The Linkielist

Linking ideas with the world

The Linkielist

Author Archives: Robin Edgar

About Robin Edgar

Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft

Ex-boss of ICANN shifts from ‘advisor’ to co-CEO of private equity biz that tried to buy .org for $1bn

Posted on by

The former head of DNS regulator ICANN has been named as co-CEO of a company that launched a controversial attempt to purchase the .org internet registry earlier this year. The news has again raised concerns over the revolving doors between regulators and those who need regulation.

In the past week, the website of Ethos Capital, the private equity firm that offered $1.13bn to take control of the popular .org registry, was updated to list ex-ICANN CEO Fadi Chehade as its joint head.

The change is significant because it was Chehade’s involvement in the attempted .org purchase that first alerted internet users that the deal deserved closer scrutiny.

The sale was ultimately vetoed several months later by ICANN, but only after the Attorney General of California got involved and sent a last-minute letter to LA-based ICANN telling it not to approve the deal in part due to the “lack of transparency” on Ethos Capital.

Part of that lack of transparency was who would actually own the .org registry after the sale: behind Ethos was a complex structure of no less than four shell companies that were all registered on the same day in Delaware with the prefix “Purpose Domains.” Ethos Capital refused to divulge who all the directors of those companies actually were despite repeat requests, including from ICANN, which had the power to refuse the sale.

Chehade’s close link to the proposed sale was only noticed because he had registered Ethos Capital’s .org domain name, EthosCapital.org, under his own name on May 7, 2019. The company Ethos Capital LLC was registered in Delaware one week later, on May 14, 2019.

All in the timing

That date is significant because May 13, 2019, the day before Ethos Capital was established, was the deadline for ICANN staff to publish a report on the controversial lifting of price caps on .org domains.

For the previous 20 years, the price of .org domains had been strictly limited by ICANN to a specific annual percentage increase. However, under reforms Chehade made as CEO of ICANN, prior to his departure in 2016, registries were allowed to request the caps be removed altogether when their current contract expired.

The company that runs .org, the Internet-Society-owned Public Internet Registry (PIR), had made that request for its contract expiring June 30, 2019, sparking a furious backlash from the internet community. ICANN public comment periods typically attract between five and 50 comments but when it came to the lifting of price caps on .org domains, there were over 3,200 responses of which more than 98 per cent were opposed to the idea.

That staff report of the comment period, due on May 13, was supposed to be an objective review of what the internet community has said; the internet community meanwhile, has long complained that ICANN’s staff frequently skew such reports to fit with a predetermined outcome.

The .org price cap issue was no exception, and despite overwhelming opposition, the staff report gave equal weight to the few comments in favor of the change as to the thousands opposed to it. It was clear that ICANN’s staff would recommend their board approve lifting the .org price caps: a decision that was potentially worth hundreds of millions of dollars over the course of the new ten-year contract.

There are just over 10 million .org domains, and the registry is one of the oldest and most stable in the market. In 2019, PIR reported [PDF] a 78.2 per cent renewal rate, meaning that the vast majority of existing domain holders automatically renewed their names for another year (you can register domains for multiple years but roughly 70 per cent of people renew a domain every year). To put it into hard numbers, there were 6.9 million .org renewals in 2019.

License to print money

That extraordinary loyalty rate, believed to be the highest in the domain industry, is what makes .org so valuable. Many organizations have built their websites and online reputation on .org domains for a decade or more, and domain names are incredibly cheap (roughly $10 a year) when compared to the enormous costs associated with moving to a different online home.

That makes the .org registry home to over eight million domain registrants who would likely pay many multiples of the current annual cost to keep their name. Even if PIR doubled its price from $10 to $20, the renewal rate would be unlikely to fall very much, resulting in an additional $69m in revenue, or thereabouts, just for that one year. In short, the .org registry without price caps was a money-printing machine.

Chehade was clearly following the issue closely, and the day after the staff report deadline, Ethos Capital – the private equity outfit that would a few months later approach the owner of the .org registry, the Internet Society – was registered in Delaware.

What makes this timeline all the more peculiar is that it isn’t clear that the staff report was actually published on Monday, May 13, 2019. Due to the volume of comments, ICANN’s staff asked for, and were granted, an extension. And so the final report that those outside the domain industry saw for the first time was published [PDF] three weeks later on June 3, 2019.

Did the former CEO of ICANN use his many connections with staff, many of whom he had hired and promoted, to get an early copy of the staff report? And is that why when Ethos Capital was named as the company trying to buy the .org registry there was no mention of Chehade’s close connection?

Despite the evidence and repeat requests, Ethos Capital refused to acknowledge Chehade’s involvement, even when he was spotted at the PIR offices, shortly after the deal was announced, with Ethos Capital CEO Erik Brooks, a former business partner, to discuss the acquisition.

Oh, that Chehade?

Eventually, Ethos Capital admitted its relationship with Chehade several months later in January in response to very specific questions posed by ICANN about the deal. On page 25 of a 27-page response [PDF] from Ethos, it answered a request that it name “former directors, officers or employees of ICANN that are or have been involved in, have advised on or otherwise have an interest in the transaction.”

And it named Nora Abusitta-Ouri, Chehade’s former personal assistant who had worked with him at previous companies; Allen Grogan, whom Chehade had hired to be ICANN’s head of compliance, and Fadi Chehade himself. They were “acting as advisors to Ethos Capital,” the company insisted, and provided no more details. Grogan, incidentally, is now listed as an Ethos Capital “executive partner” on its website.

It’s possible that Chehade’s connections with the CEOs of PIR, Jon Nevett, and the Internet Society, Andrew Sullivan, that made the dot-org takeover even remotely possible. It was always going to be a hard sell – as was made clear from the response when the deal, which had been green-lit in secret and in record time by the Internet Society and PIR boards, was announced.

When the Internet Society revealed that it was not only selling .org to a private equity firm but would also change PIR’s status from a non-profit organization to a for-profit one as part of the deal, the internet community and .org registrants were stunned. And then outraged.

