Author Archives: Robin Edgar

About Robin Edgar

Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft

Microservices guru says think serverless, not Kubernetes: You don’t want to manage ‘a towering edifice of stuff’

Posted on by

Sam Newman, a consultant and author specialising in microservices, told a virtual crowd at dev conference GOTOpia Europe that serverless, not Kubernetes, is the best abstraction for deploying software.

Newman is an advocate for cloud. “We are so much in love with the idea of owning our own stuff,” he told attendees. “We end up in thrall to these infrastructure systems we build for ourselves.”

He is therefore a sceptic when it comes to private cloud. “AWS showed us the power of virtualization and the benefits of automation via APIs,” he said. Then came OpenStack, which sought to bring those same qualities on-premises. It is one of the biggest open-source projects in the world, he said, but a “false hope… you still fundamentally have to deal with what you are running.”

cncf_interactive_landsacpe

You are viewing 1,459 cards with a total of 2,407,911 stars, market cap of $19.73 trillion and funding of $65.62 billion (click to enlarge): The CNCF ‘landscape’ illustration of cloud native shows how complex Kubernetes and its ecosystem has become

What is the next big thing? Kubernetes? “Kubernetes is great if you want to manage container workloads,” said Newman. “It’s not the best thing for managing container workloads. It’s great for having a fantastic ecosystem around it.”

As he continued, it turned out he has reservations. “It’s like a giant thing with lots of little things inside it, all these pods, like a termite mound. It’s a big giant edifice, your Kubernetes cluster, full of other moving parts… a lot of organisations incrementing their own Kubernetes clusters have found their ability to deliver software hollowed out by the fact that everybody now has to go on Kubernetes training courses.”

Newman illustrates his point with a reference to the CNCF (Cloud Native Computing Foundation) diagram of the “cloud native landscape”, which looks full of complexity.

A lot of organisations incrementing their own Kubernetes clusters have found their ability to deliver software hollowed out by the fact that everybody now has to go on Kubernetes training courses

Kubernetes on private cloud is “a towering edifice of stuff,” he said. Hardware, operating system, virtualization layer, operating system inside VMs, container management, and on top of that “you finally get to your application… you spend your time and money looking after those things. Should you be doing any of that?”

Going to public cloud and using either managed VMs, or a managed Kubernetes service like EKS (Amazon), AKS (Azure) or GKE (Google), or other ways of running containers, takes away much of that burden; but Newman argued that it is serverless, rather than Kubernetes, that “changes how we think about software… you give your code to the platform and it works out how to execute it on your behalf,” he said.

What is serverless?

“The key characteristics of a serverless offering is no server management. I’m not worried about the operating systems or how much memory these things have got; I am abstracted away from all of that. They should autoscale based on use… implicitly I’m presuming that high availability is delivered by the serverless product. If we are using public cloud, we’d also be expecting a pay as you go model.”

“Many people erroneously conflate serverless and functions,” said Newman, since the term is associated with services like AWS Lambda and Azure Functions. Serverless “has been around longer than we think,” he added, referencing things like AWS Simple Storage Service (S3) in 2006, as well as things like messaging solutions and database managers such as AWS DynamoDB and Azure Cosmos DB.

But he conceded that serverless has restrictions. With functions as a service (FaaS), there are limits to what programming languages developers can use and what version, especially in Google’s Cloud Functions, which has “very few languages supported”.

Functions are inherently stateless, which impacts the programming model – though Microsoft has been working on durable functions. Another issue is that troubleshooting can be harder because the developer is further removed from the low level of what happens at runtime.

“FaaS is the best abstraction we have come up with for how we develop software, how we deploy software, since we had Heroku,” said Newman. “Kubernetes is not developer-friendly.”

FaaS, said Newman, is “going to be the future for most of us. The question is whether or not it’s the present. Some of the current implementations do suck. The usability of stuff like Lambda is way worse than it should be.”

Despite the head start AWS had with Lambda, Newman said that Microsoft is catching up with serverless on Azure. He is more wary of Google, arguing that it is too dependent on Knative and Istio for delivering serverless, neither of which in his view are yet mature. He also thinks that Google’s decision not to develop Knative inside the CNCF is a mistake and will hold it back from adapting to the needs of developers.

How does serverless link with Newman’s speciality, microservices? Newman suggested getting started with a 1-1 mapping, taking existing microservices and running them as functions. “People go too far too fast,” he said. “They think, it makes it really easy for me to run functions, let’s have a thousand of them. That way lies trouble.”

Further breaking down a microservice into separate functions might make sense, he said, but you can “hide that detail from the outside world… you might change your mind. You might decide to merge those functions back together again, or strip them further apart.”

The microservice should be a logical unit, he said, and FaaS an implementation detail.

Despite being an advocate of public cloud, Newman recognises non-technical concerns. “More power is being concentrated in a small number of hands,” he said. “Those are socio-economic concerns that we can have conversations about.”

Among all the Kubernetes hype, has serverless received too little attention? If you believe Newman, this is the case. The twist, perhaps, is that some serverless platforms actually run on Kubernetes, explicitly so in the case of Google’s platform

Source: Microservices guru says think serverless, not Kubernetes: You don’t want to manage ‘a towering edifice of stuff’ • The Register

Village Traces 18 Months of Internet Outages to Old TV Set

Posted on by

A rural village in Wales has been suffering through internet outages and slowdowns for 18 months. The situation baffled technicians until they realized that turning off one man’s TV solved everything.

On Tuesday, U.K.-based broadband provider Openreach explained in a release that every morning, around 7 a.m., residents of the Aberhosan village found themselves experiencing issues connecting to the internet, and when they could log on, loading times slowed to a crawl. According to the provider, engineers were deployed to the area on multiple occasions only to find the network was functioning normally. The company went as far as replacing some cable, but its efforts were fruitless.

Openreach engineer Michael Jones explained that “as a final resort” a team visited the village to test for electrical interference. “By using a device called a Spectrum Analyser we walked up and down the village in the torrential rain at 6 a.m. to see if we could find an ‘electrical noise’ to support our theory,” Jones said. “And at 7 a.m., like clockwork, it happened! Our device picked up a large burst of electrical interference in the village.”

The team was able to trace the signal to a residence and found that the occupant had an aging TV that was producing electrical interference known as SHINE (Single High-level Impulse Noise). The TV’s owner had a habit of switching it on every morning at 7 a.m. as they started their day. “As you can imagine when we pointed this out to the resident, they were mortified that their old second-hand TV was the cause of an entire village’s broadband problems, and they immediately agreed to switch it off and not use again,” Jones said.

Openreach’s network is still on the outdated ADSL Broadband standard with plans to deploy fiber later this year. SHINE is a type of interference that screws with the frequencies that ADSL utilizes. When a device is powered on, a burst of frequencies is emitted that can knock devices offline or cause reduced speeds as a result of line errors. While SHINE is a single event that occurs when turning a device off and on, it can result in DSL circuits failing and losing sync. UK telecom Zen has some tips from identifying SHINE on your own using an AM radio.

