Efforts

We believe that a key goal for information efforts is to alter people’s perceptions to amplify a view of “us versus them,” with political paralysis as the ultimate goal. Social or political issues tied to identities (such as race, gender, social class, or political affiliation) that hold meaning for people are useful starting points because false content tied to these characteristics might elicit strong reactions (Marwick, 2018). We suspect that foreign efforts will likely produce content that plays on these identities in an effort to amplify differences and deepen preexisting fault lines in U.S. society. Thus, we recommend developing strategies that anticipate which subgroups are most vulnerable to such efforts without publicly shaming these groups or targeting specific individuals.

Any Response Should Attempt to Protect Potential Targets Against Foreign Information Efforts

The antidote to manufacturing intergroup conflict is convincing people that they have more in common with those who are different from them than they might believe at first glance. We recommend collecting, analyzing, and evaluating preventative interventions to protect people from reacting to falsehoods meant to divide the country (e.g., public campaigns that emphasize shared interests of Californians, public warnings about broader information efforts by foreign adversaries, or media literacy programs for subgroups that are potential targets).

In conclusion, democracy depends on citizens finding consensus with people whom they might view as different from them. Foreign adversaries have made attempts at undermining the formation of this consensus and will continue to do so. There is a logic to these attempts. The best defense is a holistic approach that accounts for the preexisting fault lines that exist within U.S. society.

Download the Full Report (includes references and appendixes) ⤴

Source: From Consensus to Conflict: Understanding Foreign Measures Targeting U.S. Elections | RAND

Instagram and Facebook Messenger Are Merging Chat Functions

Posted on by

Facebook announced today that Messenger and Instagram are, for all intents and purposes, merging. Chat features from Messenger will become available to Instagram users, and folks on either service will be able to reach out to one another without needing to download a separate app.

“Today, we’re announcing an update to Instagram DMs by introducing a new Messenger experience on the app,” wrote Adam Mosseri and Stan Chudnovsky—the respective heads of Instagram and Messenger—in a blog post earlier today.

“People are communicating in private spaces now more than ever. More than a billion people already use Messenger as a place to share, hang out and express themselves with family and friends,” they added. “That’s why we’re connecting the Messenger and Instagram experience to bring some of the best Messenger features to Instagram—so you have access to the best messaging experience, no matter which app you use.”

Source: Instagram and Facebook Messenger Are Merging Chat Functions

Who watches the watchers? Samsung does so it can fling ads at owners of its smart TVs

Posted on by

Samsung brags to advertisers that “first screen ads”, seen by all users of its Smart TVs when they turn on, are 100 per cent viewable, audience targeted, and seen 400 times per TV per month. Some users are not happy.

“Dear Samsung, why are you showing Ads on my Smart TV without my consent? I didn’t agree to this in the privacy settings but I keep on getting this, why?” said a user on Samsung’s TV forum, adding last week that “there is no mention of advertising on any of their brand new boxes”.

As noted by TV site flatpanelshd, a visit to Samsung’s site pitching to advertisers is eye-opening. It is not just that the ads appear, but also that the company continually profiles its customers, using a technology called Automatic Content Recognition (ACR), which works by detecting what kind of content a viewer is watching.

Samsung’s Tom Focetta, VP Ad Sales and Operations in the US, said in an interview: “Our platform is built on the largest source of TV data from more than 50 million smart TVs. And we have amassed over 60 per cent of the US ACR footprint.” Focetta added that ACR data is “not sold, rented or distributed” but used exclusively by Samsung to target advertising.

The first screen ad unit was introduced five years ago, Focetta explained, and the company has since “added video, different types of target audience engagement, different ways to execute in terms of tactics like audience takeovers, roadblocks”. A “roadblock” is defined as “100 per cent ownership of first screen ad impressions across all Samsung TVs”. According to a Samsung support, quoted by flatpanelshd: “In general, the banner cannot be deactivated in the Smart Hub.”

Advertising does not stop there since Samsung also offers TV Plus, “a free ad-supported TV service”. Viewers are familiar with this deal, though, since ad-supported broadcasting is long established. What perturbs them is that when spending a large sum of money on TV hardware, they were unknowingly agreeing to advertising baked into its operating menu, every time they switch on.

The advent of internet-connected TVs means that viewers now divide their time between traditional TV delivered by cable or over the air, and streaming content, with an increasing share going to streaming. Viewers who have cancelled subscription TV services in favour of streaming are known as cord-cutters.

