The Linkielist

Linking ideas with the world

The Linkielist

Author Archives: Robin Edgar

About Robin Edgar

Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft

Epic accuses Apple of flouting court order by charging for external links on iOS apps

Posted on by

Epic Games has already accused Apple of “malicious compliance” with the EU’s new competition laws, and now it’s making the same allegation stateside. In a new legal filing, it accused Apple of non-compliance with a 2021 ruling that allowed developers to bypass Apple’s 30 percent cut of in-app payments and is asking the court to enforce the original injunction.

Once the Supreme Court declined to hear an appeal of the ruling, Apple released revised guidelines, forcing developers to apply for an “entitlement,” while still offering the option to purchase through Apple’s own billing system. Moreover, Apple still charged a 27 percent commission on any sales made through links to external payment systems (or 12 percent for participants in the iOS Small Business Program).

Epic argued that those fees are “essentially the same” as what it charges using its own in-app payment (IAP) system. ‌To that end, it accused the company of failing to comply with the order, with the fees making the links “commercially unusable.”

It also said that Apple requires a “plain button style” for external links that’s “not a button at all” and violates the injunction forcing Apple to remove restrictions on “steering” users to alternative payment “buttons, external links or other calls to action.” It added that Apple violated the injunction in a third way by prohibiting multi-platform apps like Minecraft from showing external payment links. Epic included statements from other developers including Paddle and Down Dog.

“Apple’s goal is clear: to prevent purchasing alternatives from constraining the supracompetitive fees it collects on purchases of digital goods and services,” the document reads. “Apple’s so-called compliance is a sham. Epic therefore seeks an order (i) finding Apple in civil contempt, (ii) requiring Apple to promptly bring its policies into compliance with the Injunction and (iii) requiring Apple to remove all anti-steering provisions in Guideline 3.1.3.”

[…]

Source: Epic accuses Apple of flouting court order by charging for external links on iOS apps

Evil empire indeed! Those 1984 adverts are becoming reality.

COVID-19 Leaves Its Mark on the Brain. Significant Drops in IQ Scores Are Noted.

Posted on by

From the very early days of the pandemic, brain fog emerged as a significant health condition that many experience after COVID-19.

Brain fog is a colloquial term that describes a state of mental sluggishness or lack of clarity and haziness that makes it difficult to concentrate, remember things and think clearly.

Fast-forward four years and there is now abundant evidence that being infected with SARS-CoV-2 – the virus that causes COVID-19 – can affect brain health in many ways.

In addition to brain fog, COVID-19 can lead to an array of problems, including headaches, seizure disorders, strokes, sleep problems, and tingling and paralysis of the nerves, as well as several mental health disorders.

A large and growing body of evidence amassed throughout the pandemic details the many ways that COVID-19 leaves an indelible mark on the brain. But the specific pathways by which the virus does so are still being elucidated, and curative treatments are nonexistent.

Now, two new studies published in the New England Journal of Medicine shed further light on the profound toll of COVID-19 on cognitive health.

[…]

Most recently, a new study published in the New England Journal of Medicine assessed cognitive abilities such as memory, planning and spatial reasoning in nearly 113,000 people who had previously had COVID-19. The researchers found that those who had been infected had significant deficits in memory and executive task performance.

[…]

In the same study, those who had mild and resolved COVID-19 showed cognitive decline equivalent to a three-point loss of IQ. In comparison, those with unresolved persistent symptoms, such as people with persistent shortness of breath or fatigue, had a six-point loss in IQ. Those who had been admitted to the intensive care unit for COVID-19 had a nine-point loss in IQ. Reinfection with the virus contributed an additional two-point loss in IQ, as compared with no reinfection.

[…]

Another study in the same issue of the New England Journal of Medicine involved more than 100,000 Norwegians between March 2020 and April 2023. It documented worse memory function at several time points up to 36 months following a positive SARS-CoV-2 test.

Taken together, these studies show that COVID-19 poses a serious risk to brain health, even in mild cases, and the effects are now being revealed at the population level.

A recent analysis of the U.S. Current Population Survey showed that after the start of the COVID-19 pandemic, an additional one million working-age Americans reported having “serious difficulty” remembering, concentrating or making decisions than at any time in the preceding 15 years. Most disconcertingly, this was mostly driven by younger adults between the ages of 18 to 44.

Data from the European Union shows a similar trend – in 2022, 15 percent of people in the EU reported memory and concentration issues.

[…]

Source: COVID-19 Leaves Its Mark on the Brain. Significant Drops in IQ Scores Are Noted. | Scientific American

Brave, Mozilla, Vivaldi see browser installs rise on iOS since DMA – forcing competition does indeed give rise to diversity. Now Google.

Posted on by

Since Apple implemented a browser choice screen for iPhones earlier this month to comply with Europe’s Digital Markets Act (DMA), Brave Software, Mozilla, and Vivaldi have seen a surge in the number of people installing their web browsers.

It’s an early sign the Europe Union’s competition rules may actually … get this … enhance competition – an outcome that skeptics deemed unlikely.

The DMA applies to a set of six technology giants that have been designated as “gatekeepers” in order to limit their tendency to boost the usage of their own offerings – such as their own browsers, webmail, and marketplaces – to the detriment of rivals, which are pushed out of the way.

This walloping of competitors, which slashes choice and innovation, is usually achieved through default settings, contractual requirements, and other mechanisms that favor the big players over smaller upstarts. Apple and Google, as two of those gatekeeper firms, must now under Euro law make concessions to competitors to avoid further harm.

As a direct result of Europe’s DMA, Apple announced plans to implement a browser choice screen on iOS devices in January.

For Google, the DMA compliance means a browser choice screen and search choice screen on Android smartphones and tablets during device setup, as well as a search choice screen for its Chrome browser on non-Android platforms.

Choice screens can be an effective way to reduce market dominance. For example: in 2010, when Microsoft was required to provide a browser choice screen in Windows in Europe, Opera reported that its download numbers had doubled.

[…]

Brave’s figures suggest the number of daily browser installs jumped from around 8,000 on March 6, 2024 to around 11,000 a week later. And in a social media post, the developer cited those results as evidence that Apple and Google have made it hard to switch default browsers specifically to block competition.

“Monopoly defenders argue that the monopolies simply offer better products,” Brave declared. “But as you can see, when consumers get a clear choice of iOS browsers, they’re choosing alternatives to Safari. Maybe that’s why Google still hasn’t implemented a browser choice screen on Android.”

