The Linkielist

Linking ideas with the world

The Linkielist

More Than 80% of NFTs Created for Free on OpenSea Are Fraud or Spam, Company Says

[…]

OpenSea has revealed just how much of the NFT activity on its platform is defined by fakery and theft, and it’s a lot. In fact, according to the company, nearly all of the NFTs created for free on its platform are either spam or plagiarized.

The revelation began with some drama. On Thursday, popular NFT marketplace OpenSea announced that it would limit how many times a user could create (or “mint”) an NFT for free on the platform using its tools to 50. So-called “lazy minting” on the site lets users skip paying a blockchain gas fee when they create an NFT on OpenSea (with the buyer eventually paying the fee at the time of sale), so it’s a popular option especially for people who don’t have deep pockets to jumpstart their digital art empire.

This decision set off a firestorm, with some projects complaining that this was an out-of-the-blue roadblock for them as they still needed to mint NFTs but suddenly couldn’t. Shortly after, OpenSea reversed course and announced that it would remove the limit, as well as provided some reasoning for the limit in the first place: The free minting tool is being used almost exclusively for the purposes of fraud or spam.

[…]

Source: More Than 80% of NFTs Created for Free on OpenSea Are Fraud or Spam, Company Says

Australia: Facebook Users Liable for Comments Under Their Posts

The High Court’s ruling on Wednesday is just a small part of a larger case brought against Australian news outlets, including the Sydney Morning Herald, The Age, and The Australian, among others, by a man who said he was defamed in the Facebook comments of the newspapers’ stories in 2016.

The question before the High Court was the definition of “publisher,” something that isn’t easily defined in Australian law.

From Australia’s ABC News:

The court found that, by creating a public Facebook page and posting content, the outlets had facilitated, encouraged and thereby assisted the publication of comments from third-party Facebook users, and they were, therefore, publishers of those comments.

The Aboriginal-Australian man who brought the lawsuit, Dylan Voller, was a detainee at a children’s detention facility in the Northern Territory in 2015 when undercover video of kids being physically abused was captured and broadcast in 2016. Voller was shown shirtless with a hood over his head and restraints around his arms. His neck was even tied to the back of the chair.

Facebook commenters at the time made false allegations that Voller had attacked a Salvation Army officer, leaving the man blind in one eye.

[…]

Voller never asked for the Facebook comments to be taken down, according to the media companies, something that was previously required for the news outlets to be held criminally liable for another user’s content in Australia. Facebook comments couldn’t be turned off completely in 2016, a feature that was added just this year.

Wednesday’s ruling did not determine whether the Facebook comments were defamatory and Voller’s full case against the media companies can now go forward to the High Court. Nine News, one of the companies being sued, released a statement to ABC News saying they were “obviously disappointed” in today’s ruling.

[…]

Source: Australia: Facebook Users Liable for Comments Under Their Posts

So if Facebook is responsible for stuff published on their platform then shouldn’t they be resposible for the comments too?

OK, so you stole $600m-plus from us, how about you be our Chief Security Advisor, Poly Network asks thief

The mysterious thief who stole $600m-plus in cryptocurrencies from Poly Network has been offered the role of Chief Security Advisor at the Chinese blockchain biz.

It’s been a rollercoaster ride lately for Poly Network. The outfit builds software that handles the exchange of crypto-currencies and other assests between various blockchains. Last week, it confirmed a miscreant had drained hundreds of millions of dollars in digital tokens from its platform by exploiting a security weakness in its design.

After Poly Network urged netizens, cryptoexchanges, and miners to reject transactions involving the thief’s wallet addresses, the crook started giving the digital money back – and at least $260m of tokens have been returned. The company said it has maintained communication with the miscreant, who is referred to as Mr White Hat.

“It is important to reiterate that Poly Network has no intention of holding Mr White Hat legally responsible, as we are confident that Mr White Hat will promptly return full control of the assets to Poly Network and its users,” the organization said.

“While there were certain misunderstandings in the beginning due to poor communication channels, we now understand Mr White Hat’s vision for Defi and the crypto world, which is in line with Poly Network’s ambitions from the very beginning — to provide interoperability for ledgers in Web 3.0.”

First, Poly Network offered him $500,000 in Ethereum as a bug bounty award. He said he wasn’t going to accept the money, though the reward was transferred to his wallet anyway. Now, the company has gone one step further and has offered him the position of Chief Security Advisor.