Chehade had had plenty of time to work out the details and he knew the key person, PIR CEO Jonathon Nevett, extremely well. Nevett was co-founder of registry operator Donuts and had been a persistent presence in the domain name industry for years, many of them when Chehade was head of the industry’s regulator. The connection continued after Chehade left ICANN.

When Nevett sold Donuts in 2018 to Abry Partners, it was in a deal that was brokered by… Fadi Chehade and Erik Brooks. Within a few months, Nevett became CEO of PIR. And his position at Donuts was taken by another long-term Chehade business associate Akram Atallah, who had taken over as interim CEO of ICANN after Chehade left.

Contractual terms

As for the also-new CEO of the Internet Society, Andrew Sullivan, he had previously worked at Afilias, which runs the technical back-end of .org for the Internet Society’s PIR, and was the person responsible more than any other of helping the Internet Society win the contract to run .org 20 years previously. More than 80 per cent of the Internet Society’s annual revenue comes from the sale of .org domains.

Chehade was the connection between all these men who pushed through a proposal that the internet community, .org registrants, the internet society chapters, not to mention a former CEO and the former chair of ICANN, and US senators all condemned in the strongest terms.

Eventually it took the Attorney General of California, and an explicit threat to audit the notoriously secretive non-profit organization based in Los Angeles, to push ICANN off the .org sell-off and refuse it.

As for why Chehade persisted in only being an advisor to Ethos Capital when he almost certainly helped establish the company, filled it with his old staff, and was the point person for the entire deal, the answer to that may be in responses to questions put to the Internet Society and PIR about when they were first approached about a possible sale of .org.

“The Internet Society was first approached by Ethos Capital in September,” the organization told us in an official statement in response to our questions about interactions and timing of the deal. When PIR was asked the same question, its CEO Jon Nevett answered that he had no knowledge of any planned sale to Ethos Capital when he took over the CEO job in December 2018, or when his organization decided to formally ask for pricing caps to be lifted.

But of course, Ethos Capital only formally existed in May 2019. And Fadi Chehade was not a representative of Ethos Capital, merely an advisor, until last week when he suddenly became co-CEO. As to conversations Chehade may have had with his former staff to smooth the path of the billion-dollar sale, ICANN continues to refuse to supply records of staff or board communications, citing confidentiality.

Source: Ex-boss of ICANN shifts from ‘advisor’ to co-CEO of private equity biz that tried to buy .org for $1bn+ • The Register

Microsoft’s Doing the Monopoly Thing Again, Slack Says

Posted on by

Workplace messaging software company Slack is accusing Microsoft of monopoly behavior in an antitrust complaint filed today to European Union regulators. Unsurprisingly, the accusations hinge on the same practice that helped make Microsoft rich in the first place.

Bill Gates, Windows, innovation, yes, yes, OK—undoubtedly Microsoft had a lot to contribute to the early years of home computing. But what helped it grow to mammoth scale was software bundling: specifically, the practice of getting its products pre-installed on brand new machines built by third parties—and making it hard to delete those programs and replace them with competitors.

You might remember this refrain from such hits as United States v. Microsoft Corporation, and Microsoft Corp. vs. Commission, the latter of which eventually cost the company over a billion dollars after it became “the first company in 50 years of EU competition policy that the Commission has had to fine for failure to comply with an antitrust decision,” according to the European Commission’s then-Competition Commissioner Neelie Kroes.

Kind of makes you wonder how Apple still gets away with setting Safari as the default browser on iOS devices, but I digress…

While those early cases against Microsoft focused on software like Internet Explorer and Windows Media Player, Slack’s new legal salvo concerns the company’s bundling of competing chat app Teams with its ubiquitous productivity suite Microsoft Office. In a press release, Slack accused its rival of “force installing it for millions, blocking its removal, and hiding the true cost to enterprise customers,” which Slack believes to be an “illegal and anti-competitive practice.”

“We’re confident that we win on the merits of our product, but we can’t ignore illegal behavior that deprives customers of access to the tools and solutions they want,” said Jonathan Prince, vice president of communications and policy at Slack. “Slack threatens Microsoft’s hold on business email, the cornerstone of Office, which means Slack threatens Microsoft’s lock on enterprise software.”

Reached for comment, a Microsoft spokesperson sniped that “we created Teams to combine the ability to collaborate with the ability to connect via video, because that’s what people want. With COVID-19, the market has embraced Teams in record numbers while Slack suffered from its absence of video-conferencing. We’re committed to offering customers not only the best of new innovation, but a wide variety of choice in how they purchase and use the product.”

The merits of the case will be decided by the Commission, but the existence of the suit is a smart play for Slack, which has seen its stock slip recently, perhaps as a result of Teams’s encroachment on its market share. The EU has consistently had a greater appetite to pursue antitrust concerns compared to the U.S., where both companies are headquartered, making it a doubly clever play for the considerably smaller and more vulnerable party.

Source: Microsoft’s Doing the Monopoly Thing Again, Slack Says

test detects cancer four years before conventional diagnosis using a blood test

Posted on by

Early detection has the potential to reduce cancer mortality, but an effective screening test must demonstrate asymptomatic cancer detection years before conventional diagnosis in a longitudinal study. In the Taizhou Longitudinal Study (TZL), 123,115 healthy subjects provided plasma samples for long-term storage and were then monitored for cancer occurrence. Here we report the preliminary results of PanSeer, a noninvasive blood test based on circulating tumor DNA methylation, on TZL plasma samples from 605 asymptomatic individuals, 191 of whom were later diagnosed with stomach, esophageal, colorectal, lung or liver cancer within four years of blood draw. We also assay plasma samples from an additional 223 cancer patients, plus 200 primary tumor and normal tissues. We show that PanSeer detects five common types of cancer in 88% (95% CI: 80–93%) of post-diagnosis patients with a specificity of 96% (95% CI: 93–98%), We also demonstrate that PanSeer detects cancer in 95% (95% CI: 89–98%) of asymptomatic individuals who were later diagnosed, though future longitudinal studies are required to confirm this result. These results demonstrate that cancer can be non-invasively detected up to four years before current standard of care.

Source: Non-invasive early detection of cancer four years before conventional diagnosis using a blood test | Nature Communications

China successfully launches Mars probe that packs an orbiter, lander, rover

Posted on by

China has successfully launched a Mars probe.