[…]

For most of us, Apple requires browsers on iOS to use Cupertino’s WebKit engine – Europe has strong-armed the iGiant into ditching that stipulation in its region.

[…]

The monopolistic practices employed by Big Tech have often hindered Firefox’s ability to innovate and offer users competitive alternatives,” a Moz spokesperson told The Register. “It is no small feat for us to cut through their tricky tactics to keep consumers locked within their own ecosystems.

“Despite less than ideal compliance, the recent implementation of the DMA choice screen is a promising step toward true competition online in the EU, which is why we’re not surprised to have seen a more than 50 percent increase in Firefox user growth in Germany and close to 30 percent increase in France just since its implementation. Still, there is a lot of room for improvement, and we’ll continue to fight for a web that puts people over profits, prioritizes privacy and is open and accessible to all.”

[…]

“We are still reviewing the technical details but are extremely disappointed with Apple’s proposed plan to restrict the newly-announced BrowserEngineKit to EU-specific apps,” Mozilla’s spokesperson lamented. “The effect of this would be to force an independent browser like Firefox to build and maintain two separate browser implementations – a burden Apple itself will not have to bear.

“Apple’s proposals fail to give consumers viable choices by making it as painful as possible for others to provide competitive alternatives to Safari. This is another example of Apple creating barriers to prevent true browser competition on iOS.”

[…]

Von Tetzchner criticized the way the browser choice screen has been implemented, noting that the user has to first click on Safari before being presented with the choice screen that provides non-Safari options. He also observed that if a user has gone ahead and chosen a default browser that’s not listed on Apple’s choice screen, when iOS next presents the choice screen, it won’t include the user’s already designated browser.

He expects Apple will be asked to make further accommodations, based on the fact that it has already had to backtrack several times.

“The point of all of this is to create competition,” noted von Tetzchner. “The point of this is there are certain companies that are gatekeepers that cannot control access to other applications with which they compete. And the point is to create a level playing ground. I think it’s very clear that there isn’t a level playing ground with this.”

Von Tetzchner told us he hasn’t seen Google’s choice screen, because it hasn’t debuted yet.

“I’ve been told by Google that it’s something that they came to an agreement about with the European Commission and the fact that I got that from Google is one of the differences that we see with different organizations here. We actually have a contact at Google. They have a contact with Microsoft and we’ve still not managed to get any contact at Apple, which is rather special.”

According to von Tetzchner, Cupertino has been telling the European Commission that no one will talk to Apple, when it’s the opposite situation.

“We’ve been trying really hard to get hold of anyone at Apple who will talk to us,” he said. “And that’s not happening. And again, I’m hearing the same from the other browser makers.”

[…]

 

Source: Brave, Mozilla, Vivaldi see browser installs rise on iOS • The Register

Breach in French labor history database impacts up to 43 million people for past 20 years showing what a great idea huge centralised databases are

Posted on by

A French government department – responsible for registering and assisting unemployed people – is the latest victim of a mega data breach that compromised the information of up to 43 million citizens.

France Travail announced on Wednesday that it informed the country’s data protection watchdog (CNIL) of an incident that exposed a swathe of personal information about individuals dating back 20 years.

The department’s statement reveals that names, dates of birth, social security numbers, France Travail identifiers, email addresses, postal addresses, and phone numbers were exposed.

[…]

It’s not clear whether the database’s entire contents were stolen by attackers, but the announcement suggests that at least some of the data was extracted.

“The database allegedly extracted illicitly contains the personal identification data of people currently registered, people previously registered over the last 20 years as well as people not registered on the list of job seekers but having a candidate space on francetravail.fr,” the statement reads, which was translated electronically from French.

“It is therefore potentially the personal data of 43 million people which have been exfiltrated.”

The Cybercrime Brigade of the Paris Judicial Police Department is heading up the investigation into the breach, which it says was carried out between February 6 and March 5.

[…]

“It’s not clear how the attack happened apart from reports that the attackers posed as members of Cap Emploi. This could indicate some kind of social engineering over a more technical attack, or likely the two together.”

Cap Emploi, is a similar department that looks after disabled people looking for work.

France Travail will soon undertake the mammoth task of directly informing those affected by email or by other means, and has apologized for the incident.

[…]

This data breach is a real stinker for France Travail, which seems to be unable to catch a break. In August last year, it was caught up in an incident at a service provider that also compromised the data of an estimasted 10 million French citizens.

Wider reporting at the time pinned the blamed for the attacks on Cl0p’s supply chain assault of MOVEit MFT.

It’s been a tough month for France in terms of cybersecurity and data protection too. Just a month ago, the contry was contending with what was called the largest-ever data breach.

Data breaches at Viamedis and Almerys, two third-party payment providers for healthcare and insurance companies, led to more than 33 million people’s data being compromised.

Yann Padova, a data protection lawyer and former secretary general at the CNIL, told Franceinfo at the time that he believed the incident to be the largest of its kind in France.

[…]

Source: Record mega breach in France impacts up to 43 million people • The Register

Under New Management Detects when your extensions have changed owners

Posted on by

Intermittenty checks your installed extensions to see if the developer information listed on the Chrome Web Store or Firefox Addons store has changed. If anything is different, the extension icon will display a red badge, alerting you to the change.

shows the difference when an extension has been changed

Why is this needed?

Extension developers are constantly getting offers to buy their extensions. In nearly every case, the people buying these extensions want to rip off the existing users.

The users of these extensions have no idea an installed extension has changed hands, and may now be compromised.

Under New Management gives users notice of the change of ownership, giving them a chance to make an informed decision about the software they’re using.

Source: Under New Management (Github)

Install for Chrome: https://chromewebstore.google.com/detail/under-new-management/jppepdecgemgbgnjnnfjcmanlleioikj

Install for Firefox: https://addons.mozilla.org/en-US/firefox/addon/under-new-management-v2/

OR

Download a prebuilt release, unpack the .zip file, and load the dist directory into your browser.

Vehicle Cloning — Another Reason Not To Use Automated License Plate Readers

Posted on by

Over the last decade, increasing numbers of automated license plate readers (ALPR) have been installed on roads, bringing with them a variety of privacy problems, as Techdirt has reported. It’s easy to see why ALPR is popular with the authorities: license plate readers seem a simple way to monitor driving behavior and to catch people breaking traffic laws, by speeding, for example.