Source: Village Traces 18 Months of Internet Outages to Old TV Set

Amazon Restricts How Rival Device Makers Buy Ads on Its Site

Posted on by

Some makers of smart speakers, video doorbells and other hardware hit roadblocks buying key ads in search results on Amazon; gadgets made by e-commerce giant get edge. From a report: Amazon.com is limiting the ability of some competitors to promote their rival smart speakers, video doorbells and other devices on its dominant e-commerce platform, according to Amazon employees and executives at rival companies and advertising firms. The strategy gives an edge to Amazon’s own devices, which the company regards as central to building consumer loyalty. It puts at a disadvantage an array of gadget makers such as Arlo that rely on Amazon’s site for a significant share of their sales. The e-commerce giant routinely lets companies buy ads that appear inside search results, including searches for competing products. Indeed, search advertising is a lucrative part of the company’s business.

But Amazon won’t let some of its own large competitors buy sponsored-product ads tied to searches for Amazon’s own devices, such as Fire TV, Echo Show and Ring Doorbell, according to some Amazon employees and others familiar with the policy. Roku which makes devices that stream content to TVs, can’t even buy such Amazon ads tied to its own products, some of these people said. In some cases, Amazon has barred competitors from selling certain devices on its site entirely. The policies show the conflicts between Amazon’s large e-commerce platform for sellers and its role as a product manufacturer in its own right. While traditional retailers buy inventory from manufacturers and resell it to consumers, limiting the number of vendors they can work with, Amazon’s platform has more than a million businesses and entrepreneurs selling directly to Amazon’s shoppers. Amazon accounts for 38% of online shopping in the U.S. and roughly half of all online shopping searches in the U.S. start on Amazon.com.

“News flash: retailers promote their own products and often don’t sell products of competitors,” said Amazon spokesman Drew Herdener in a written statement. “Walmart refuses to sell [Amazon brands] Kindle, Fire TV, and Echo. Shocker. In the Journal’s next story they will uncover gambling in Las Vegas.”

Source: Amazon Restricts How Rival Device Makers Buy Ads on Its Site – Slashdot

Which is another reason why marketplaces should not be allowed to sell products at all and another show of how monopoly dominance undercuts and destroys competition – which is bad for the consumer.

This is something I have been talking about since the beginning of last year and is now gaining traction

 

Facebook Fights Climate Change by Mass Banning of Climate Groups

Posted on by

Just last week, Facebook launched an initiative to uplift climate science. It was wildly misguided, yes, but the company was trying to show it’s down for the cause or something. Now, the company is proving just how devoted to climate activism it is by, um, booting environmental justice organizers from the platform. Tight!

Hundreds of Indigenous, environmental, and social justice groups and members had their accounts blocked this past weekend, leaving them unable to post or send messages. Greenpeace USA, Climate Hawks Vote, Stand.earth, Wet’suwet’en Access Point on Gidimt’en Territory, and Rainforest Action Network were among the groups that saw their accounts affected.

The accounts blocked were involved in planning a communications blockade event against KKR & Co., the U.S. investment firm that’s majority funder of the destructive Coastal Link natural gas pipeline, which is set to cut through land controlled by Indigenous people without consent. In other words, these groups were blocked while fighting climate injustice.

“Facebook is actively suppressing those who oppose fascism and the colonial capitalists,” activist Delee Nikal, a Wet’suwet’en band member of the Gitdimt’en clan, said in a statement emailed to Earther.

In a statement, Facebook said these suspensions were all just a random accident.

“Our systems mistakenly removed these accounts and content,” Facebook spokesman Andy Stone said.

He said all limits imposed had been lifted, but according to Greenpeace USA, though many accounts have now been restored, some are still blocked.

Source: Facebook Conducts ‘Mass Censorship’ of Climate Activists

The Nvidia RTX 3080 eBay Debacle Exposed a Scalper Bot Civil War

Posted on by

Last week, RTX 3080 scalpers pissed off a lot of Nvidia GPU fans by buying up all the graphics cards and attempting to resell them for hundreds of dollars more than the actual MSRP. Unfortunately, this is a common scalper tactic: Buy up as many items of a single product as possible, create a false scarcity, and sell them at a higher price to make a huge profit. People did this at the beginning of the covid-19 pandemic with hand sanitizers and other disinfecting products, and it happens all the time with consoles and PC components, too. Scalpers may have created bots to snatch up all those cards, but it looks like bots aren’t just helping the scalpers. They’re also hurting them.

Now RTX 3080 GPUs are being listed on eBay with bids that exceed $10,000. But those ridiculously high bids might be the result of bots created by fed-up potential buyers. After I wrote about who in the hell would buy a RTX 3080 for $70,000, I quickly received dozens of messages from people pointing me to a post on the Nvidia forums where a user claimed that they wrote a bot to inflate scalper prices. The post on Nvidia’s forums has since been removed, but I was able to connect with the post’s author. They confirmed they did not place that winning $70,000 bid, but they claimed they modified the source code for a free eBay bidding bot and ran that code on 10 spoof accounts. They said they were also able to use the same phone number on all 10 of those accounts, and that number was fake as well.

If this person was doing that, how many other people were doing the same thing, and how far were they driving up RTX 3080 auction prices? We analyzed 2,723 bids across 179 live auctions on Monday morning, Sept. 21, that totaled $966,927 worth of bids, and came away with some interesting results.

[…]

Without going through every single RTX 3080 auction, it’s hard to know how many automatic bids or bots are getting into bidding wars like this. And the way eBay presents bidding information sometimes makes it hard to parse through that information. But it’s clear there’s a huge chunk of people out there hoping to get these listings deleted and the sellers banned from eBay by inflating bid prices. eBay has a policy against price gouging, or “offering items at a price higher than is considered fair or reasonable,” and artificially inflating RTX 3080 auction prices seems to have grabbed eBay’s attention. It has started taking actions against some of these sellers.

One seller sent me a screenshot of an email they received from eBay saying their account, which they first activated in March 2014, has been suspended permanently.

The suspended seller told me they received about 100 messages from other eBay users, ranging from, “You should be ashamed of yourself,” to,“Fucking kill yourself.” While the latter type of message is definitely abusive, anger directed toward scalpers trying to make a quick buck is not misplaced.

We reached out to eBay, but the company has yet to respond.

Nvidia has responded to the chaos by publishing a full FAQ about the steps it’s taking to prevent scalpers and bots from getting the jump on real customers in the future.

“We moved our Nvidia Store to a dedicated environment, with increased capacity and more bot protection,” Nvidia announced. “We updated the code to be more efficient on the server load. We integrated CAPTCHA to the checkout flow to help offset the use of bots. We implemented additional security protections to the store APIs. And more efforts are underway.”

The company confirmed that it manually canceled hundreds of orders linked to malicious reseller accounts, and more cards will be available for purchase soon. Hopefully, both Nvidia and eBay take additional steps to address this issue before the launch of the RTX 3090 and RTX 3070.