The middle kingdom’s previous red planet effort, 2011’s Yinghuo-1, rode on a Russian rocket that failed to leave Earth orbit and therefore did not fulfill its orbital observation mission.

For this new mission, dubbed Tianwen-1, China has used its own Long March 5 heavy lifter and packed in an orbiter, lander and rover.

Chinese State media has confirmed the launch and a People’s Daily social media post includes video of a rocket heading upwards and says it’s Mars-bound.

China’s being typically cagey about the mission, which is believed to plan a landing with a combination of parachutes and airbags before the rover deploys a range of instruments capable of investigating Martian magnetic fields, geology and chemistry. The orbiter packs a camera capable of two-metre resolution from a height of 400kms, plus more magnetosphere-sensing kit.

If the mission succeeds, China will join the USA, Soviet Union, European Union and India as successful sponsors of Mars missions. Only the USA, Soviet Union and EU have landed rovers on the red planet.

Source: China successfully launches Mars probe that packs an orbiter, lander, rover • The Register

Twitter hack latest: Up to 36 compromised accounts had their private messages read – including a Dutch politician’s

Posted on by

Twitter has admitted that the naughty folk who hijacked verified accounts last week read a portion of hacked users’ direct messages.

Among the 36 Twitter users whose direct messages (DMs), email addresses and phone numbers were definitely accessed by account hijackers last week was one Dutch politician, the microblogging platform said overnight.

“We believe that for up to 36 of the 130 targeted accounts, the attackers accessed the DM inbox, including 1 elected official in the Netherlands. To date, we have no indication that any other former or current elected official had their DMs accessed,” Twitter said in an updated post.

The hack happened after an individual or persons unknown gained access to Twitter’s administrative tools, allegedly after bribing a company insider.

As we reported last week, a number of Twitter accounts belonging to high-profile individuals were compromised. Those accounts all have blue ticks, indicating that they really do belong to whomever’s name and mugshot they bear.

Source: Twitter hack latest: Up to 36 compromised accounts had their private messages read – including a Dutch politician’s • The Register

Fitness freaks flummoxed as massive global Garmin outage leaves them high and dry for hours

Posted on by

Garmin’s Connect service has been down for more than seven hours today to the frustration of fitness enthusiasts keen to upload running times or synchronise with other services such as Strava. So, too, is the company’s web shop and support forums.

Users have expressed obvious concern that such an extended outage is indicative of a problem beyond maintenance, worrying perhaps about their personal data stored there, and for sure the company’s communication has been poor.

Garmin Connect lets owners of Garmin devices such as fitness trackers and smart watches upload their activity, enabling analysis of activity, achievements, and optionally sharing with friends. It can be linked with other services like Strava so data uploaded to Garmin Connect also appears there.

[…]

Initially the Garmin social media accounts were for the most part silent on the matter. “@GarminFitness @Garmin @GarminUK Garmin Connect has now been down for over 6 hours. Your forums are returning a runtime error and are down. Not one of these three accounts has even mentioned this,” said one customer.

[…]

A customer was quick to comment that “the fact that this makes my watch not talk to my phone makes me upset”. The phone is working, the watch is working, both are nearby, but data has to go to the internet and back for the two to communicate. It is an IoT issue, which nobody notices while connectivity is good.

“What’s going on @Garmin. Something don’t feel right. You can’t get us to buy watches and make it part of our daily lives and one day just to AWOL,” complained another.

Strava has pointed users at a support note explaining how to upload a file in .FIT format directly, though this is a tedious process compared to wireless synchronisation.

We have asked Garmin for more information. ®

Updated to add

It is suspected that Garmin has been hit by the WastedLocker ransomware, ZDNet reports citing the manufacturer’s staff on Twitter and an article from Taiwan that Garmin’s production line will be shut for two days due to a computer virus.

Source: Fitness freaks flummoxed as massive global Garmin outage leaves them high and dry for hours • The Register

And this is why we like stuff that isn’t in the cloud

US accuses Chinese-Made Drones with Security Weakness: the possiblity to update their software

Posted on by

In two reports, the researchers contended that an app on Google’s Android operating system that powers drones made by China-based Da Jiang Innovations, or DJI, collects large amounts of personal information that could be exploited by the Beijing government. Hundreds of thousands of customers across the world use the app to pilot their rotor-powered, camera-mounted aircraft.

The world’s largest maker of commercial drones, DJI has found itself increasingly in the cross hairs of the United States government, as have other successful Chinese companies. The Pentagon has banned the use of its drones, and in January the Interior Department decided to continue grounding its fleet of the company’s drones over security fears. DJI said the decision was about politics, not software vulnerabilities.

[…]

The security research firms that documented it, Synacktiv, based in France, and GRIMM, located outside Washington, found that the app not only collected information from phones but that DJI can also update it without Google reviewing the changes before they are passed on to consumers. That could violate Google’s Android developer terms of service.

The changes are also difficult for users to review, the researchers said, and even when the app appears to be closed, it awaits instructions from afar, they found.

“The phone has access to everything the drone is doing, but the information we are talking about is phone information,” said Tiphaine Romand-Latapie, a Synacktiv engineer. “We don’t see why DJI would need that data.”

[…]

Synacktiv did not identify any malicious uploads but simply raised the prospect that the drone app could be used that way.

A New York Times analysis of the software confirmed the functionality. An attempt to update the app directly from DJI’s servers delivered a message indicating that the phone The Times used “did not meet the qualifications for an update package.”

Source: Popular Chinese-Made Drone Is Found to Have Security Weakness – The New York Times

Note: nowhere do they say what data is supposedly being stolen, in fact they admit there has been no data stolen as far as they have seen. This is stirring the pot: you want your stuff to get updates in life. That’s called security.

Facebook settles unauthorised use of facial recognition for $650 million

Posted on by

Facebook has agreed to pay a total of $650 million in a landmark class action lawsuit over the company’s unauthorized use of facial recognition, a new court filing shows.

The filing represents a revised settlement that increases the total payout by $100 million and comes after a federal judge balked at the original proposal on the grounds it did not adequately punish Facebook.