Since the whole process can be automated, from reading the license plates to sending out fines, it looks like an efficient, low-cost alternative to placing large numbers of police officers around the road network. There’s just one problem: the whole system is based on the assumption that the license plate on the car is genuine, and can be used to identify the person responsible for the vehicle. As an article on “car cloning” in the Guardian reports, drivers in the UK are discovering that this assumption no longer holds.

The problem is that people are making copies of other drivers’ license plates, and using them on similar-looking vehicles — generally the same model and same color — to break the law with impunity. When the ALPR cameras catch the cloners speeding, or failing to pay fees for entering special zones like London’s Ultra Low Emission Zone (ULEZ), the fines are sent to the actual owner of the license plate, not the perpetrator. The result is misery for those unlucky enough to have their license plates cloned, since it is hard to convince the authorities that automated license plate readers have made a mistake when there is apparent photographic evidence they haven’t. The experience of one driver interviewed by the Guardian is typical:

The most recent incident happened in July 2021, when he received two penalty charge notices from different London councils — one for driving in a bus lane and the other for an illegal left turn. Both notices included photos purporting to show his five-door Audi A3 car.

Despite him providing extensive evidence that at the time of one of the offences his vehicle was in a car park, and demonstrating that the one in the photo appeared to be a three-door Audi A1, the council concerned rejected his appeal.

Only when he sent in photos of his vehicle type and the one in the CCTV image where he had “circled all the differences” was the matter dropped.

Even when no fines are involved, vehicle cloning can cause financial problems for innocent drivers, as another case mentioned by the Guardian shows:

Late last year, the Guardian was contacted by another driver who had fallen victim to car cloning. The 88-year-old’s insurance doubled at renewal to £1,259 [about $1600] and she was told this was because her Ford Fiesta had been involved in an accident on the M25 [London’s main ring road] .

Despite her pointing out that she had not driven on the M25 for more than a decade, and that she had been either at church or at home at the time of the accident — and the fact that she had reported that her car had been cloned to Hertfordshire police — her insurer, Zurich, refused to take the claim off her file. Only after the Guardian intervened did the firm restore her no-claims bonus and reduce her premium accordingly.

The more automated license plate readers are installed in order to stop people breaking traffic laws, the greater the incentive for criminals and the unscrupulous to use cloned plates to break those laws without any consequences. What may once have seemed the system’s great strength — the fact that it provides photographic evidence of law breaking — turns out to be a huge weakness that can be turned against it.

Source: Vehicle Cloning — Another Reason Not To Use Automated License Plate Readers | Techdirt

Makers of Switch emulator Yuzu crushed quickly by Nintendo

Posted on by

Tropic Haze, the popular Yuzu Nintendo Switch emulator developer, appears to have agreed to settle Nintendo’s lawsuit against it. Less than a week after Nintendo filed the legal action, accusing the emulator’s creators of “piracy at a colossal scale,” a joint final judgment and permanent injunction filed Tuesday says Tropic Haze has agreed to pay the Mario maker $2.4 million, along with a long list of concessions.

Nintendo’s lawsuit claimed Tropic Haze violated the anti-circumvention and anti-trafficking provisions of the Digital Millennium Copyright Act (DMCA). “Without Yuzu’s decryption of Nintendo’s encryption, unauthorized copies of games could not be played on PCs or Android devices,” the company wrote in its complaint. It described Yuzu as “software primarily designed to circumvent technological measures.”

Yuzu launched in 2018 as free, open-source software for Windows, Linux and Android. It could run countless copyrighted Switch games — including console sellers like The Legend of Zelda: Breath of the Wild and Tears of the Kingdom, Super Mario Odyssey and Super Mario Wonder. Reddit threads comparing Switch emulators praised Yuzu’s performance compared to rivals like Ryujinx. Yuzu introduces various bugs across different titles, but it can typically handle games at higher resolutions than the Switch, often with better frame rates, so long as your hardware is powerful enough.

Screenshot from the Yuzu emulator website showing a still from Zelda: Breath of the Wild with a blueprint-style sketch of the Nintendo Switch framing it. Dark gray background.
A screenshot from Yuzu’s website, showing The Legend of Zelda: Breath of the Wild (Tropic Haze / Nintendo)

As part of an Exhibit A attached to the proposed joint settlement, Tropic Haze agreed to a series of accommodations. In addition to paying Nintendo $2.4 million, it must permanently refrain from “engaging in activities related to offering, marketing, distributing, or trafficking in Yuzu emulator or any similar software that circumvents Nintendo’s technical protection measures.”

Tropic Haze must also delete all circumvention devices, tools and Nintendo cryptographic keys used in the emulator and turn over all circumvention devices and modified Nintendo hardware. It even has to surrender the emulator’s web domain (including any variants or successors) to Nintendo. (The website is still live now, perhaps waiting for the judgment’s final a-okay.) Not abiding by the settlement’s agreements could land Tropic Haze in contempt of court, including punitive, coercive and monetary actions.

Although piracy is the top motive for many emulator users, the software can double as crucial tools for video game preservation — making rapid legal surrenders like Tropic Haze’s potentially problematic. Without emulators, Nintendo and other copyright holders could make games obsolete for future generations as older hardware eventually becomes more difficult to find.

Nintendo’s legal team is, of course, no stranger to aggressively enforcing copyrighted material. In recent years, the company went after Switch piracy websites, sued ROM-sharing website RomUniverse for $2 million and helped send hacker Gary Bowser to prison. Although it was Valve’s doing, Nintendo’s reputation indirectly got the Dolphin Wii and GameCube emulator blocked from Steam. It’s safe to say the Mario maker doesn’t share preservationists’ views on the crucial historical role emulators can play.

Despite the settlement, it appears unlikely the open-source Yuzu will disappear entirely. The emulator is still available on GitHub, where its entire codebase can be found.

Source: Makers of Switch emulator Yuzu quickly settle with Nintendo for $2.4 million

Yup, the big money of Nintendo is excellent at destroying small guys. A really good reason to hate lawyers, but also see how broken the law is. For more, see: Nintendo files lawsuit against creators of Yuzu emulator

Apple stamps feet but now to let EU developers distribute apps from the web

Posted on by

Apple’s compliance measures with the EU’s Digital Markets Act haven’t exactly been universally well received, so the iMaker is making a few tweaks to appease the software-developing masses.