Source: The Nvidia RTX 3080 eBay Debacle Exposed a Scalper Bot Civil War

OpenAI Sells out to Microsoft: exclusive license for mega-brain GPT-3 for anything and everything

Posted on by

Microsoft has bagged exclusive rights to use OpenAI’s GPT-3 technology, allowing the Windows giant to embed the powerful text-generating machine-learning model into its own products.

“Today, I’m very excited to announce that Microsoft is teaming up with OpenAI to exclusively license GPT-3, allowing us to leverage its technical innovations to develop and deliver advanced AI solutions for our customers, as well as create new solutions that harness the amazing power of advanced natural language generation,” Microsoft CTO Kevin Scott said on Tuesday.

Right now, GPT-3 is only available to a few teams hand picked by OpenAI. The general-purpose text-in-text-out tool is accessible via an Azure-hosted API, and is being used by, for instance, Reddit to develop automated content moderation algorithms, and by academics investigating how the language model could be used to spread spam and misinformation at a scale so large it would be difficult to filter out.

GPT-3 won’t be available on Google Cloud, Amazon Web Services etc

Microsoft has been cosying up to OpenAI for a while; it last year pledged to invest $1bn in the San Francisco-based startup. As part of that deal, OpenAI got access to Microsoft’s cloud empire to run its experiments, and Microsoft was named its “preferred partner” for commercial products. Due to the exclusive license now brokered, GPT-3 won’t be available on rival cloud services, such as Google Cloud and Amazon Web Services.

[…]

GPT-3 is a massive model containing 175 billion parameters, and was trained on all manner of text scraped from the internet. It’s able to perform all sorts of tasks, including answering questions, translating languages, writing prose, performing simple arithmetic, and even attempting code generation. Although impressive, it remains to be seen if it can be utilized in products for the masses rather than being an object of curiosity.

Source: Get ready for Clippy 9000: Microsoft exclusively licenses OpenAI’s mega-brain GPT-3 for anything and everything • The Register

Because everybody loves a monopolist

Another body for the Google graveyard: Chrome Web Store payments, citing alternatives – unlike Apple. Costs were 5%, also unlike Apple’s 30%.

Posted on by

Google has decided to shut down the Chrome Web Store payments API permanently after what was supposed to be a temporary closure at the start of the year.

In January, the internet advertising biz halted the publication of Chrome apps, extensions, and themes in the Chrome Web Store that were either paid-for or took in-app payments, following a flood of fraudulent transactions.

By February, developers could again submit paid items to be reviewed for inclusion in the Chrome Web Store. But the following month, Google again disabled Chrome Web Store payments, citing the challenges presented by the emergence of the COVID-19 pandemic.

“We understand that these changes may cause inconvenience, and we apologize for any interruption of service,” the Silicon Valley giant’s Chrome Web Store (CWS) team said in its email to developers in March.

It was also in January that Google announced plans to phase out Chrome apps, only to revise its schedule in August. Chrome apps, also known as Chrome packaged apps, are web apps tied to Chrome that were intended to behave like native apps by being launchable from the desktop, outside of the browser window.

On Monday, another email went out to registered extension developers informing them that Chrome Web Store payments will stop functioning in February next year.

“When we launched the Chrome Web Store 11 years ago, there weren’t a lot of ways for our developers to take payment from users,” the message to extension developers stated. “Today, there is a thriving ecosystem of payment providers offering a far more diverse set of features than a single provider could hope to. Now that our developers have so many great options to choose from, we can comfortably sunset our own payments integration.”

As of this week, the inability to create new paid extensions and to implement in-app purchases using the CWS payment API, ongoing since March, became permanent. On December 1, 2020, free trials will be disabled and the “Try Now” button in the CWS will vanish. On February 1, 2021 active CWS items and in-purchases will no longer be able to make transactions, though querying license information for previously paid-for purchases and subscriptions will still be allowed.

And at some indeterminate time after that, the licensing API will no longer function. The payments deprecation schedule is explained on the Chrome developer website.

Most developers do not charge directly for their extensions. Among the roughly 190,000 extensions in the Chrome Web Store, about nine per cent are either paid or implement in-app purchasing, according to Extension Monitor. These account for about 2.6 per cent of some 1.2bn installs.

Google doesn’t make data available to discern how many of paid CWS items use the CWS payment system and how many use third-party services such as Stripe or Braintree. Unlike Apple’s iOS App Store, Google does not require developers to use its payment system for their apps or extensions.

[…]

 

Source: Another body for the Google graveyard: Chrome Web Store payments. Bad news if you wanted to bank some income from these apps • The Register

Facebook says it may quit Europe over ban on sharing data with US

Posted on by

Facebook has warned that it may pull out of Europe if the Irish data protection commissioner enforces a ban on sharing data with the US, after a landmark ruling by the European court of justice found in July that there were insufficient safeguards against snooping by US intelligence agencies.

In a court filing in Dublin, Facebook’s associate general counsel wrote that enforcing the ban would leave the company unable to operate.

“In the event that [Facebook] were subject to a complete suspension of the transfer of users’ data to the US,” Yvonne Cunnane argued, “it is not clear … how, in those circumstances, it could continue to provide the Facebook and Instagram services in the EU.”

Facebook denied the filing was a threat, arguing in a statement that it was a simple reflection of reality. “Facebook is not threatening to withdraw from Europe,” a spokesperson said.

“Legal documents filed with the Irish high court set out the simple reality that Facebook, and many other businesses, organisations and services, rely on data transfers between the EU and the US in order to operate their services. A lack of safe, secure and legal international data transfers would damage the economy and hamper the growth of data-driven businesses in the EU, just as we seek a recovery from Covid-19.”

The filing is the latest volley in a legal battle that has lasted almost a decade. In 2011, Max Schrems, an Austrian lawyer, began filing privacy complaints with the Irish data protection commissioner, which regulates Facebook in the EU, about the social network’s practices.

Those complaints gathered momentum two years later, when the Guardian revealed the NSA’s Prism program, a vast surveillance operation involving direct access to the systems of Google, Facebook, Apple and other US internet companies. Schrems filed a further privacy complaint, which was eventually referred to the European court of justice.

That court found in 2015 that, because of the existence of Prism, the “Safe Harbour” agreement, which allowed US companies to transfer the data of EU citizens back home, was invalid.

The EU then attempted a second legal agreement for the data transfers, a so-called privacy shield; that too was invalidated in July this year, with the court again ruling that the US does not limit surveillance of EU citizens.

In September, the Irish data protection commissioner began the process of enforcing that ruling. The commissioner issued a preliminary order compelling the social network to suspend data transfers overseas.

In response, Nick Clegg, the company’s head of global affairs and communications, published a blogpost that argued that “international data transfers underpin the global economy and support many of the services that are fundamental to our daily lives”.