The settlement covers any Facebook user in Illinois whose picture appeared on the site after 2011. According to the new document, those users can each expect to receive between $200 and $400 depending on how many people file a claim.

The case represents one of the biggest payouts for privacy violations to date, and contrasts sharply with other settlements such as that for the notorious data breach at Equifax—for which victims are expected to received almost nothing.

The Facebook lawsuit came about as a result of a unique state law in Illinois, which obliges companies to get permission before using facial recognition technology on their customers.

The law has ensnared not just Facebook, but also the likes of Google and photo service Shutterfly. The companies had insisted in court that the law did not apply to their activities, and lobbied the Illinois legislature to rule they were exempt, but these efforts fell short.

The final Facebook settlement is likely to be approved later this year, meaning Illinois residents will be poised to collect a payout in 2021.

The judge overseeing the settlement rejected the initial proposal in June on the grounds that the Illinois law provides penalties of $5,000, meaning Facebook could have been obliged to pay $47 billion—an amount far exceeding what the company agreed to pay under the settlement.

“We are focused on settling as it is in the best interest of our community and our shareholders to move past this matter,” said a Facebook spokesperson.

Edelson PC, the law firm representing the plaintiffs, declined to comment on the revised deal.

Source: Facebook adds $100 million to facial recognition settlement | Fortune

Amazon Met With Startups About Investing, Then Launched Competing Products

Posted on by

When Amazon.com’s venture-capital fund invested in DefinedCrowd, it gained access to the technology startup’s finances and other confidential information. Nearly four years later, in April, Amazon’s cloud-computing unit launched an artificial-intelligence product that does almost exactly what DefinedCrowd does, said DefinedCrowd founder and Chief Executive Daniela Braga. The new offering from Amazon Web Services, called A2I, competes directly “with one of our bread-and-butter foundational products” that collects and labels data, said Ms. Braga. After seeing the A2I announcement, Ms. Braga limited the Amazon fundâ(TM)s access to her company’s data and diluted its stake by 90% by raising more capital. Ms. Braga is one of more than two dozen entrepreneurs, investors and deal advisers interviewed by The Wall Street Journal who said Amazon appeared to use the investment and deal-making process to help develop competing products.

In some cases, Amazon’s decision to launch a competing product devastated the business in which it invested. In other cases, it met with startups about potential takeovers, sought to understand how their technology works, then declined to invest and later introduced similar Amazon-branded products, according to some of the entrepreneurs and investors. An Amazon spokesman said the company doesn’t use confidential information that companies share with it to build competing products. Dealing with Amazon is often a double-edged sword for entrepreneurs. Amazon’s size and presence in many industries, including cloud-computing, electronic devices and logistics, can make it beneficial to work with. But revealing too much information could expose companies to competitive risks.

Source: Amazon Met With Startups About Investing, Then Launched Competing Products – Slashdot

I have been talking about the vast market powers of the monopolists and exactly this case with Amazon since early 2019

Instacart Customers’ Data Is Being Sold Online, but Instacart has it’s fingers in it’s ears, pretends nothing is wrong

Posted on by

The personal information of what could be hundreds of thousands of Instacart customers is being sold on the dark web. This data includes names, the last four digits of credit card numbers, and order histories, and appears to have affected customers who used the grocery delivery service as recently as yesterday.

As of Wednesday, sellers in two dark web stores were offering information from what appeared to be 278,531 accounts, although some of those may be duplicates or not genuine. As of April, Instacart had “millions of customers across the US and Canada,” according to a company spokesperson.

The company denied there had been a breach of its data.

“We are not aware of any data breach at this time. We take data protection and privacy very seriously,” an Instacart spokesperson told BuzzFeed News. “Outside of the Instacart platform, attackers may target individuals using phishing or credential stuffing techniques. In instances where we believe a customer’s account may have been compromised through an external phishing scam outside of the Instacart platform or other action, we proactively communicate to our customers to auto-force them to update their password.”

The source of the information, which also included email addresses and shopping data, was unknown, but appeared to have been uploaded from at least June until today.

“It’s looking recent and totally legit,” Nick Espinosa, the head of cybersecurity firm Security Fanatics, told BuzzFeed News after reviewing the accounts being sold.

Two women whose personal information was for sale confirmed they were Instacart customers, that their last order date and amount matched what appeared on the dark web, and that the credit card information belonged to them.

Source: Instacart Customers’ Data Is Being Sold Online

Amazon’s auditing of Alexa Skills is so good, these boffins got all 200+ rule-breaking apps past the reviewers

Posted on by

Amazon claims it reviews the software created by third-party developers for its Alexa voice assistant platform, yet US academics were able to create more than 200 policy-violating Alexa Skills and get them certified.

In a paper [PDF] presented at the US Federal Trade Commission’s PrivacyCon 2020 event this week, Clemson University researchers Long Cheng, Christin Wilson, Song Liao, Jeffrey Alan Young, Daniel Dong, and Hongxin Hu describe the ineffectiveness of Amazon’s Skills approval process.

The researchers have also set up a website to present their findings.

Like Android and iOS apps, Alexa Skills have to be submitted for review before they’re available to be used with Amazon’s Alexa service. Also like Android and iOS, the Amazon’s review process sometimes misses rule-breaking code.

In the researchers’ test, sometimes was every time: The e-commerce giant’s review system granted approval for every one of 234 rule-flouting Skills submitted over a 12-month period.

“Surprisingly, the certification process is not implemented in a proper and effective manner, as opposed to what is claimed that ‘policy-violating skills will be rejected or suspended,'” the paper says. “Second, vulnerable skills exist in Amazon’s skills store, and thus users (children, in particular) are at risk when using [voice assistant] services.”

Amazon disputes some of the findings and suggests that the way the research was done skewed the results by removing rule-breaking Skills after certification, but before other systems like post-certification audits might have caught the offending voice assistant code.

The devil is in the details

Alexa hardware has been hijacked by security researchers for eavesdropping and the software on these devices poses similar security risks, but the research paper concerns itself specifically with content in Alexa Skills that violates Amazon’s rules.