In a post to its developer site today, Apple said it is modifying not only how developers can distribute apps, but also changing the structure of alternative app marketplaces and linking out for purchases that are made away from the official iOS App Store.

Let’s get the quick news out of the way first, starting with changes to alternative app marketplaces. Whereas previously alternative app marketplaces in the EU had to allow apps from other devs, Apple now says that marketplaces “can choose to offer a catalog of apps solely from the developer of the marketplace.”

Think a Meta market that contains just Facebook, Instagram, WhatsApp and the like – but not an Epic Games store, as developers still need to be part of the Apple Developer Program.

European Commission on Apple’s announcement:

“Gatekeepers are required to demonstrate and ensure effective compliance with the relevant obligations. The designated gatekeepers have submitted and published a compliance report explaining their proposals to comply with the relevant obligations.”We will now carefully analyse the compliance reports and assess whether the implemented measures are effective in achieving the objectives of the relevant obligations and DMA in general.”

The Commish added that “if needed,” it would “not hesitate to take formal enforcement action, using the entire toolbox, to fully enforce the DMA. The Commission can open proceedings against such gatekeeper for non-compliance, prescribe specific compliance solutions and impose fines.”

Apple also loosened its link-out rules, and will now allow developers pushing users outside the App Store for purchases to display their offers however they want. Up until now, developers had to use Apple-provided design templates to “optimize for key purchase and promotion use cases,” Cupertino said. Those templates are now optional.

Screw app marketplaces – let’s distribute on the web

The biggest announcement Apple made was the one that didn’t go live today: Allowing developers to distribute apps directly from their websites. Dubbed “Web Distribution,” Apple said the feature will be available following a software update later in the spring.

The new function will provide APIs “that facilitate the distribution of developers’ apps from the web, integrate with system functionality, back up and restore users’ apps, and more,” Apple explained on a new developer support page.

“Using App Store Connect, developers can easily download signed binary assets and host them on their website for distribution,” the company added. Users will have to give the OK for a developer to install apps on their device and this will require users to be presented with an App Store-esque system sheet that includes information about the app submitted to Apple.

Of course, not everyone will qualify for Web Distribution, which is limited to companies enrolled in the Apple Dev Program with a registration location based in an EU nation, and in good standing (that includes Epic again… for now). Developers distributing apps on the web also can’t offer anyone else’s software, have to publish transparent data collection policies, “be responsive to communications from Apple,” and have to handle their own taxes.

And let’s not forget Apple always ensures it gets a slice of the pie. Like Apple’s previously announced DMA provisions, devs distributing apps via the web will still be subject to a Core Technology Fee that will force them to pay €0.50 for each first annual install over one million in the past 12 months. That could add up quickly for big-name devs, though waivers are available for nonprofits, educational institutions and government entities.

Source: Apple to let EU developers distribute apps from the web • The Register

To read more about Apples greed tantrums and screaming like a little baby at the EU, click here

Automakers Are Sharing Consumers’ Driving Behavior With Insurance Companies

Posted on by
car with eye in sky

Kenn Dahl says he has always been a careful driver. The owner of a software company near Seattle, he drives a leased Chevrolet Bolt. He’s never been responsible for an accident. So Mr. Dahl, 65, was surprised in 2022 when the cost of his car insurance jumped by 21 percent. Quotes from other insurance companies were also high. One insurance agent told him his LexisNexis report was a factor. LexisNexis is a New York-based global data broker with a “Risk Solutions” division that caters to the auto insurance industry and has traditionally kept tabs on car accidents and tickets. Upon Mr. Dahl’s request, LexisNexis sent him a 258-page “consumer disclosure report,” which it must provide per the Fair Credit Reporting Act. What it contained stunned him: more than 130 pages detailing each time he or his wife had driven the Bolt over the previous six months. It included the dates of 640 trips, their start and end times, the distance driven and an accounting of any speeding, hard braking or sharp accelerations. The only thing it didn’t have is where they had driven the car. On a Thursday morning in June for example, the car had been driven 7.33 miles in 18 minutes; there had been two rapid accelerations and two incidents of hard braking.

According to the report, the trip details had been provided by General Motors — the manufacturer of the Chevy Bolt. LexisNexis analyzed that driving data to create a risk score “for insurers to use as one factor of many to create more personalized insurance coverage,” according to a LexisNexis spokesman, Dean Carney. Eight insurance companies had requested information about Mr. Dahl from LexisNexis over the previous month. “It felt like a betrayal,” Mr. Dahl said. “They’re taking information that I didn’t realize was going to be shared and screwing with our insurance.” In recent years, insurance companies have offered incentives to people who install dongles in their cars or download smartphone apps that monitor their driving, including how much they drive, how fast they take corners, how hard they hit the brakes and whether they speed. But “drivers are historically reluctant to participate in these programs,” as Ford Motor put it in apatent application (PDF) that describes what is happening instead: Car companies are collecting information directly from internet-connected vehicles for use by the insurance industry.

Sometimes this is happening with a driver’s awareness and consent. Car companies have established relationships with insurance companies, so that if drivers want to sign up for what’s called usage-based insurance — where rates are set based on monitoring of their driving habits — it’s easy to collect that data wirelessly from their cars. But in other instances, something much sneakier has happened. Modern cars are internet-enabled, allowing access to services like navigation, roadside assistance and car apps that drivers can connect to their vehicles to locate them or unlock them remotely. In recent years, automakers, including G.M., Honda, Kia and Hyundai, have started offering optional features in their connected-car apps that rate people’s driving. Some drivers may not realize that, if they turn on these features, the car companies then give information about how they drive to data brokers like LexisNexis. Automakers and data brokers that have partnered to collect detailed driving data from millions of Americans say they have drivers’ permission to do so. But the existence of these partnerships is nearly invisible to drivers, whose consent is obtained in fine print and murky privacy policies that few read. Especially troubling is that some drivers with vehicles made by G.M. say they were tracked even when they did not turn on the feature — called OnStar Smart Driver — and that their insurance rates went up as a result.

Google will charge money for sideloading apps on Android

Posted on by

Developers who want to sideload apps on Android, or offer apps outside the Play Store, will have to pay for this .

It has been possible to have so-called apk files installed on Android smartphones and tablets for some time, but now Google is going to charge money for this. The company does this on the basis of the new European Digital Markets Act (DMA).