“In the worst-case scenario, this could mean that a small tech start-up in Germany would no longer be able to use a US-based cloud provider,” he wrote. “A Spanish product development company could no longer be able to run an operation across multiple time zones. A French retailer may find they can no longer maintain a call centre in Morocco.”

Clegg added: “We support global rules that can ensure consistent treatment of data around the world.”

Source: Facebook says it may quit Europe over ban on sharing data with US | Technology | The Guardian

Yep, mr Clegg. But the law is the law. And it’s a good law. Having EU Citizens’ private data in the hands of the megalomanic 4th Reich US government is not a good idea – in the EU people like the idea of having rights and privacy.

COVID-19 Conspiracy Theories Are a Public Health Threat

Posted on by

Public health crises have spawned conspiracy theories as far back as when the Black Death ravaged Europe in the 1300s, as people desperately try to make sense of the chaotic forces disrupting their lives. While modern science offers a better understanding of how diseases infect people and how to contain them, COVID-19 conspiracy theories are spreading rapidly via social media, unreliable news outlets and from our own political leaders, including U.S. President Donald Trump. The result: many Americans now believe pandemic-related conspiracy theories—and, alarmingly, those same people are less likely to take steps to prevent the virus from spreading.

In a University of Pennsylvania Annenberg Public Policy Center study published Monday in Social Science & Medicine, researchers surveyed a group of 840 U.S. adults—first in late March, and then again in mid-July—to determine how Americans’ beliefs and actions regarding the pandemic changed over time. Overall, they found that COVID-19 conspiracy theories are not only commonplace, they’re gaining traction. Back in March, 28% of people believed a debunked rumor that the Chinese government created the coronavirus as a bioweapon; that number rose to 37% by July. About 24% believed that the U.S. Centers for Disease Control and Prevention exaggerated the virus’ danger to hurt Trump politically despite a lack of evidence; by July, that figure rose to 32%. And in March, about 15% of respondents said they believed that the pharmaceutical industry created the virus to boost drug and vaccine sales—another unfounded theory—compared to 17% in July.

Whether or not someone thinks NASA hired Stanley Kubrick to fake the moon landing has little bearing on the world beyond that person. But in the case of a pandemic—which requires people to follow public health guidance in order to keep one another safe—conspiratorial thinking can have disturbing consequences. Indeed, the Annenberg study found that only 62% of people who were most likely to believe the coronavirus conspiracies said they wear a mask every day when they’re around other people away from home, compared to 95% of non-believers. Furthermore, people who believe COVID-19 conspiracy theories were 2.2 times less likely to say they wanted to receive a vaccine in March; by July, they were 3.5 times less likely to want to be vaccinated.

“Belief in pandemic conspiracy theories appears to be an obstacle to minimizing the spread of COVID-19,” said Dan Romer, Annenberg Public Policy Center research director and a study co-author, in a statement.

Where are people picking up COVID-19 conspiracy theories? Believers were more likely to be heavy users of social media and viewers of conservative media like Fox News, the study found. Meanwhile, people who watch other television news channels were more likely to follow public health guidance and to desire vaccination.

While the researchers say they understand how pandemic conspiracy theories are spreading, they say it’s still a challenge to get believers to reconsider once they’re sucked in. Other research suggests that simply correcting false information doesn’t usually work—and can even cause some people to believe conspiracies even more deeply.

“Conspiracy theories are difficult to displace because they provide explanations for events that are not fully understood, such as the current pandemic, play on people’s distrust of government and other powerful actors, and involve accusations that cannot be easily fact-checked,” said Kathleen Hall Jamieson, Annenberg Public Policy Center director and study co-author, in a statement.

Source: COVID-19 Conspiracy Theories Are a Public Health Threat | Time

Some managed Netgear switches suddenly need a cloud account to use its full UI. Also may not update security. Time to change vendor.

Posted on by

Netgear has decided that users of some of its managed network switches don’t need access to the equipment’s full user interface – unless they register their details with Netgear first.

For instance, owners of its 64W Power-over-Ethernet eight-port managed gigabit switch GC108P, and its 126W variant GC108PP, need to hand over information about themselves to the Netgear Cloud to get full use out of the devices.

“Starting from firmware version 1.0.5.4, product registration is required to unlock full access to the local browser user interface,” said the manufacturer in a note on its website referencing a version released in April this year.

The latest build, 1.0.5.8, released last week, continues that registration requirement. These rules also appear to apply to a dozen or so models of Netgear’s kit, including its GS724TPP 24-port managed Ethernet switch.

“I recently bought a couple of Netgear Managed Switches for business, and in their datasheet they list local-only management as a feature. Only after they arrived we discovered that you only get limited functionality in the local-only management mode, you have to register the switches to your Netgear Cloud account to get access to the full functionality,” fumed one netizen on a Hacker News discussion thread. “I would not have bought the switches if I had knew I needed to register them to Netgear Cloud to have access to the full functionality specified in the data sheet.”

It appears the Silicon Valley giant is aware that not everyone will rush to create a cloud account to manage their network hardware because it has published a list of functions that one can freely access without said registration – for now, anyway.

We’ve asked Netgear to explain the move. The manufacturer most recently made the headlines when, after being informed of a security flaw in a large number of product lines, promptly abandoned half of them rather than issue a patch.

Professor Alan Woodward of the University of Surrey, England, opined: “It’s a conundrum because it is software and you do have only a licence to use it: you don’t own it so one might argue this helps protect intellectual property rights. However, that’s different for the hardware which is pretty useless without the software.”

Woodward pointed to Netgear’s online privacy policy, which, like every other company on the internet, states that data from customers and others can be hoovered up for marketing purposes, research and so on (see section 11).

Source: Before you buy that managed Netgear switch, be aware you may need to create a cloud account to use its full UI • The Register

Trump Pushes to Reap Extensive Biometric Data From Immigrants, Americans, never delete them

Posted on by

Six million would-be U.S. immigrants face expanded collection of their biometric data, including iris scans, palm-, and voice-prints, facial recognition images, and DNA, under a proposed federal rule. The Department of Homeland Security also for the first time would gather that data from American citizens sponsoring or benefiting from a visa application.

Years in the making, the biometrics immigration rule has garnered more than 160 comments since its Sept. 11 publication. The 30-day comment period closes on Oct 13. A final version could be in place by Inauguration Day.

Immigration and privacy advocates have voiced concerns over who will have to comply with the new requirements, why President Donald Trump is making this push so late in his term, and what it means for a federal agency already claiming a lack of resources.

“The only words to describe this proposed rule is breathtaking,” said Doug Rand, who worked on technology and immigration policy in the Obama White House and then joined the Federation of American Scientists. “It’s clearly designed to drastically expand surveillance of immigrants, U.S. citizens, employers.”

The 300-plus-page plan updates current biometrics requirements so that “any applicant, petitioner, sponsor, beneficiary, or individual filing or associated with an immigration benefit or request, including U.S. citizens, must appear for biometrics collection without regard to age unless the agency waives or exempts the requirement.”