Alexa content prohibitions include limitations on activities like collecting information from children, collecting health information, sexually explicit content, descriptions of graphic violence, self-harm instructions, references to Nazis or hate symbols, hate speech, the promotion drugs, terrorism, or other illegal activities, and so on.

Getting around these rules involved tactics like adding a counter to Skill code, so the app only starts spewing hate speech after several sessions. The paper cites a range of problems with the way Amazon reviews Skills, including inconsistencies where rejected content gets accepted after resubmission, vetting tools that can’t recognize cloned code submitted by multiple developer accounts, excessive trust in developers, and negligence in spotting data harvesting even when the violations are made obvious.

Amazon also does not require developers to re-certify their Skills if the backend code – run on developers’ servers – changes. It’s thus possible for Skills to turn malicious if the developer alters the backend code or an attacker compromises a well-intentioned developer’s server.

As part of the project, the researchers also examined 825 published Skills for kids that either had a privacy policy or a negative review. Among these, 52 had policy violations. Negative comments by users mention unexpected advertisements, inappropriate language, and efforts to collect personal information.

Source: Amazon’s auditing of Alexa Skills is so good, these boffins got all 200+ rule-breaking apps past the reviewers • The Register

The Record Industry Is Going After Parody Songs Written By an Algorithm

Posted on by

Georgia Tech researcher Mark Riedl didn’t expect that his machine learning model “Weird A.I. Yankovic,” which generates new rhyming lyrics for existing songs would cause any trouble. But it did.

On May 15, Reidl posted an AI-generated lyric video featuring the instrumental to Michael Jackson’s “Beat It.” It was taken down on July 14, Reidl tweeted, after Twitter received a Digital Millennium Copyright Act takedown notice for copyright infringement from the International Federation of the Phonographic Industry, which represents major and independent record companies.

“I am fairly convinced that my videos fall under fair use,” Riedl told Motherboard of his AI creation, which is obviously inspired by Weird Al’s parodies. Riedl said his other AI-generated lyric videos posted to Twitter have not been taken down.

Riedl has contested the takedown with Twitter but has not received a response. Twitter also did not respond to Motherboard’s request for comment.

The incident raises the question of what role machine learning plays when it comes to the already nuanced and complicated rules of fair use, which allows for the use of a copyrighted work in certain circumstances, including educational uses and as part of a “transformative” work. Fair use also protects parody in some circumstances.

Riedl, whose research focuses on the study of artificial intelligence and storytelling for entertainment, says the model was created as a personal project and outside his role at Georgia Tech. “Weird A.I. Yankovic generates alternative lyrics that match the rhyme and syllables schemes of existing songs. These alternative lyrics can then be sung to the original tune,” Riedl said. “Rhymes are chosen, and two neural networks, GPT-2 and XLNET, are then used to generate each line, word by word.”

Source: The Record Industry Is Going After Parody Songs Written By an Algorithm

Oddly enough, game publishers seem to be able to contest DMCA on YouTube in 20 minutes when they are at a convention. It’s like it’s not being applied fairly at all…

KFC will test lab-grown chicken nuggets made with a 3D bioprinter this fall in Russia

Posted on by
  • KFC announced on July 16 it would test chicken nuggets made with 3D bioprinting technology in Russia this fall.
  • The chain partnered with 3D Bioprinting Solutions to create a chicken nugget that will mimic the taste and appearance of its original nuggets at a fraction of the environmental cost.
  • The release will be the first time a major chain will sell a lab-grown meat product and may serve as a proof-of-concept for the much-hyped cell-based meat industry.
  • Visit Business Insider’s homepage for more stories.

KFC will test chicken nuggets made with 3D bioprinting technology in Moscow, Russia, this fall, the chain announced in a July 16 press release.

The chicken chain has partnered with 3D Bioprinting Solutions to create a chicken nugget made in a lab with chicken and plant cells using bioprinting. Bioprinting, which uses 3D-printing techniques to combine biological material, is used in medicine to create tissue and even organs.

The 3D-printed chicken nuggets will closely mimic the taste and appearance of KFC’s original chicken nuggets, according to the press release. KFC expects the production of 3D-printed nuggets to be more environmentally friendly than the production process of its traditional chicken nuggets. The fall release will mark the first debut of a lab-grown chicken nugget at a global fast-food chain like KFC.

Source: KFC will test lab-grown chicken nuggets made with a 3D bioprinter this fall in Russia

Russia tested satellite-to-satellite shooter, say UK and USA

Posted on by

The USA and UK have alleged that Russia last week trialled an in-orbit satellite-killer weapon.

US Space Force chief of operations General John Raymond put his name to a statement that says on July 15th Russia “injected a new object into orbit from Cosmos 2543”, a satellite that Moscow insists is a maintenance vehicle but which the USA believes is a weapons platform.

Cosmos 2543 sidled up to another Russian satellite before releasing the object that moved at around 700 km/h.

The UK’s Ministry of Defence popped up a Tweet about the incident:

The Outer Space Treaty prohibits the use of weapons in space, so if Moscow has conducted a weapons test it has been very naughty indeed. However it is widely believed that several nations posses missiles that could reach space to attack satellites.

Such attacks are important because satellite play a significant role assisting and directing terrestrial conflicts.

Moscow loves a show of force: in 2018 it revealed hypersonic warheads, a nuclear-powered submarine drone, cruise missiles with nearly unlimited range, and a ground-based laser weapon, but claimed none would be used for anything other than retaliation.

Whatever it was that Cosmos 2543 launched appears to have been rather less exotic

Source: Russia tested satellite-to-satellite shooter, say UK and USA • The Register

Google aims at Amazon and fires: List your products on Google Shopping for free

Posted on by

we’re advancing our plans to make it free for merchants to sell on Google. Beginning next week, search results on the Google Shopping tab will consist primarily of free listings, helping merchants better connect with consumers, regardless of whether they advertise on Google. With hundreds of millions of shopping searches on Google each day, we know that many retailers have the items people need in stock and ready to ship, but are less discoverable online.