Firstly, there is a 10 percent purchase fee for in-app purchases or 5 percent for two-year subscriptions. In addition, there will be an ongoing fee for processing in-app purchases. This amounts to 17 percent (7 percent for subscriptions).

 

Source: Google will charge money for sideloading Android – Emerce

Following Apple’s greedy little footsteps. Don’t be Evil is a long long long time ago.

European Commission broke data protection law with Microsoft Office 365 – duh

Posted on by

The European Commission has been reprimanded for infringing data protection regulations when using Microsoft 365.

The rebuke came from the European Data Protection Supervisor (EDPS) and is the culmination of an investigation that kicked off in May 2021, following the Schrems II judgement.

According to the EDPS, the EC infringed several data protection regulations, including rules around transferring personal data outside the EU / European Economic Area (EEA.)

According to the organization, “In particular, the Commission has failed to provide appropriate safeguards to ensure that personal data transferred outside the EU/EEA are afforded an essentially equivalent level of protection as guaranteed in the EU/EEA.

“Furthermore, in its contract with Microsoft, the Commission did not sufficiently specify what types of personal data are to be collected and for which explicit and specified purposes when using Microsoft 365.”

While the concerns are more about EU institutions and transparency, they should also serve as notice to any company doing business in the EU / EEA to take a very close look at how it has configured Microsoft 365 regarding the EU Data Protection Regulations.

[…]

Source: European Commission broke data protection law with Microsoft • The Register

Who knew? An American Company running an American cloud product on American Servers and the EU was putting it’s data on it. Who would have thought that might end up in America?!

India reverses AI stance, follows EU and starts regulating significant AI models

Posted on by

India has waded into global AI debate by issuing an advisory that requires “significant” tech firms to get government permission before launching new models.

India’s Ministry of Electronics and IT issued the advisory to firms on Friday. The advisory — not published on public domain but a copy of which TechCrunch has reviewed — also asks tech firms to ensure that their services or products “do not permit any bias or discrimination or threaten the integrity of the electoral process.”

Though the ministry admits the advisory is not legally binding, India’s IT Deputy Minister Rajeev Chandrasekhar says the notice is “signalling that this is the future of regulation.” He adds: “We are doing it as an advisory today asking you to comply with it.”

In a tweet Monday, Chandrasekhar said the advisory is aimed at “untested AI platforms deploying on the India internet” and doesn’t apply to startups.

The ministry cites power granted to it through the IT Act, 2000 and IT Rules, 2021 in its advisory. It seeks compliance with “immediate effect” and asks tech firms to submit “Action Taken-cum-Status Report” to the ministry within 15 days.

The new advisory, which also asks tech firms to “appropriately” label the “possible and inherent fallibility or unreliability” of the output their AI models generate, marks a reversal from India’s previous hands-off approach to AI regulation. Less than a year ago, the ministry had declined to regulate AI growth, instead identifying the sector as vital to India’s strategic interests.

[…]

Source: India reverses AI stance, requires government approval for model launches | TechCrunch

Black Trump Supporters Are Being AI-Generated – Trumpistas fall for them though

Posted on by

Donald Trump supporters are creating and sharing AI-generated images of the former president with Black voters. The photos appear to be an attempt to inflate Trump’s popularity with the Black community, which may be irreparably harmed by his ties to white supremacist groups, but the photos are nothing but fakes.

In the leadup to the 2024 Presidential Election, several of these AI-generated dupes of Black Trump supporters have popped up on social media. One image is a holiday photo depicting Trump embracing several Black people. However, it’s an AI dupe created by The Mark Kaye Show, a conservative talk show, and distributed on Facebook to over one million of Kaye’s Facebook followers. The post from November, first reported by the BBC, was not labeled as being AI-generated in any way.

“I never thought I would read the words ‘BLM Leader endorses Donald Trump,’ but then again, Christmas is the time for miracles,” said Kaye in a Facebook post.

The image is obviously an AI fake. Trump’s hands look deformed, and the person on the far left is missing a ring finger.

[….]

Source: Black Trump Supporters Are Being AI-Generated

You don’t own what you bought: Roku Issues a Mandatory Terms of Service Update That You Must Agree To or You Can’t Use Your Roku

Posted on by

roku remote with dollar bills around it

Over the last 48 hours, Roku has slowly been rolling out a mandatory update to its terms of service. In this terms it changes the dispute resolution terms but it is not clear exactly why. When the new terms and conditions message shows up on a Roku Player or TV, your only option is to accept them or turn off your Roku and stop using it.

[…]

Roku does offer a way to opt out of these new arbitration rules if you write them a letter to an address listed in the terms of service. You do need to hurry though as you only get 30 days to write a letter to Roku to opt out. Though it is unclear if that is from when you buy your Roku or agree to these new terms.

Customers are understandably confused by these new terms of service that have appeared in recent days. Raising questions about why now and why such an aggressive messaging about them that forces you to manually accept them or stop using your device.

[…]

Source: Roku Issues a Mandatory Terms of Service Update That You Must Agree To or You Can’t Use Your Roku | Cord Cutters News

How to Prevent X’s Audio and Video Calls Feature From Revealing Your IP Address – wait it reveals your IP address :O – wait… of course, it’s a Musk thing

Posted on by

[…] X began rolling out the audio and video calling feature, which was previously restricted to paid users, to everyone last week. However, hawk-eyed sleuths quickly noticed that the feature was automatically turned on, meaning that users had to manually go to their settings to turn it off. Only your mutuals or someone you’ve exchanged DMs with can call you by default, but that’s still potentially a lot of people.

Privacy researchers also sounded the alarm on the feature after learning that it revealed users’ IP address during calls. Notably, the option to protect users’ IP addresses is toggled off, which frankly makes no sense.

Zach Edwards, an independent privacy researcher, told Gizmodo that an IP address can allow third parties to track down your location and get their hands on other details of your online life.

“In major cities, an IP address can sometimes identify someone’s exact location, but usually it’s just close enough to be creepy. Like a 1 block radius around your house,” Edwards said via X direct messages. However, “sometimes if in a remote/rural location, the IP address 1000% identifies you.”

Law enforcement can use IP addresses to track down illegal behavior, such as child sexual abuse material or pirating online content. Meanwhile, hackers can launch DDoS attacks to take down your internet connection or even steal your data.