The DHS estimates an additional 2.17 million new biometrics submissions will be collected annually, an increase from the current 3.9 million, under the rule.

[…]

The DHS already collects fingerprints from some visa applicants. The new rule would expand that biometrics-gathering to iris images, palm- and voice- prints. The agency wants authority to require or request DNA testing to prove familial relationships where kinship is in question. The DNA data could be stored indefinitely, under the proposed rule.

[…]

While the current proposal doesn’t expressly reference employers, that doesn’t mean it couldn’t be applied to employer-backed visa holders down the road, said Michael Nowlan, co-leader of Clark Hill’s Immigration Business unit. “It’s just amazing to me how broad this is.”

One potential scenario for employers petitioning for visa-holding workers or sponsoring foreign workers for green cards is that legal counsel or even a human resources officer may be required to submit biometrics on the company’s behalf.

[…]

Should Trump win re-election, his administration can use this period of uncertainty to accelerate this regulation and carry it out in the new year. If Trump loses, and his team makes it final it before Democrat Joe Biden takes office, it’s a “huge headache” for the next administration, Rand said.

“It’s basically like burning down the house on your way out,” Rand said.

Source: Trump Pushes to Reap Biometric Data From Immigrants, Americans

This kind of data is dangerous in and of itself. Keeping it in a centralised database is a horrible idea – history has shown us again and again that these are abused and unsafe. And this is data about people that the people themselves, as well as their families, descendants, can’t change. Ever.

Microsoft Sysmon now logs data copied to the Windows Clipboard

Posted on by

Microsoft has released Sysmon 12, and it comes with a useful feature that logs and captures any data added to the Windows Clipboard.

This feature can help system administrators and incident responders track the activities of malicious actors who compromised a system.

Those not familiar with Sysmon, otherwise known as System Monitor, it is a Sysinternals tool that monitors Windows systems for malicious activity and logs it to the Windows event log.

Sysmon 12 adds clipboard capturing

With the release of Sysmon 12, users can now configure the utility to generate an event every time data is copied to the Clipboard. The Clipboard data is also saved to files that are only accessible to an administrator for later examination.

As most attackers will utilize the Clipboard when copying and pasting long commands, monitoring the data stored in the Clipboard can provide useful insight into how an attack was conducted.

To get started, download Sysmon 12 from its dedicated Sysinternal’s page or https://live.sysinternals.com/sysmon.exe.

Once downloaded, run it from an elevated command prompt, as it needs administrative privileges to run.

Simply running Sysmon.exe without any arguments will display a help screen, and for more detailed information, you can go to the Sysinternals’ Sysmon page.

Sysmon 12 help
Sysmon 12 help

Without any configuration, Sysmon will monitor basic events such as process creation and file time changes.

It is possible to configure it to log many other types of information by creating a Sysmon configuration file, which we will do to enable the new ‘CaptureClipboard’ directive.

For a very basic setup that will enable Clipboard logging and capturing, you can use the configuration file below:

Configuration file enabling the CaptureClipboard feature
Configuration file enabling the CaptureClipboard feature

To start Sysmon and direct it to use the above configuration file, you would enter the following command from an elevated command prompt:

sysmon -i sysmon.cfg.xml

Once started, Sysmon will install its driver and begin collecting data quietly in the background.

All Sysmon events will be logged to ‘Applications and Services Logs/Microsoft/Windows/Sysmon/Operational‘ in the Event Viewer.

With the CaptureClipboard feature enabled, when data is copied into the Clipboard it will generate an ‘Event 24 – Clipboard Changed’ entry in Event Viewer, as shown below.

Event 24 - Clipboard Changed
Event 24 – Clipboard Changed

The event log entry will display what process stored the data in the clipboard, the user who copied it, and when it was done. It will not, though, show the actual data that was copied.

The copied data is instead saved to the protected C:\Sysmon C:\Sysmon folder in files named clip-SHA1_HASH, where the hash is provided in the event above.

For example, the event displayed above would have the Clipboard contents stored in the C:\Sysmon\CLIP-CC849193D18FF95761CD8A702B66857F329BE85B file.

This C:\Sysmon folder is protected with a System ACL, and to access it, you need to download the psexec.exe program and launch a cmd prompt with System privileges using the following command:

psexec -sid cmd

After the new System command prompt is launched, you can go into the C:\Sysmon folder to access the saved Clipboard data.

Protected C:\Sysmon folder
Protected C:\Sysmon folder

When opening the CLIP-CC849193D18FF95761CD8A702B66857F329BE85B file, you can see that it contains a PowerShell command that I copied into the clipboard from Notepad.exe.

Capture Clipboard data
Capture Clipboard data

This PowerShell command is used to clear Shadow Volume Copies in Windows, which can be used by an attacker who wants to make it harder to restore deleted data.

Having this information illustrates how useful this feature can be when performing incident response.

Another useful feature added in Sysmon 11 will automatically create backups of deleted files, allowing administrators to recover files used in an attack.

Source: Microsoft Sysmon now logs data copied to the Windows Clipboard

The Air Force Has Already Flown a Secret Plane That Could Be Its Next Fighter

Posted on by

The U.S. Air Force has quietly built and flown a brand-new aircraft prototype that could become its next-generation fighter, the service’s top acquisition official announced Tuesday.

Dr. Will Roper, assistant secretary of the Air Force for acquisition, technology and logistics, revealed during the virtual 2020 Air, Space and Cyber conference that the new aircraft is part of the Next Generation Air Dominance (NGAD) program, which defies the traditional categorization of a single platform, featuring a network of advanced fighter aircraft, sensors and weapons in a growing and unpredictable threat environment.

“NGAD right now is designing, assembling, testing in the digital world — exploring things that would have cost time and money to wait for physical world results,” he said. “NGAD has come so far that the full-scale flight demonstrator has already flown in the physical world.”

During a roundtable with reporters, Roper declined to give specifics on the project, except that the craft was created using digital engineering, which allows the service to bypass the regular manufacturing process for parts and gives developers more flexibility to design and change blueprints. The service announced Monday that any weapon made using digital concepts will have an “e-” prefix in an effort to showcase these innovative processes.

The new aircraft has “broken a lot of records and is showing digital engineering isn’t a fluke,” Roper said. He declined to comment on whether the defense industry has taken part in the endeavor.

While he touted the expedited process of digital methods, “we don’t want our adversaries to know what they are,” Roper added.

The news comes four years after the Air Force laid out initial plans for what its future fighter jets might look like.

Source: The Air Force Has Already Flown a Secret Plane That Could Be Its Next Fighter | Military.com

All you need to know about FinCEN documents leak

Posted on by

Leaked documents involving about $2tn of transactions have revealed how some of the world’s biggest banks have allowed criminals to move dirty money around the world.

They also show how Russian oligarchs have used banks to avoid sanctions that were supposed to stop them getting their money into the West.

It’s the latest in a string of leaks over the past five years that have exposed secret deals, money laundering and financial crime.

What are the FinCEN files?