For retailers, this change means free exposure to millions of people who come to Google every day for their shopping needs. For shoppers, it means more products from more stores, discoverable through the Google Shopping tab. For advertisers, this means paid campaigns can now be augmented with free listings. If you’re an existing user of Merchant Center and Shopping ads, you don’t have to do anything to take advantage of the free listings, and for new users of Merchant Center, we’ll continue working to streamline the onboarding process over the coming weeks and months.

These changes will take effect in the U.S. before the end of April, and we aim to expand this globally before the end of the year. Our help center has more details on how to participate in free product listings and Shopping ads.

We’re also kicking off a new partnership with PayPal to allow merchants to link their accounts. This will speed up our onboarding process and ensure we’re surfacing the highest quality results for our users. And we’re continuing to work closely with many of our existing partners that help merchants manage their products and inventory, including Shopify, WooCommerce, and BigCommerce, to make digital commerce more accessible for businesses of all sizes.

Source: List your products on Google Shopping for free – The Keyword

Copyright Claims Block Star Trek, Cartoon Network Comic-Con Panels video streams. Somehow they get to fix DMCA in 20 minutes – why doesn’t the  rest of the world?

Posted on by

It wouldn’t be a virtual event without a few technical difficulties. Though I can’t imagine the media giants showcasing at San Diego Comic-Con’s online event were worried about copyright violations affecting their panels. Considering, you know, they’re the ones that own the copyright.

Of course, that’s exactly what happened.

On Thursday, ViacomCBS livestreamed an hour-long panel for this year’s virtual SDCC to showcase properties in its ever-expansive Star Trek universe such as Picard, Discovery, and the upcoming Star Trek: Lower Decks. The stream briefly went dark, however, after YouTube’s copyright bots flagged the stream and replaced it with a warning that read: “Video unavailable: This video contains content from CBS CID, who has blocked it on copyright grounds.”

The hiccup occurred as the cast and producers of Discovery performed an “enhanced” read-through of the show’s season 2 finale accompanied by sound effects and on-screen storyboards. Evidently, the video sounded enough like the real deal to trigger YouTube’s software, even if it was obvious from looking at the stream that it wasn’t pirated content.

It only took about 20 minutes for the feed to be restored, but the irony of CBS’s own panel running afoul of its copyright (even accidentally) was too good for audiences to gloss over. As noted by io9’s Beth Elderkin, a later Cartoon Network panel livestream was similarly pulled offline over a copyright claim from its parent company, Turner Broadcasting.

Source: Copyright Claims Block Star Trek, Cartoon Network Comic-Con Panels

UNESCO launches worldwide online public consultation on the ethics of artificial intelligence

Posted on by

Today, UNESCO is launching a global online consultation on the ethics of artificial intelligence, to give everyone around the world the opportunity to participate in the work of its international group of experts on AI. This group has been charged with producing the first draft of a Recommendation on the Ethics of AI, to be submitted to UNESCO Member States for adoption in November 2021. If adopted, it will be the first global normative instrument to address the developments and applications of AI.

“It is crucial that as many people as possible take part in this consultation, so that voices from around the world can be heard during the drafting process for the first global normative instrument on the ethics of AI”, says Audrey Azoulay, Director-General of UNESCO.

Twenty-four renowned specialists with multidisciplinary expertise on the ethics of artificial intelligence have been tasked with producing a draft UNESCO Recommendation that takes into account the wide-ranging impacts of AI, including on the environment and the needs of the global south.

With this consultation, UNESCO is inviting civil society organizations, decision-makers, the general public, intergovernmental and non-governmental organizations, media representatives, the private sector, the scientific community and all other interested stakeholders to comment on the draft text before 31 July 2020.

UNESCO is convinced that that there is an urgent need for a global instrument on the ethics of AI to ensure that ethical, social and political issues can be adequately addressed both in times of peace and in extraordinary situations like the current global health crisis.

The UNESCO Recommendation is expected to define shared values and principles, and identify concrete policy measures on the ethics of AI. Its role will be to help Member States ensure that they uphold the fundamental rights of the UN Charter and of the Universal Declaration of Human Rights and that research, design, development, and deployment of AI systems take into account the well-being of humanity, the environment and sustainable development.

The final draft text will be presented for adoption by Member States during the 41st session of UNESCO’s General Conference in November 2021.

Source: UNESCO launches worldwide online public consultation on the ethics of artificial intelligence

BadPower Attack Can Trick Power Bricks into Starting a Fire

Posted on by

In a study published by Xuanwu Labs (which is owned by Chinese tech giant Tencent), researchers detailed the BadPower hack which works by manipulating the firmware inside fast charge power adapters.

Normally, when a phone is connected to a power brick with support for fast charging, the phone and the power adapter communicate with each other to determine the proper amount of electricity that can be sent to the phone without damaging the device—the more juice the power adapter can send, the faster it can charge the phone.

However, by hacking the fast charging firmware built into a power adapter, Xuanwu Labs demonstrated that bad actors could potentially manipulate the power brick into sending more electricity than a phone can handle, thereby overheating the phone, melting internal components, or as Xuanwu Labs discovered, setting the device on fire.

Here’s a photo captured by researchers at Xuanwu showing what a charging brick infected with BadPower can do to a connected device.
Here’s a photo captured by researchers at Xuanwu showing what a charging brick infected with BadPower can do to a connected device.
Photo: Xuanwu Labs (Other)

After confirming the results of the research, Xuanwu labs decided to test BadPower by loading it onto 35 different power bricks (out of 234 available models currently on sale) and discovered that 18 of those chargers (made by eight different vendors) were susceptible to the attack.

To make matters worse, if BadPower is used to hack a power brick, there would be no external signs or easy ways of detecting that the device had been tampered with. Fortunately, for now, it will require the bad actor to have physical access to the power adapter. The researchers at Xuanwu claimed hacking a power adapter was as simple as connecting it to a portable, custom-designed rig that can upload malicious code to the power brick in a just a few seconds. And in some cases, the researchers were able to upload BadPower just by connecting a power adapter to an infected phone or laptop.

Source: BadPower Attack Can Trick Power Bricks into Starting a Fire

Sloan Digital Sky Surver releases biggest 3D map of the universe

Posted on by

An international consortium has compiled the most comprehensive 3D map of the observable cosmos to date, significantly improving our understanding of cosmological history while raising new questions about the fundamental laws that govern the universe.