How to turn off audio and video calls on X

Luckily, you can avoid potential IP security nightmares by turning off audio and video calls on X. As you’ll see in the screenshots below, it’s pretty straightforward:

– First, go to Settings and Support. Then click on Settings and Privacy. (If you’re on desktop, click on the More button and then go to Settings and Privacy).

– Next, click on Privacy and Safety. Select Direct Messages from the menu that pops up.

– Toggle off the option that says Enable audio and video calling.

A screenshot that shows how to disable audio and video calling on X.
Screenshot: Oscar Gonzalez

And that’s it. Some may not see the Enable audio and video calling option in their settings yet, which means the feature hasn’t been rolled out to them. That doesn’t mean they won’t eventually get it in a future update.

Source: How to Prevent X’s Audio and Video Calls Feature From Revealing Your IP Address

Carmakers Must Bring Back Buttons for safety, Says Europe

Posted on by

Key dashboard touchscreen functions will soon be kicked into touch and physical switches will be required instead for car manufacturers to be granted the highest safety ratings.

Euro NCAP, the automotive safety industry body for Europe, is introducing new guidance for 2026 which means that five important tasks in every car will have to be performed by actual buttons instead of by accessing a screen.

Indicators, hazard warning lights, windscreen wipers, horn, and SOS features will have to be controlled by proper switches in order for cars to be granted Euro NCAP’s coveted five star safety rating.

“The overuse of touchscreens is an industry-wide problem, with almost every vehicle-maker moving key controls onto central touchscreens, obliging drivers to take their eyes off the road and raising the risk of distraction crashes,” explained Matthew Avery, director of strategic development at Euro NCAP.

“New Euro NCAP tests due in 2026 will encourage manufacturers to use separate, physical controls for basic functions in an intuitive manner, limiting eyes-off-road time and therefore promoting safer driving.

Several manufacturers have already come under fire for excessively complex touch screen controls forcing drivers to access menu after menu to adjust seats, mirrors and ventilation—we’re especially looking at you Tesla and VW.

Although it won’t be mandatory to comply with Euro NCAP’s new rules car makers that don’t will lose valuable points in their safety ratings. It sounds like a sensible idea—a positive move in the battle against distracted driving—and one, that, hopefully, the NHTSA will follow.

Source: Carmakers Must Bring Back Buttons, Says Europe – Hagerty Media

It’s a shame they are not also including Radio station buttons, which BMW has removed in it’s latest iteration.

Microsoft calls NYT copyright claims ‘doomsday futurology’ – also, VCRs are legal too

Posted on by

Microsoft is coming out swinging over claims by the New York Times that the Windows giant and OpenAI infringed copyright by using its articles to build ChatGPT and other models.

In yesterday’s filing [PDF], Microsoft’s lawyers recall the early 1980s efforts of the Motion Picture Association to stifle the growth of VCR technology, likening it to the legal efforts of the New York Times (NYT) to stop OpenAI in their work on the “latest profound technological advance.”

The motion describes the NYT’s allegations that the use of GPT-based products “harms The Times,” and “poses a mortal threat to independent journalism” as “doomsday futurology.”

[…]

Microsoft’s response doesn’t appear to suggest that content has not been lifted. Instead, it says: “Despite The Times’s contentions, copyright law is no more an obstacle to the LLM than it was to the VCR (or the player piano, copy machine, personal computer, internet, or search engine.)”

[…]

In its demands for the dismissal of the three claims in particular, the motion points out that Microsoft shouldn’t be held liable for end-user copyright infringement through GPT-based tools. It also says that to get the NYT content regurgitated, a user would need to know the “genesis of that content.”

“And in any event, the outputs the Complaint cites are not copies of works at all, but mere snippets.”

Finally, the filing delves into the murky world of “fair use,” the American copyright law, which is relatively permissive in the US compared to other legal jurisdictions.

OpenAI hit back at the NYT last month and accused the company of paying someone to “hack” ChatGPT in order to persuade it to spit out those irritatingly verbatim copies of NYT content.

[…]

Source: Microsoft calls NYT copyright claims ‘doomsday futurology’ • The Register

For more illustrations about how much nonsense the New York Times suit is, have a look here

Rooster Teeth (Red vs Blue) Shut Down By WB Discovery After Two Decades

Posted on by
a space helmet half red and half blue

Rooster Teeth, a Warner Bros. Discovery Global Streaming & Interactive Entertainment subsidiary, is ending operations after 20+ years. The news was announced on March 6 in a company memo and blog post on the digital content creator’s site.

Earlier today, the news of Rooster Teeth shutting down was first shared at an all-hands company meeting followed by an internal memo from RT’s general manager, Jordan Levin. This memo was then posted alongside a message from community director Chelsea Atkinson confirming that the site was winding down, and adding that a livestream about the shutdown was planned for tomorrow, March 7.

“Since inheriting ownership and control of Rooster Teeth from AT&T following its acquisition of TimeWarner, Warner Bros. Discovery continued its investment in our company, content, and community,” said Levin in the memo.

“Now however, it’s with a heavy heart I announce that Rooster Teeth is shutting down due to challenges facing digital media resulting from fundamental shifts in consumer behavior and monetization across platforms, advertising, and patronage.”

[…]

Rooster Teeth started back in 2003 in Texas. It was founded by Burnie Burns, Matt Hullum, Geoff Ramsey, Jason Saldaña, Gus Sorola, and Joel Heyman. The company’s first big hit was the Halo machinima series, Red Vs. Blue. That show would become incredibly popular, leading to millions of views, DVDs, spin-offs, and loads of merchandise. Elijah Wood even had a role in one season. The show’s 19th and final season is still set to arrive later this year.

[…]

Source: Rooster Teeth Shut Down By WB Discovery After Two Decades

Posted in Art

Alternatieve iPhone app stores stop working when you travel outside of the EU

Posted on by

iOS 17.4 is the first version of Apple’s operating system to comply with the regulatory framework of the European Digital Markets Act. Apple must also support alternative app stores, where apps can be installed around the App Store.

The availability of this functionality is only geographically limited to the EU, and Apple has revealed for the first time that alternative app stores will stop working if you leave the EU for too long.

Furthermore, your Apple ID must be set to one of the following countries: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain and Sweden.

The exact period during which you can travel outside the EU is not specified.