The FinCEN files are more than 2,500 documents, most of which were files that banks sent to the US authorities between 2000 and 2017. They raise concerns about what their clients might be doing.

These documents are some of the international banking system’s most closely guarded secrets.

Banks use them to report suspicious behaviour but they are not proof of wrongdoing or crime.

They were leaked to Buzzfeed News and shared with a group that brings together investigative journalists from around the world, which distributed them to 108 news organisations in 88 countries, including the BBC’s Panorama programme.

Hundreds of journalists have been sifting through the dense, technical documentation, uncovering some of the activities that banks would prefer the public not to know about.

Getty
FinCEN Files

  • 2,657documents including
  • 2,121 Suspicious Activity Reports

Source: ICIJ

Two acronyms you need to know

FinCEN is the US Financial Crimes Investigation Network. These are the people at the US Treasury who combat financial crime. Concerns about transactions made in US dollars need to be sent to FinCEN, even if they took place outside the US.

Suspicious activity reports, or SARs, are an example of how those concerns are recorded. A bank must fill in one of these reports if it is worried one of its clients might be up to no good. The report is sent to the authorities.

Why does this matter?

If you are planning to profit from a criminal enterprise, one of the most important things to have in place is a way of laundering the money.

Laundering money is the process of taking dirty money – the proceeds of crimes such as drug dealing or corruption – and getting it into an account at a respected bank where it will not be linked with the crime.

The same process is needed if you are a Russian oligarch whom Western countries have taken sanctions against to stop you getting your money into the West.

Banks are supposed to make sure they don’t help clients to launder money or move it around in ways that break the rules.

By law, they have to know who their clients are – it’s not enough to file SARs and keep taking dirty money from clients while expecting the authorities to deal with the problem. If they have evidence of criminal activity they should stop moving the cash.

Fergus Shiel from the International Consortium of Investigative Journalists (ICIJ) said the leaked files were an “insight into what banks know about the vast flows of dirty money across the globe”.

He said the documents also highlighted the extraordinarily large amounts of money involved. The documents in the FinCEN files cover about $2tn of transactions and they are only a tiny proportion of the SARs submitted over the period.

What has been revealed?

  • HSBC allowed fraudsters to move millions of dollars of stolen money around the world, even after it learned from US investigators the scheme was a scam.
  • JP Morgan allowed a company to move more than $1bn through a London account without knowing who owned it. The bank later discovered the company might be owned by a mobster on the FBI’s 10 Most Wanted list.
  • Evidence that one of Russian President Vladimir Putin’s closest associates used Barclays Bank in London to avoid sanctions which were meant to stop him using financial services in the West. Some of the cash was used to buy works of art.
  • The UK is called a “higher risk jurisdiction” like Cyprus, according to the intelligence division of FinCEN. That’s because of the number of UK registered companies that appear in the SARs. Over 3,000 UK companies are named in the FinCEN files – more than any other country.
  • The United Arab Emirates’ central bank failed to act on warnings about a local firm which was helping Iran evade sanctions.
  • Deutsche Bank moved money launderers’ dirty money for organised crime, terrorists and drug traffickers. More details (BuzzFeed News)
  • Standard Chartered moved cash for Arab Bank for more than a decade after clients’ accounts at the Jordanian bank had been used in funding terrorism.
Image copyright EPA
Image caption Canary Wharf, the heart of London’s banking network

Why is this leak different?

There have been a number of big leaks of financial information in recent years, including:

The FinCEN papers are different because they are not just documents from one or two companies – they come from a number of banks.

They highlight a range of potentially suspicious activity involving companies and individuals and also raise questions about why the banks which had noticed this activity did not always act on their concerns.

FinCEN said the leak could impact on US national security, compromise investigations, and threaten the safety of institutions and individuals who file the reports.

But last week it announced proposals to overhaul its anti-money laundering programmes.

The UK has also unveiled plans to reform its register of company information to clamp down on fraud and money laundering.

Source: All you need to know about FinCEN documents leak

The Hype Machine by Sinan Aral: how does social media form our decisions

Posted on by
Drawing on two decades of his own research and business experience, Aral goes under the hood of the biggest, most powerful social networks to tackle the critical question of just how much social media actually shapes our choices, for better or worse. Aral shows how the tech behind social media offers the same set of behavior-influencing levers to both Russian hackers and brand marketers—to everyone who hopes to change the way we think and act—which is why its consequences affect everything from elections to business, dating to health. Along the way, he covers a wide array of topics, including how network effects fuel Twitter’s and Facebook’s massive growth to the neuroscience of how social media affects our brains, the real consequences of fake news, the power of social ratings, and the impact of social media on our kids.

In mapping out strategies for being more thoughtful consumers of social media, The Hype Machine offers the definitive guide to understanding and harnessing for good the technology that has redefined our world overnight.

Source: The Hype Machine by Sinan Aral: 9780525574514 | PenguinRandomHouse.com: Books

For more information on Dark Patterns and how they affect you, click here

And for another roundup of information on this: How programmers addict you to social media, games and your mobile phone

In A Complete Fluke, A Euro/Jap Spacecraft Is About To Fly Past Venus – And Could Look For Signs Of Life

Posted on by

Earlier this week, scientists announced the discovery of phosphine on Venus, a potential signature of life. Now, in an amazing coincidence, a European and Japanese spacecraft is about to fly past the planet – and could confirm the discovery.

On Monday, September 14, a team of scientists said they had found evidence for phosphine in the atmosphere of Venus. The region in which it was found, about 50 kilometers above the surface, is outside the harsh conditions on the Venusian surface, and could be a habitat for airborne microbes.

[…]

And as luck would have it, a joint mission comprising two spacecraft – one from the European Space Agency (ESA) and the other from the Japanese space agency (JAXA) – is about to fly past Venus that could tell us for sure.

BepiColombo, launched in 2018, is on its way to enter orbit around Mercury, the innermost planet of the Solar System. But to achieve that it plans to use two flybys of Venus to slow itself down, one on October 15, 2020, and another on August 10, 2021.

The teams running the spacecraft already had plans to observe Venus during the flyby. But now, based on this detection of phosphine from telescopes on Earth, they are now planning to use both of these flybys to look for phosphine using an instrument on the spacecraft.

“We possibly could detect phosphine,” says ESA’s Johannes Benkhoff, BepiColombo’s Project Scientist. “But we do not know if our instrument is sensitive enough.”

The instrument on the European side of the mission, called MERTIS (MErcury Radiometer and Thermal Infrared Spectrometer), is designed to study the composition of the surface of Mercury. However, the team believe they can also use it to study the atmospheric composition of Venus during both flybys.

On this first flyby, the spacecraft will get no closer than 10,000 kilometers from Venus. That’s very far, but potentially still close enough to make a detection.

“There actually is something in the spectral range of MERTIS,” says Jörn Helbert from the German Aerospace Center, co-lead on the MERTIS instrument. “So we are now seeing if our sensitivity is good enough to do observations.”