“We are counting on more experts like Mr White Hat to be involved in the future development of Poly Network since we believe that we share the vision to build a secure and robust distributed system,” it said in a statement. “Also, to extend our thanks and encourage Mr White Hat to continue contributing to security advancement in the blockchain world together with Poly Network, we cordially invite Mr White Hat to be the Chief Security Advisor of Poly Network.”

It’s unclear whether so-called Mr White Hat will accept the job offer or not. Judging by the messages embedded in Ethereum transactions exchanged between both parties, it doesn’t look likely at the moment. He still hasn’t returned $238m, to the best of our knowledge, and said he isn’t ready to hand over the keys to the wallet where the funds are stored. He previously claimed he had attacked Poly Network for fun and to highlight the vulnerability in its programming.

“Dear Poly, glad to see that you are moving things to the right direction! Your essays are very convincing while your actions are showing your distrust, what a funny game…I am not ready to publish the key in this week…,” according to one message he sent.

Source: OK, so you stole $600m-plus from us, how about you be our Chief Security Advisor, Poly Network asks thief • The Register

Poly Network Offers $500k Reward to Hacker Who Stole $611 Million and then returned it

A cryptocurrency platform that was hacked and had hundreds of millions of dollars stolen from it has now offered the thief a “reward” of $500,000 after the criminal returned almost all of the money.

A few days ago a hacker exploited a vulnerability in the blockchain technology of decentralized finance (DeFi) platform Poly Network, pilfering a whopping $611 million in various tokens—the crypto equivalent of a gargantuan bank robbery. It is thought to be the largest robbery of its kind in DeFi history.

The company subsequently posted an absurd open letter to the thief that began “Dear Hacker” and proceeded to beg for its money back while also insinuating that the criminal would ultimately be caught by police.

Amazingly, this tactic seemed to work—and the hacker (or hackers) began returning the crypto. As of Friday, almost the entirety of the massive haul had been returned to blockchain accounts controlled by the company, though a sizable $33 million in Tether coin still remains frozen in an account solely controlled by the thief.

After this, Poly weirdly started calling the hacker “Mr. White Hat”—essentially dubbing them a virtuous penetration tester rather than a disruptive criminal. Even more strange, on Friday Poly Network confirmed to Reuters that it had offered $500,000 to the cybercriminal, dubbing it a “bug bounty.”

Bug bounties are programs wherein a company will pay cyber-pros to find holes in its IT defenses. However, such programs are typically commissioned by companies and addressed by well-known infosec professionals, not conducted unprompted and ad-hoc by rogue, anonymous hackers. Similarly, I’ve never heard of a penetration tester stealing hundreds of millions of dollars from a company as part of their test.

Nonetheless, Poly Network apparently told the hacker: “Since, we (Poly Network) believe your action is white hat behavior, we plan to offer you a $500,000 bug bounty after you complete the refund fully. Also we assure you that you will not be accountable for this incident.” We reached out to the company to try to independently confirm these reports.

The hacker reportedly refused to take the crypto platform up on its offer, opting instead to post a series of public messages in one of the crypto wallets that was used to return funds. Dubbed “Q & A sessions,” the posts purport to explain why the heist took place. The self-interviews were shared over social media by Tom Robinson, co-founder of crypto-tracking firm Elliptic. In one of them, the hacker explains:

Q: WHY HACKING?
A: FOR FUN 🙂

Q: WHY POLY NETWORK?
A: CROSS CHAIN HACKING IS HOT

Q: WHY TRANSFERRING TOKENS
A: TO KEEP IT SAFE.

In another post, the hacker purportedly proclaimed, “I’m not interested in money!” and said, “I would like to give them tips on how to secure their networks,” apparently referencing the blockchain provider.

So, yeah, what do we think here, folks? Is the hacker:

  • A) a good samaritan who stole the better part of a billion dollars to teach a crypto company a lesson?
  • B) a spineless weasel who realized they were in tremendous levels of shit and decided to engineer a way out of their criminal deed?

The answer is unclear at the moment, but gee, does it make for quality entertainment. Tune in next week for a new episode of Misadventures in De-Fi Cybersecurity. Thrilling stuff, no?