Even viewers who have chosen to watch only ad-free content do not escape. “30 per cent of streamers spend all of their streaming time in non-ad supported apps. This, however, does not mean ‘The Lost 30’ are unreachable,” said Samsung in a paper.

[…]

Source: Who watches the watchers? Samsung does so it can fling ads at owners of its smart TVs • The Register

Not one to be outdone by Microsoft, Apple’s cloud fell over too. Unlike Microsoft, it hasn’t said what happened

Posted on by

The rivalry between Apple and Microsoft continued last night as the fruity firm’s cloud services took a tumble a mere day after Azure crapped itself.

While Apple has remained silent on what happened (we asked; it did not respond), the vast majority of its services wobbled over a two-hour period early this morning (UK time).

Issues began at around 1am affecting services including Apple TV, iCloud Mail, iWork for iCloud, and the company’s App Store. On its System Status page the company said “Some users were affected”, along with “Users experienced a problem with this service.”

The “problem” being that it simply didn’t work. A glance at social media shows disappointed fanatics wailing about Apple TV stopping midstream, Apple Music hitting the pause button, and iCloud Photos leaping from the nearest ledge.

At one point even the System Status page reportedly fell over.

Apple’s inability to keep its cloud in the air came a day after Microsoft suffered an embarrassing Azure failure, prompting us to ponder if Redmond has a reliability problem.

Unless some late-night (and early morning) fondling was involved, the outage did not cause too much European outrage. Some US users, on the other hand, found themselves at the pointy end of Apple’s issues and unable to express their feelings on the US presidential debate via the medium of iCloud email.

Things appear back to normal this morning, and The Register was heartened to note that fanboi assistant Siri did not appear to be affected.

In marked contrast to the approach taken by Microsoft, Apple has yet to explain what happened, why it happened, and why it will not happen again. We will update should a statement be forthcoming.

In the meantime, we anxiously await Cook & co’s inevitable “you’re using it wrong” retort.

Source: Not one to be outdone by Microsoft, Apple’s cloud fell over too. Unlike Microsoft, it hasn’t said what happened • The Register

Yay cloud.

Super precise measurement of all matter in universe made

Posted on by

A team of US astrophysicists has produced one of the most precise measurements ever made of the total amount of matter in the Universe, a longtime mystery of the cosmos.

The answer, published in The Astrophysical Journal on Monday, is that matter consists of 31.5 percent—give or take 1.3 percent—of the total amount of matter and energy that make up the Universe.

The remaining 68.5 percent is dark energy, a mysterious force that is causing the expansion of the Universe to accelerate over time, and was first inferred by observations of distant supernovae in the late 1990s.

Put another way, this means the total amount of matter in the observable Universe is equivalent to 66 billion trillion times the mass of our Sun, Mohamed Abdullah, a University of California, Riverside astrophysicist and the paper’s lead author told AFP.

Most of this matter—80 percent—is called dark matter. Its nature is not yet known but it may consist of some as-yet-undiscovered subatomic particle.

[…]

So how exactly do you weigh the Universe?

The team honed a 90-year-old technique that involves observing how galaxies orbit inside galaxy clusters—massive systems that contain thousands of galaxies.

These observations told them how strong each ‘s gravitational pull was, from which its total mass could then be calculated.

Fate of the Universe

In fact, explained Wilson, their technique was originally developed by the pioneering astronomer Fritz Zwicky, who was the first person to suspect the existence of dark matter in galaxy clusters, in the 1930s.

He noticed that the combined gravitational mass of the galaxies he observed in the nearby Coma galaxy cluster was insufficient to prevent those galaxies from flying away from one another, and realized there must be some other invisible matter at play.

The UCR team refined Zwicky’s technique, developing a tool they called GalWeight that determines more accurately which galaxies belong to a given and which do not.

They applied their tool to the Sloan Digital Sky Survey, the most detailed three-dimensional maps of the Universe currently available, measuring the mass of 1,800 galaxy clusters and creating a catalog.

Finally, they compared the number of clusters observed per unit volume in their catalog against a series of computer simulations, each of which was fed a different value for the total matter of the Universe.

Simulations with too little matter had too few clusters, while those with too much matter had too many clusters.

The “Goldilocks” value they found fit the simulations just right.