As this first flyby is only weeks away, however, the observation campaign of the spacecraft is already set in stone, making the chance of a discovery slim. More promising is the second flyby next year, which will not only give the team more time to prepare, but also approach just 550 kilometers from Venus.

“[On the first flyby] we have to get very, very lucky,” says Helbert . “On the second one, we only have to get very lucky. But it’s really at the limit of what we can do.”

Source: In A Complete Fluke, A European Spacecraft Is About To Fly Past Venus – And Could Look For Signs Of Life

Epic’s new filing claims Apple lied about Fortnite’s popularity: Apple used Google Trends data!

Posted on by

There’s a new development in the high-profile game of chicken between Apple and Epic. The Fortnite developer’s latest legal filing claims that Apple “cherry-picked” Google data in its own legal filing earlier this week to support its narrative that Fortnite’s declining popularity is the impetus behind all this drama.

Apple has repeatedly argued that Epic started the legal battle over Fortnite in its App Store as a publicity stunt because the game’s hype has started to flatline. In a filing Tuesday, it said that interest in Fortnite had fallen “by nearly 70%” between October 2019 and July 2020 according to Google Trends and that Epic’s lawsuit “appears to be part of a marketing campaign designed to reinvigorate interest in Fortnite.”

But Epic’s calling bullshit on those claims, citing its own user engagement data as proof that the Fortnite hype train is still chugging along just fine, thank you.

“Over the period of time that Apple cherry-picked for its Google search volume comparison… the number of daily active users on Fortnite actually increased by more than 39%,” the company wrote in reply papers filed late Friday evening.

Not to mention that Apple’s decision to cite Google Trends, of all things, is already suspect to begin with. It measures the volume of searches for any given term, but even if people aren’t searching for Fortnite on Google as much as they used to be, that doesn’t prove a correlation between how many people are still playing or downloading the game. I’d put money on this being an Occam’s broom scenario: Apple just went with that statistic because it was the only one they found that proved their point.

As a recap, Apple booted Fortnite off its App Store in August after Epic’s theatrical attempt to circumvent its so-called “Apple Tax,” which requires that developers fork over 30% of revenue from in-app purchases for the privilege of having their app on iOS. The two have been playing a melodramatic game of tit-for-tat ever since. Epic immediately sued, of course, then Apple terminated its App Store developer account for iOS. After that, Epic vowed not to push the Aug. 27 Fortnite update to iOS or macOS in retaliation, and Apple launched a countersuit for compensatory and punitive damages, calling Epic’s actions a deliberate attempt to undermine its iOS ecosystem.

The drama is still playing out in court, with a full court hearing scheduled for Sept. 28. In the case’s first hearing in August, a judge ruled that Apple could kick Fortnite off its App Store but not Epic’s Unreal Engine. Epic has also asked the court to restore both Fortnite and its developer account in the App Store.

It’s likely these two will continue to take jabs at one another throughout this legal drama, so you might as well settle in and grab some popcorn as these incendiary press releases keep flying.

Source: Epic’s new filing claims Apple lied about Fortnite’s popularity

The F-35 Lightning II can’t fly in lightning once again

Posted on by

The most widely used variant of the F-35 Joint Strike Fighter is currently unable to fly in thunderstorms after the discovery of damage to one of the systems it uses to protect itself from lightning, its prime contractor Lockheed Martin said Wednesday.

To safely fly in conditions where lightning is present, the F-35 relies on its Onboard Inert Gas Generation System, or OBIGGS, which pumps nitrogen-enriched air into the fuel tanks to inert them. Without this system, a jet could explode if struck by lightning.

However, damage to one of the tubes that distributes inert gas into the fuel tank was discovered during routine depot maintenance of an F-35A at Hill Air Force Base’s Ogden Logistics Complex in Utah, Lockheed said in a statement.

[…]

“As a safety precaution, the JPO recommended to unit commanders that they implement a lightning flight restriction for the F-35A, which restricts flying within 25 miles of lightning or thunderstorms,” Lockheed said. “We are working with the F-35 Joint Program Office (JPO) on a root cause corrective action investigation to determine next steps.”

[…]

Bloomberg, which obtained a JPO memo dated June 5, reported that flawed tubes were found in 14 of the 24 “A” models inspected.

The JPO did not respond immediately to a request for comment.

For a plane nicknamed “Lightning II,” the F-35′s lightning protection systems have, ironically, become an embarrassing problem issue for the jet at times throughout its development.

The F-35 was prohibited from flying within 25 miles of lightning in the early 2010s after the Pentagon’s weapons tester discovered deficiencies with the original OBIGGs system in getting enough inert gas into the fuel tanks. Those restrictions were rescinded after the OBIGGS was redesigned in 2014.

Source: The F-35 Lightning II can’t fly in lightning once again

Facebook Accused of Watching Instagram Users Through Cameras. FB claims “bug”

Posted on by

Facebook is again being sued for allegedly spying on Instagram users, this time through the unauthorized use of their mobile phone cameras. Bloomberg reports: The lawsuit springs from media reports in July that the photo-sharing app appeared to be accessing iPhone cameras even when they weren’t actively being used. Facebook denied the reports and blamed a bug, which it said it was correcting, for triggering what it described as false notifications that Instagram was accessing iPhone cameras.

In the complaint filed Thursday in federal court in San Francisco, New Jersey Instagram user Brittany Conditi contends the app’s use of the camera is intentional and done for the purpose of collecting “lucrative and valuable data on its users that it would not otherwise have access to.” By “obtaining extremely private and intimate personal data on their users, including in the privacy of their own homes,” Instagram and Facebook are able to collect “valuable insights and market research,” according to the complaint.

Source: Facebook Accused of Watching Instagram Users Through Cameras – Slashdot

Iranian Hackers Beat Encrypted Apps like Telegram, WhatsApp – since 2014

Posted on by

Iranian hackers, most likely employees or affiliates of the government, have been running a vast cyberespionage operation equipped with surveillance tools that can outsmart encrypted messaging systems — a capability Iran was not previously known to possess, according to two digital security reports released Friday.

The operation not only targets domestic dissidents, religious and ethnic minorities and antigovernment activists abroad, but can also be used to spy on the general public inside Iran, said the reports by Check Point Software Technologies, a cybersecurity technology firm, and the Miaan Group, a human rights organization that focuses on digital security in the Middle East.

The reports, which were reviewed by The New York Times in advance of their release, say that the hackers have successfully infiltrated what were thought to be secure mobile phones and computers belonging to the targets, overcoming obstacles created by encrypted applications such as Telegram and, according to Miaan, even gaining access to information on WhatsApp. Both are popular messaging tools in Iran. The hackers also have created malware disguised as Android applications, the reports said.

[…]

According to the report by Check Point’s intelligence unit, the cyberespionage operation was set up in 2014, and its full range of capabilities went undetected for six years.

[…]

The hackers appeared to have a clear goal: stealing information about Iranian opposition groups in Europe and the United States and spying on Iranians who often use mobile applications to plan protests, according to the Miaan report.