Source: Alternatieve iPhone appwinkels werken niet meer als je buiten de EU reist – Emerce

Hackers exploited Windows 0-day for 6 months after Microsoft knew of it

Posted on by

[…]

Even after Microsoft patched the vulnerability last month, the company made no mention that the North Korean threat group Lazarus had been using the vulnerability since at least August to install a stealthy rootkit on vulnerable computers. The vulnerability provided an easy and stealthy means for malware that had already gained administrative system rights to interact with the Windows kernel. Lazarus used the vulnerability for just that. Even so, Microsoft has long said that such admin-to-kernel elevations don’t represent the crossing of a security boundary, a possible explanation for the time Microsoft took to fix the vulnerability.

A rootkit “holy grail”

“When it comes to Windows security, there is a thin line between admin and kernel,” Jan Vojtěšek, a researcher with security firm Avast, explained last week. “Microsoft’s security servicing criteria have long asserted that ‘[a]dministrator-to-kernel is not a security boundary,’ meaning that Microsoft reserves the right to patch admin-to-kernel vulnerabilities at its own discretion. As a result, the Windows security model does not guarantee that it will prevent an admin-level attacker from directly accessing the kernel.”

The Microsoft policy proved to be a boon to Lazarus in installing “FudModule,” a custom rootkit that Avast said was exceptionally stealthy and advanced.

[…]

In years past, Lazarus and other threat groups have reached this last threshold mainly by exploiting third-party system drivers, which by definition already have kernel access. To work with supported versions of Windows, third-party drivers must first be digitally signed by Microsoft to certify that they are trustworthy and meet security requirements. In the event Lazarus or another threat actor has already cleared the admin hurdle and has identified a vulnerability in an approved driver, they can install it and exploit the vulnerability to gain access to the Windows kernel. This technique—known as BYOVD (bring your own vulnerable driver)—comes at a cost, however, because it provides ample opportunity for defenders to detect an attack in progress.

The vulnerability Lazarus exploited, tracked as CVE-2024-21338, offered considerably more stealth than BYOVD because it exploited appid.sys, a driver enabling the Windows AppLocker service, which comes preinstalled in the Microsoft OS. Avast said such vulnerabilities represent the “holy grail,” as compared to BYOVD.

In August, Avast researchers sent Microsoft a description of the zero-day, along with proof-of-concept code that demonstrated what it did when exploited. Microsoft didn’t patch the vulnerability until last month. Even then, the disclosure of the active exploitation of CVE-2024-21338 and details of the Lazarus rootkit came not from Microsoft in February but from Avast 15 days later. A day later, Microsoft updated its patch bulletin to note the exploitation.

[…]

Source: Hackers exploited Windows 0-day for 6 months after Microsoft knew of it | Ars Technica

Millions of research papers at risk of disappearing from the Internet

Posted on by

More than one-quarter of scholarly articles are not being properly archived and preserved, a study of more than seven million digital publications suggests. The findings, published in the Journal of Librarianship and Scholarly Communication on 24 January1, indicate that systems to preserve papers online have failed to keep pace with the growth of research output.

“Our entire epistemology of science and research relies on the chain of footnotes,” explains author Martin Eve, a researcher in literature, technology and publishing at Birkbeck, University of London. “If you can’t verify what someone else has said at some other point, you’re just trusting to blind faith for artefacts that you can no longer read yourself.”

[…]

The sample of DOIs included in the study was made up of a random selection of up to 1,000 registered to each member organization. Twenty-eight per cent of these works — more than two million articles — did not appear in a major digital archive, despite having an active DOI. Only 58% of the DOIs referenced works that had been stored in at least one archive. The other 14% were excluded from the study because they were published too recently, were not journal articles or did not have an identifiable source.

Preservation challenge

Eve notes that the study has limitations: namely that it tracked only articles with DOIs, and that it did not search every digital repository for articles (he did not check whether items with a DOI were stored in institutional repositories, for example).

[…]

“Everybody thinks of the immediate gains they might get from having a paper out somewhere, but we really should be thinking about the long-term sustainability of the research ecosystem,” Eve says. “After you’ve been dead for 100 years, are people going to be able to get access to the things you’ve worked on?”

doi: https://doi.org/10.1038/d41586-024-00616-5

Source: Millions of research papers at risk of disappearing from the Internet

Want to Steal a Tesla? set up a guest wifi with a fake site, steal the password and make your own key

Posted on by

Security researchers report they uncovered a design flaw that let them hijack a Tesla using a Flipper Zero, a controversial $169 hacking tool. Partners Tommy Mysk and Talal Haj Bakry of Mysk Inc. said the attack is as simple as swiping a Tesla owner’s login information, opening the Tesla app, and driving away. The victim would have no idea they lost their $40,000 vehicle. Mysk said the exploit takes minutes, and to prove it all works, he stole his own car.

The issue isn’t “hacking” in the sense of breaking into software, it’s a social engineering attack that fools a user into handing over their information. Using a Flipper, the researchers set up a WiFi network called “Tesla Guest,” the name Tesla uses for its guest networks at service centers. Mysk then created a website that looks like Tesla’s login page.

The process is simple. In this scenario, hackers could broadcast the network near a charging station, where a bored driver might be looking for entertainment. The victim connects to the WiFi network and enters their username and password on the fake Tesla website. The hacker then uses the credentials to log in to the real Tesla app, which triggers a two-factor authentication code. The victim enters that code into the fake website, and the thief gains access to their account. Once you’re logged into the Tesla app, you can set up a “phone key” which lets you unlock and control the car over Bluetooth with a smartphone. From there, the car is yours.

You can see Mysk’s demonstration of the attack in the video below.

Cybersecurity: Can a Tesla stop phishing and social engineering attacks?

According to Mysk, Tesla doesn’t notify users when new keys are created, so the victim wouldn’t know they’ve been compromised. Mysk said the bad guys wouldn’t need to steal the car right away, either, because the app shows you the physical location of the vehicle. The Tesla owner could finish charging the car and drive off to go shopping or park outside their house. The thief would just watch the car’s location using the app, and then waltz up at an opportune moment and drive away.

“This means with a leaked email and password, an owner could lose their Tesla vehicle.

[…]

Source: Want to Steal a Tesla? Try Using a Flipper Zero

EU fines Apple nearly $2B over in-app music purchases

Posted on by

Apple’s anti-steering provisions that prevent music streaming apps from directing users outside the App Store for paid services were smacked down in the European Union today and earned the iGiant a fine of more than €1.8 billion ($1.95 billion).