[…]

Source: What’s the matter with the Universe? Scientists have the answer

Second alignment plane of solar system discovered

Posted on by

A study of comet motions indicates that the solar system has a second alignment plane. Analytical investigation of the orbits of long-period comets shows that the aphelia of the comets, the point where they are farthest from the Sun, tend to fall close to either the well-known ecliptic plane where the planets reside or a newly discovered “empty ecliptic.” This has important implications for models of how comets originally formed in the solar system.

In the solar system, the planets and most other bodies move in roughly the same orbital , known as the ecliptic, but there are exceptions such as comets. Comets, especially long-period comets taking tens-of-thousands of years to complete each orbit, are not confined to the area near the ecliptic; they are seen coming and going in various directions.

[…]

The solar system does not exist in isolation; the gravitational field of the Milky Way galaxy in which the resides also exerts a small but non-negligible influence

[…]

hen the galactic gravity is taken into account, the aphelia of long-period comets tend to collect around two planes. First the well-known ecliptic, but also a second “empty ecliptic.” The ecliptic is inclined with respect to the disk of the Milky Way by about 60 degrees. The empty ecliptic is also inclined by 60 degrees, but in the opposite direction. Higuchi calls this the “empty ecliptic” based on mathematical nomenclature and because initially it contains no objects, only later being populated with scattered comets.

[…]

Source: Second alignment plane of solar system discovered

YouTube celebrates Deaf Awareness Week by killing crowd-sourced captions

Posted on by

Today’s the day YouTube is killing its “Community Contributions” feature for videos, which let content creators crowdsource captions and subtitles for their videos. YouTube announced the move back in July, which triggered a community outcry from the deaf, hard of hearing, and fans of foreign media, but it does not sound like the company is relenting. In one of Google’s all-time, poor-timing decisions, YouTube is killing the feature just two days after the International Week of the Deaf, which is the last full week in September.

Once enabled by a channel owner, the Community Contributions feature would let viewers caption or translate a video and submit it to the channel for approval. YouTube currently offers machine-transcribed subtitles that are often full of errors, and if you also need YouTube to take a second pass at the subtitles for machine translation, they’ve probably lost all meaning by the time they hit your screen. The Community Caption feature would load up those machine-written subtitles as a starting point and allow the user to make corrections and add text that the machine transcription doesn’t handle well, like transcribed sound cues for the deaf and hard of hearing.

YouTube says it’s killing crowd-source subtitles due to spam and low usage. “While we hoped Community Contributions would be a wide-scale, community-driven source of quality translations for Creators,” the company wrote, “it’s rarely used and people continue to report spam and abuse.” The community does not seem to agree with this assessment, since a petition immediately popped up asking YouTube to reconsider, and so far a half-million people have signed. “Removing community captions locks so many viewers out of the experience,” the petition reads. “Community captions ensured that many videos were accessible that otherwise would not be.”

[…]

Source: YouTube celebrates Deaf Awareness Week by killing crowd-sourced captions | Ars Technica

FakeCatcher Deepfake Tool looks for a heartbeat

Posted on by

In the endlessly escalating war between those striving to create flawless deepfake videos and those developing automated tools that make them easy to spot, the latter camp has found a very clever way to expose videos that have been digitally modified by looking for literal signs of life: a person’s heartbeat.

If you’ve ever had a doctor attach a pulse oximeter to the tip of your finger, then you’ve already experienced a technique known as photoplethysmography where subtle color shifts in your skin as blood is pumped through in waves allows your pulse to be measured. It’s the same technique that the Apple Watch and wearable fitness tracking devices use to measure your heartbeat during exercise, but it’s not just limited to your fingertips and wrists.

Though not apparent to the naked eye, the color of your face exhibits the same phenomenon, subtly shifting in color as your heart endlessly pumps blood through the arteries and veins under your skin, and even a basic webcam can be used to spot the effect and even measure your pulse. The technique has allowed for the development of contactless monitors for infants, simply requiring a non-obtrusive camera to be pointed at them while they sleep, but now is being leveraged to root out fake news.

Researchers from Binghamton University in Binghamton, New York, worked with Intel to develop a tool called FakeCatcher, and their findings were recently published in a paper titled, “FakeCatcher: Detection of Synthetic Portrait Videos using Biological Signals.” Deepfakes are typically created by matching individual frames of a video to a library of headshots, often times containing thousands of images of a particular person, and then subtly adjusting and tweaking the face being swapped in to match the existing one perfectly. Unbeknownst to the naked eye, those images still contain the telltale biological signs of the person having a pulse, but the machine learning tools used to create deepfakes don’t take into account that when the final video is played back, the moving face should still exhibit a measurable pulse. The random way in which a deepfake video is created results in an unstable pulse measurement when photoplethysmography detection techniques are applied to it, making them easier to spot.