The updated map, made from data gathered by the Sloan Digital Sky Survey (SDSS), offers a detailed history of the cosmos, from the Big Bang and its early expansion phase through to the current era.

The latest phase of the project, called “extended Baryon Oscillation Spectroscopic Survey” (eBOSS), includes the positions and distances of more than 4 million galaxies and ultra-bright quasars surrounding supermassive black holes, according to a press release from EPFL, a Swiss research institute. The new results are showing how the universe evolved over an 11-billion-year period, filling an important gap in our knowledge.

“In 2012, I launched the eBOSS project with the idea of ​​producing the most complete 3D map of the Universe throughout the lifetime of the Universe, implementing for the first time celestial objects that indicate the distribution of matter in the distant Universe, galaxies that actively form stars and quasars,” Jean-Paul Kneib, a co-leader of the project and an EPFL astrophysicist, said in the press release. “It is a great pleasure to see the culmination of this work today.”

The eBOSS project has resulted in 23 new scientific papers (plus the new map), which were released today to the arXiv pre-print server.

Astrophysicists have previously chronicled the earliest days of the universe by calculating the abundance of elements created after the Big Bang and studying the Cosmic Microwave Background Radiation—the cooled remnant of the universe’s first light. Scientists also have a good handle on recent cosmological history, as informed by galactic maps and distance measurements. But “there’s a troublesome gap in the middle 11 billion years,” said Kyle Dawson, a cosmologist at the University of Utah and the principal investigator of eBoss, in an SDSS press release.

To gaze back at this 11-billion-year gap, the scientists honed in on galaxies and quasars, looking for patterns in how they’re distributed across the universe. These observations were then combined with data gathered during previous phases of SDSS, dating back to 1998.

“Taken together, detailed analyses of the eBOSS map and the earlier SDSS experiments have now provided the most accurate expansion history measurements over the widest-ever range of cosmic time,” Will Percival, an astrophysicist at the University of Waterloo and eBOSS’s Survey Scientist, said in the EPFL statement. “These studies allow us to connect all these measurements into a complete story of the expansion of the Universe.”

The updated map shows empty voids and filaments that defined the universe a mere 300,000 years after the Big Bang, which happened 13.8 billion years ago. By identifying ancient quasars—extremely bright galactic cores surrounding supermassive black holes—the researchers were able to map regions more than 11 billion years old. To map more recent periods, namely regions between 6 billion and 11 billion years old, the scientists tracked patterns in the distribution of galaxies, which subsequently enabled more accurate measurements of dark energy.

Source: New Map of the Universe Fills in Some ‘Troublesome’ Gaps

AI helps drone swarms navigate through crowded, unfamiliar spaces

Posted on by

Drone swarms frequently fly outside for a reason: it’s difficult for the robotic fliers to navigate in tight spaces without hitting each other. Caltech researchers may have a way for those drones to fly indoors, however. They’ve developed a machine learning algorithm, Global-to-Local Safe Autonomy Synthesis (GLAS), that lets swarms navigate crowded, unmapped environments. The system works by giving each drone a degree of independence that lets it adapt to a changing environment.

Instead of relying on existing maps or the routes of every other drone in the swarm, GLAS has each machine learning how to navigate a given space on its own even as it coordinates with others. This decentralized model both helps the drones improvise and makes scaling the swarm easier, as the computing is spread across many robots.

An additional tracking controller, Neural-Swarm, helps the drones compensate for aerodynamic interactions, such as the downwash from a robot flying overhead. It’s already more reliable than a “commercial” controller that doesn’t account for aerodynamics, with far smaller tracking errors.

This could be useful for drone light shows, of course, but it could also help with more vital operations. Search and rescue drones could safely comb areas in packs, while self-driving cars could keep traffic jams and collisions to a minimum. It may take a while before there are implementations outside of the lab, but don’t be surprised if flocks of drones become relatively commonplace.

Source: AI helps drone swarms navigate through crowded, unfamiliar spaces | Engadget

The Physical Traits that Define Men and Women in Literature

Posted on by

After slogging through that book, I began paying attention to similarly stereotyped descriptions of bodies in other books. Women are all soft thighs and red lips. Men, strong muscles and rough hands.

I was frustrated by this lazy writing. I want to read books that explore the full humanity of their characters, not stories that reduce both men and women to weak stereotypes of their gender.

Before getting too upset, I wanted to see if this approach to writing was as widespread as it seemed, or if I was succumbing to selective reading. Do authors really mention particular body parts

more for men than for women? Are women’s bodies described using different adjectives than those attributed to men?

[…]

It’s easy to dismiss or overlook the differences in the way men’s and women’s bodies are depicted because they can be subtle and hard to discern in one particular book—one or two extra mentions of “his bushy hair” may not register over 300 pages.

But when you zoom out and look at thousands of books, the patterns are clear.

In real life, women are obviously more dimensional than soft, sexual objects. Men are more complex than muscular lunkheads. We should expect that same nuance of the characters in the books we read.

Instead of focusing on her perfect hair and soft hips and wet eyes, tell me about her strong legs

that carry her through the world, or her capable hands that do her life’s work. Don’t reduce him to his muscular forearms and rough knuckles and chiseled jaw. I want to read about his silly smile for his family or his soft heart for animals.

 

Source: The Physical Traits that Define Men and Women in Literature

Firefox on Android: Camera remains active when phone is locked or the user switches apps after streaming

Posted on by

Mozilla says it’s working on fixing a bug in Firefox for Android that keeps the smartphone camera active even after users have moved the browser in the background or the phone screen was locked.

A Mozilla spokesperson told ZDNet in an email this week that a fix is expected for later this year in October.

The bug was first spotted and reported to Mozilla a year ago, in July 2019, by an employee of video delivery platform Appear TV.

The bug manifests when users chose to video stream from a website loaded in Firefox instead of a native app.

Mobile users often choose to stream from a mobile browser for privacy reasons, such as not wanting to install an intrusive app and grant it unfettered access to their smartphone’s data. Mobile browsers are better because they prevent websites from accessing smartphone data, keeping their data collection to a minimum.