The European Commission said Apple’s policies “amount to unfair trading conditions” and “are neither necessary nor proportionate for the protection of Apple’s commercial interests.”

“Apple will have to open the gates to its ecosystem, to allow end users to easily find the apps they want, pay for them in any way they want, and use them on any device they want,” EU antitrust chief Margrethe Vestager said of the decision.

Apple’s anti-steering rules have prevented developers from directing users outside the App Store – thereby circumventing Apple’s 30 percent commission – for in-app purchases and subscriptions. As part of the EC decision, Apple is being forced to end the use of anti-steering provisions in the bloc, but this restriction applies only to music streaming apps, an EC spokesperson told The Register.

Vestager described Apple’s anti-competitive conduct as having gone on for nearly a decade, resulting in iOS users paying “significantly higher prices for music streaming subscriptions.” The anti-steering provisions also led to a “degraded user experience,” Vestager said, as users were forced to “engage in a cumbersome search” to find cheaper prices outside the App Store because the anti-steering rule also prevented developers from telling users about cheaper prices available elsewhere.

[…]

Source: EU fines Apple nearly $2B over in-app purchases • The Register

Satellites Step Up After Red Sea Internet Cables Get Severed

Posted on by

[…] Earlier this week, four out of 15 communication cables were cut, disrupting network traffic that flows through the Red Sea. The damaged cables affected 25% of traffic between Asia, Europe, and the Middle East, according to Hong Kong telecoms company HGC Global Communications. The cause of the damage is still unknown, and the company is working on a fix, which it referred to as an “exceptionally rare occurrence.” Although HGC did not reveal the cause behind the damaged cables, a U.S. National Security Council spokesperson blamed it on the anchor of a cargo ship that was sunk by the Houthi group in Yemen. The Houthis, however, issued a statement denying its involvement.

Regardless of the cause, satellite companies have stepped up by beaming connectivity from space to reroute some of that impacted traffic. Satellite operators such as Intelsat are providing back up connectivity to fill in the gaps for the severed cables, SpaceNews reported.

Intelsat has a fleet of 52 communication satellites in orbit, providing broadband internet and offering airline passengers inflight connectivity. Other companies, like Eutelsat OneWeb, SES, and, more famously, SpaceX are also in the business of beaming connectivity from Earth orbit.

The recent incident, although rare, does offer a glimpse into what a hybrid connectivity solution would look like, providing internet from both underwater cables, as well as orbital satellites. Subsea customers, or those getting internet from both ends, can restore their connectivity within 15 minutes should there be an issue with a terrestrial provider, Rhys Morgan, regional vice president for Intelsat, told SpaceNews.

[…]

Source: Satellites Step Up After Red Sea Internet Cables Get Severed

VMware sandbox escape bugs are so critical, patches are released for end-of-life products – also, remove all your USB products now

Posted on by

VMware is urging customers to patch critical vulnerabilities that make it possible for hackers to break out of sandbox and hypervisor protections in all versions, including out-of-support ones, of VMware ESXi, Workstation, Fusion, and Cloud Foundation products.

A constellation of four vulnerabilities—two carrying severity ratings of 9.3 out of a possible 10—are serious because they undermine the fundamental purpose of the VMware products, which is to run sensitive operations inside a virtual machine that’s segmented from the host machine. VMware officials said that the prospect of a hypervisor escape warranted an immediate response

[…]

A VMware advisory included the following matrix showing how the vulnerabilities—tracked as CVE-2024-22252, CVE-2024-22253, CVE-2024-22254, CVE-2024-22255—affect each of the vulnerable products:

Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version [1] Workarounds Additional Documentation
ESXi 8.0 Any CVE-2024-22252, CVE-2024-22253, CVE-2024-22254, CVE-2024-22255 8.4, 8.4, 7.9, 7.1 critical ESXi80U2sb-23305545 KB96682 FAQ
ESXi 8.0 [2] Any CVE-2024-22252, CVE-2024-22253, CVE-2024-22254, CVE-2024-22255 8.4, 8.4, 7.9, 7.1 critical ESXi80U1d-23299997 KB96682 FAQ
ESXi 7.0 Any CVE-2024-22252, CVE-2024-22253, CVE-2024-22254, CVE-2024-22255 8.4, 8.4, 7.9, 7.1 critical ESXi70U3p-23307199 KB96682 FAQ
Workstation 17.x Any CVE-2024-22252, CVE-2024-22253, CVE-2024-22255 9.3, 9.3, 7.1 critical 17.5.1 KB96682 None.
Fusion 13.x MacOS CVE-2024-22252, CVE-2024-22253, CVE-2024-22255 9.3, 9.3, 7.1 critical 13.5.1 KB96682 None

Three of the vulnerabilities affect the USB controller the products use to support peripheral devices such as keyboards and mice. The advisory describes the vulnerabilities as:

CVE-2024-22252: a use-after-free vulnerability in XHCI USB controller with a maximum severity range of 9.3 for Workstation/Fusion and a base score of 8.4 for ESXi. Someone with local administrative privileges on a virtual machine can execute code as the virtual machine’s VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox, whereas, on Workstation and Fusion, this could lead to code execution on the machine where Workstation or Fusion is installed.

CVE-2024-22253: a use-after-free vulnerability in UHCI USB controller with a maximum severity rating of 9.3 for Workstation/Fusion and a base score of 8.4 for ESXi. Exploitation requirements and outcomes are the same as for CVE-2024-22252.

CVE-2024-22254: an out-of-bounds write vulnerability with a maximum severity base score of 7.9. This vulnerability makes it possible for someone with privileges within the VMX process to trigger an out-of-bounds write, leading to a sandbox escape.

CVE-2024-22255: an information disclosure vulnerability in the UHCI USB controller with a maximum CVSSv3 base score of 7.1. Someone with administrative access to a virtual machine can exploit it to leak memory from the vmx process.

Broadcom, the VMware parent company, is urging customers to patch vulnerable products. As a workaround, users can remove USB controllers from vulnerable virtual machines, but Broadcom stressed that this measure could degrade virtual console functionality and should be viewed as only a temporary solution.

[…]

Source: VMware sandbox escape bugs are so critical, patches are released for end-of-life products | Ars Technica