From their testing, the researchers found that FakeCatcher was not only able to spot deepfake videos more than 90 percent of the time, but with the same amount of accuracy, it was also able to determine which of four different deepfake tools—Face2Face, NeuralTex, DeepFakes, or FaceSwap—was used to create the deceptive video. Of course, now that the research and the existence of the FakeCatcher tool has been revealed, it will give those developing the deepfake creation tools the opportunity to improve their own software and to ensure that as a deepfake videos are being created, those subtle shifts in skin color are included to fool photoplethysmography tools as well. But this is good while it lasts.

Source: Intel and Binghamton Researchers Unveil FakeCatcher Deepfake Tool

British Army develops AI shotgun drone with machine vision for indoor use

Posted on by

The British Army has reportedly developed AI-equipped killer drones armed with twin-linked shotguns designed for blasting enemies of the Queen hiding inside buildings.

As if that wasn’t terrifying enough, the Army is already looking at strapping a chain gun or rocket launcher to its i9 drone instead of the shotguns, according to The Times.

“It is the UK military’s first weaponised drone to be able to fly inside, using a combination of physics and AI that allow it to overcome ‘wall suck’, which causes drones with heavy payloads to crash because of the way they displace air in small rooms,” the newspaper reported this morning.

The weaponised craft is said to be loaded with “twin stabilised shotguns” as well as making use of “machine vision” to identify its targets. A human operator will have to press a button to actually fire the shotguns, though that is potentially the least of the civilised world’s worries from this thing.

drone_swarm

We want weaponised urban drones flying through your house, says UK defence ministry as it waves a fistful of banknotes

READ MORE

Assuming that the drone is genuinely capable of firing a shotgun while hovering or in flight, this would mean the “unnamed British company” behind it has overcome some rather large challenges of physics. Basic Newtonian theory tells us that flinging an ounce of lead forwards at great speed causes an equal and opposite reaction backwards. In ballistics this force is called “recoil”. It takes little imagination to realise that recoil in a confined space is likely to push a drone backwards into a wall, rendering it useless.

[…]

The Ministry of Defence is but four years behind Russia in its armed drone endeavours. Back in 2016 a group of students designed an armed drone which first flew in 2019, though that appears to be an outdoors-only craft. The Belarusian Army also strapped an RPG to a drone in 2018, though footage doesn’t show it actually being fired

Source: British Army develops AI shotgun drone with machine vision for indoor use • The Register

Plane-tracking site Flight Radar 24 DDoSed… just as drones spotted buzzing over Azerbaijan and Armenia

Posted on by

[…]

Flight Radar spokesman Ian Petchenik told The Register: “At this time we understand this to be a very strong DDoS attack [orchestrated] from a single source. While it is not known why we’re being targeted, multiple flight tracking services have suffered attacks over the past two days.”

It was not immediately obvious which other sites had suffered attacks, though some had used their Twitter accounts to inform followers of planned server upgrades and updates to end-user apps.

Open source researchers claim to have picked up the live flight tracks of drones over Armenia and Azerbaijan, following armed skirmishes between the two nations over the long-disputed Nagorno-Karabakh region. The conflict gained a more international dimension earlier today when a Turkish F-16 fighter jet reportedly shot down an elderly Armenian Su-25 Frogfoot ground attack aircraft.

The use of DDoSes against general-interest websites has fallen out of favour in recent years as the script kiddies behind those types of attacks in days of yore a) grew up and b) realised that ransomware is far more lucrative than crayoning over someone else’s website.

With that said, such attacks are still in use: in August someone malicious forced the New Zealand stock exchange offline, while encrypted email biz Tutanota suffered a spate of similar attacks earlier this month.

Whatever the cause of the Flight Radar 24 attacks – one knowledgeable source suggested to El Reg that the Nagorno-Karabakh conflict may have triggered a government determined to control what the wider world can see – they serve as a reminder that even one of the oldest online attack methods can still cause chaos today.

Source: Plane-tracking site Flight Radar 24 DDoSed… just as drones spotted buzzing over Azerbaijan and Armenia • The Register