Among the most prominent victims of the attacks, the reports said, are the Mujahedeen Khalq, or M.E.K., an insurgent group that the Iranian authorities regard as a terrorist organization; a group known as the Association of Families of Camp Ashraf and Liberty Residents; the Azerbaijan National Resistance organization; citizens of Iran’s restive Sistan and Balochistan Province; and Hrana, an Iranian human rights news agency. Human rights lawyers and journalists working for Voice of America have also been targeted, Miaan said.

According to Check Point, the hackers use a variety of infiltration techniques, including phishing, but the most widespread method is sending what appear to be tempting documents and applications to carefully selected targets.

[…]

These documents contained malware code that activated a number of spyware commands from an external server when the recipients opened them on their desktops or phones. According to the Check Point report, almost all of the targets have been organizations and opponents of the government who have left Iran and are now based in Europe. Miaan documented targets in the United States, Canada and Turkey as well as the European Union.

The spyware enabled the attackers to gain access to almost any file, log clipboard data, take screenshots and steal information. According to Miaan, one application empowered hackers to download data stored on WhatsApp.

In addition, the attackers discovered a weakness in the installation protocols of several encrypted applications including Telegram, which had always been deemed relatively secure, enabling them to steal the apps’ installation files.

These files, in turn, allow the attackers to make full use of the victims’ Telegram accounts. Although the attackers cannot decipher the encrypted communications of Telegram, their strategy makes it unnecessary. Rather, they use the stolen installation files to create Telegram logins to activate the app in the victims’ names on another device. This enables the attackers to secretly monitor all Telegram activity of the victims.

“This cutting-edge surveillance operation succeeded in going under the radar for at least six years,” said Lotem Finkelstein, head of threat intelligence at Check Point. “The group maintained a multi-platform, targeted attack, with both mobile, desktop and web attack vectors, that left no evasion path for victims on the target list.”

[…]

Source: Iranian Hackers Can Beat Encrypted Apps like Telegram, Researchers Say – The New York Times

Estée Lauder products will launch to space. NASA astronauts will fllm them floating around the ISS

Posted on by

The International Space Station has served as the world’s most unique laboratory for two decades, hosting hundreds of scientific experiments, crews of astronauts and even the occasional slime.

But now, NASA, one of the space station’s primary operators, is preparing to oversee the largest push of business activity aboard the ISS. Later this month, up to 10 bottles of a new Estée Lauder (EL) skincare serum will launch to the space station, a NASA spokesperson told CNN Business. NASA astronauts are expected to film the items in the microgravity environment of the ISS and the company will be able to use that footage in ad campaigns or other promotional material.
The details of those plans were first reported by New Scientist magazine.
If the footage is used in a commercial, it would not be the first advertisement filmed in space; nor will it be the first time NASA has worked with corporate advertisers. But it will mark one of the most high-profile cases of NASA offering up the American portion of the space station for capturing zero-gravity footage of a product.
The Estée Lauder partnership will continue NASA’s years-long push to encourage private-sector spending on space projects as the space agency looks to stretch its budget beyond the ISS and focus on taking astronauts back into deep space. Those efforts include allowing the space station to be used for marketing and entertainment purposes.

Source: Estée Lauder products will launch to space. NASA astronauts will fllm them floating around the ISS – CNN

Google bans stalkerware apps from Android store. Which is cool but… why were they allowed in the first place?

Posted on by

In an update to its Android Developer Program Policy, Google on Wednesday said stalkerware apps in its app store can no longer be used to stalk non-consenting adults.

Stalkerware, which the web giant defines as “code that transmits personal information off the device without adequate notice or consent and doesn’t display a persistent notification that this is happening,” may still be used for keeping track of one’s kids.

But starting October 1, 2020, the ad biz says it’s no longer acceptable for Android apps in the Google Play Store to track another person, such as a spouse, without permission, unless there’s a persistent visible notification that data is being transmitted.

The ban follows a similar prohibition in August on Google-served ads for “spyware and technology used for intimate partner surveillance,” which reportedly hasn’t worked very well.

In recent years, computer security experts have argued that the privacy and security risks in intimate relationships remain haven’t been adequately anticipated or addressed.

But rules against invasive behavior aren’t necessarily effective. Via Twitter, Michael Veale, a lecturer at University College London, observed that a 2018 research paper “found that ‘abusers frequently exploit dual-use applications—tools whose main purpose is legitimate but that can be easily repurposed to function as spyware,’ so banning explicit stalkerware of questionable efficacy.”

Google will continue to allow non-stalkerware apps (i.e. policy compliant apps) to monitor and track people, provided the programs are not marketed as surveillance apps, they disclose any such functions, and they present the requisite persistent notification and icon.

Monitoring apps of the permissible sort continue to be subject to removal for violating applicable laws in the locations where they’re published, and may not link to resources (e.g. servers, SDKs) that provide policy violating functions or non-compliant APKs hosted outside the Google Play Store.

Google’s developer policy update also includes a ban on misrepresentation, both for apps and developer accounts. Apps or accounts that impersonate a person or organization, or attempt to conceal the app’s purpose or ownership, or engage in coordinated misleading activity, are no longer allowed.

Source: Google bans stalkerware apps from Android store. Which is cool but… why were they allowed in the first place? • The Register

To answer the question: The tech giants will do almost anything to get  your location information because it allows them to know and control you better.

The Weather Channel app settles suit over selling location data of 49m people without consent

Private Intel Firm Buys Location Data to Track People to their ‘Doorstep’ sourced from innocuous seeming apps

How Location Tracking Actually Works on Your Smartphone (and how to manipulate it – kind of)

Google collects Android location data even if you turn it off and don’t have a SIM card inserted

US carmakers collect and keep driven locations

And some more links

The Weather Channel app settles suit over selling location data of 49m people without consent

Posted on by

IBM and the Los Angeles city attorney’s office have settled a privacy lawsuit brought after The Weather Channel app was found to be selling user location data without proper disclosure. The lawsuit was filed last year, at which point the app had 45 million active users.

IBM has changed the way that users are informed, and also agreed to donate $1M worth of technology to assist LA County with its coronavirus contact tracing efforts …

 

Associated Press reports.

The operator of The Weather Channel mobile app has agreed to change how it informs users about its location-tracking practices and sale of personal data as part of a settlement with the Los Angeles city attorney’s office, officials said Wednesday.

City Attorney Mike Feuer alleged in a 2019 lawsuit that app users were misled when they agreed to share their location information in exchange for personalized forecasts and alerts. Instead, the lawsuit claimed users were unaware they had surrendered personal privacy when the company sold their data to third parties.

Feuer announced the settlement Wednesday with the app’s operator, TWC Product and Technology LLC, and owner IBM Corp. The app’s disclosure screens were initially revised after the lawsuit was filed and future changes that will be monitored by the city attorney’s office are planned.

Source: The Weather Channel app settles suit over selling location data – 9to5Mac