The Appear TV developer noticed that Firefox video streams kept going, even in situations when they should have normally stopped.

While this raises issues with streams continuing to consume the user’s bandwidth, the bug was also deemed a major privacy issue as Firefox would continue to stream from the user’s device in situations where the user expected privacy by switching to another app or locking the device.

“From our analysis, a website is allowed to retain access to your camera or microphone whilst you’re using other apps, or even if the phone is locked,” a spokesperson for Traced, a privacy app, told ZDNet, after alerting us to the issue.

“While there are times you might want the microphone or video to keep working in the background, your camera should never record you when your phone is locked,” Traced added.

Source: Firefox on Android: Camera remains active when phone is locked or the user switches apps | ZDNet

Mozilla offers trusted VPN services – good timing!

Posted on by

Starting today, there’s a VPN on the market from a company you trust. The Mozilla VPN (Virtual Private Network) is now available on Windows and Android devices. This fast and easy-to-use VPN service is brought to you by Mozilla, the makers of Firefox, and a trusted name in online consumer security and privacy services.

See for yourself how the Mozilla VPN works:

 

The first thing you may notice when you install the Mozilla VPN is how fast your browsing experience is. That’s because the Mozilla VPN is based on modern and lean technology, the WireGuard protocol’s 4,000 lines of code, is a fraction in size of legacy protocols used by other VPN service providers.

You will also see an easy-to-use and simple interface for anyone who is new to VPN, or those who want to set it and get onto the web.

With no long-term contracts required, the Mozilla VPN is available for just $4.99 USD per month and will initially be available in the United States, Canada, the United Kingdom, Singapore, Malaysia, and New Zealand, with plans to expand to other countries this Fall.

Source: Mozilla Puts Its Trusted Stamp on VPN – The Mozilla Blog

Especially after 7 no logs VPN services just dumped millions of lines of logs with very very personal information in them

Seven ‘no log’ VPN providers accused of leaking – yup, you guessed it – 1.2TB of user logs onto the internet

Posted on by

A string of “zero logging” VPN providers have some explaining to do after more than a terabyte of user logs were found on their servers unprotected and facing the public internet.

This data, we are told, included in at least some cases clear-text passwords, personal information, and lists of websites visited, all for anyone to stumble upon.

It all came to light this week after Comparitech’s Bob Diachenko spotted 894GB of records in an unsecured Elasticsearch cluster that belonged to UFO VPN.

The silo contained streams of log entries as netizens connected to UFO’s service: this information included what appeared to be account passwords in plain text, VPN session secrets and tokens, IP addresses of users’ devices and the VPN servers they connected to, connection timestamps, location information, device characteristics and OS versions, and web domains from which ads were injected into the browsers of UFO’s free-tier users.

UFO stated in bold in its privacy policy: “We do not track user activities outside of our site, nor do we track the website browsing or connection activities of users who are using our Services.” Yet it appears it was at least logging connections to its service – and in a system anyone could access if they could find it.

More than 20 million entries were added a day to the logs, according to Comparitech, and UFO happens to boast on its website it has 20 million users. Diachenko said he alerted the provider to the misconfiguration on July 1, the day he found the unprotected database, and heard nothing back.

Oh, it gets worse

A few days later, on July 5, the data silo was separately discovered by Noam Rotem’s team at VPNmentor, and it became clear the security blunder went well beyond UFO. It appears seven Hong-Kong-based VPN providers – UFO VPN, FAST VPN, Free VPN, Super VPN, Flash VPN, Secure VPN, and Rabbit VPN – all share a common entity, which provides a white-labelled VPN service.

And they were all leaking data onto the internet from that unsecured Elasticsearch cluster, VPNmentor reported. Altogether, some 1.2TB of data was sitting out in the open, totaling 1,083,997,361 log entries, many featuring highly sensitive information, it is said.

This exposed cluster contained, we’re told, at least some records of websites visited, connection logs, people’s names, subscribers’ email and home addresses, plain-text passwords, Bitcoin and Paypal payment information, messages to support desks, device specifications, and account info.

“Each of these VPNs claims that their services are ‘no-log’ VPNs, which means that they don’t record any user activity on their respective apps,” Rotem’s team said. “However, we found multiple instances of internet activity logs on their shared server. This was in addition to the personally identifiable information, which included email addresses, clear text passwords, IP addresses, home addresses, phone models, device ID, and other technical details.”

Source: Seven ‘no log’ VPN providers accused of leaking – yup, you guessed it – 1.2TB of user logs onto the internet • The Register

Issue with Cloudflare’s DNS service and crappy router shuts down half the web. Again.

Posted on by

Scores of websites and services went down Friday afternoon due to problems with Cloudflare’s DNS service, sparking rampant speculation about the cause. After all, a global DDOS attack would totally fit the real-life apocalypse movie that 2020 is increasingly turning into.

The outage, which started shortly after 5 p.m. ET, brought down popular sites and services like Discord, Politico, Feedly, and League of Legends for roughly half an hour on Friday. Once connections were restored, Cloudflare issued an incident report stating that the issue “was not as a result of an attack” and that it “has been identified and a fix is being implemented.”

Turns out the real explanation’s nothing so nefarious. Evidently, half the internet briefly went dark because of a crappy router in Atlanta.

“It appears that a router in Atlanta had an error that caused bad routes across our backbone. That resulted in misrouted traffic to PoPs that connect to our backbone,” Cloudflare CEO Matthew Prince tweeted Friday. “We isolated the Atlanta router and shut down our backbone, routing traffic across transit providers instead. There was some congestion that caused slow performance on some links as the logging caught up. Everything is restored now and we’re looking into the root cause.”

According to the incident report, this issue with Cloudflare’s 1.1.1.1 DNS service impacted its data centers internationally, from Frankfurt to Paris and Schiphol, as well as several in major U.S. cities, including Los Angeles, Chicago, Seattle, Atlanta, and San Jose. Reports on Downdetector showed the outages appeared to be concentrated in the U.S. and northern Europe.

Source: Issue with Cloudflare’s DNS service shuts down half the web