Source: Poly Network Offers Reward to Hacker Who Stole $611 Million

Gmail to show your company logo in inbox if DMARC and BIMI authenticated

After first announcing Gmail’s Brand Indicators for Message Identification (BIMI) pilot last year, today we’re announcing that over the coming weeks we’re rolling out Gmail’s general support of BIMI, an industry standard that aims to drive adoption of strong sender authentication for the entire email ecosystem

[…]

BIMI enables organizations that authenticate their emails using Domain-based Message Authentication, Reporting, and Conformance (DMARC)—a standard for providing strong sender authentication that allows security systems to perform better filtering, separating legitimate messages from potentially spoofed ones—to validate ownership of their logos and securely transmit them to Google. BIMI is designed to be easy: for organizations with DMARC in place, validated logos display on authenticated emails from their domains and subdomains.

Here’s how it works: Organizations who authenticate their emails using Sender Policy Framework (SPF) or Domain Keys Identified Mail (DKIM) and deploy DMARC can provide their validated trademarked logos to Google via a Verified Mark Certificate (VMC). BIMI leverages Mark Verifying Authorities, like Certification Authorities, to verify logo ownership and provide proof of verification in a VMC. Once these authenticated emails pass our other anti-abuse checks, Gmail will start displaying the logo in the existing avatar slot.

[…]

For logo validation, BIMI is starting by supporting the validation of trademarked logos, since they are a common target of impersonation. Today, Entrust and DigiCert support BIMI as Certification Authorities, and in the future the BIMI working group expects this list of supporting validation authorities to expand further. To learn more about BIMI and see the latest news, visit the working group’s website.

To take advantage of BIMI, ensure that your organization has adopted DMARC, and that you have validated your logo with a VMC

[…]

Source: Bringing BIMI to Gmail in Google Workspace | Google Cloud Blog

Using satellites to track tiny plastic particles and their concentration in the ocean

Most data on microplastic concentrations comes from commercial and research ships that tow plankton nets—long, cone-shaped nets with very fine mesh designed for collecting marine microorganisms.

But net trawling can sample only small areas and may be underestimating true plastic concentrations. Except in the North Atlantic and North Pacific gyres—large zones where rotate, collecting floating debris—scientists have done very little sampling for microplastics. And there is scant information about how these particles’ concentrations vary over time.

To address these questions, University of Michigan research assistant Madeline Evans and I developed a new way to detect microplastic concentrations from space using NASA’s Cyclone Global Navigation Satellite System. CYGNSS is a network of eight microsatellites that was launched in 2016 to help scientists predict hurricanes by analyzing tropical wind speeds. They measure how wind roughens the ocean’s surface—an indicator that we realized could also be used to detect and track large quantities of microplastics.

This animation shows how satellite data can be used to track where microplastics enter the water, how they move and where they tend to collect.

Looking for smooth zones

[…]

The radars on CYGNSS satellites are designed to measure winds over the ocean indirectly by measuring how they roughen the water’s surface. We knew that when there is a lot of material floating in the water, winds don’t roughen it as much. So we tried computing how much smoother measurements indicated the surface was than it should have been if winds of the same speed were blowing across clear water.

This anomaly—the “missing roughness”—turns out to be highly correlated with the concentration of microplastics near the ocean surface. Put another way, areas where surface waters appear to be unusually smooth frequently contain high concentrations of microplastics. The smoothness could be caused by the microplastics themselves, or possibly by something else that’s associated with them.

By combining all the measurements made by CYGNSS satellites as they orbit around the world, we can create global time-lapse images of ocean microplastic concentrations. Our images readily identify the Great Pacific Garbage Patch and secondary regions of high microplastic concentration in the North Atlantic and the southern oceans.

These images show microplastic concentrations (number of particles per square kilometer) at the mouths of the Yangtze and Qiantang rivers where they empty in to the East China Sea. (A) Average density year-round; (B) short-lived burst of particles from the Qiantang River; (C and D) short-lived bursts from the Yangtze River. Credit: Evans and Ruf, 2021., CC BY

Tracking microplastic flows over time

Since CYGNSS tracks wind speeds constantly, it lets us see how microplastic concentrations change over time. By animating a year’s worth of images, we revealed that were not previously known.

We found that global microplastic concentrations tend to peak in the North Atlantic and Pacific during the Northern Hemisphere’s summer months. June and July, for example, are the peak months for the Great Pacific Garbage Patch.

Concentrations in the Southern Hemisphere peak during its summer months of January and February. Lower concentrations during the winter in both hemispheres are likely due to a combination of stronger currents that break up microplastic plumes and increased vertical mixing—the exchange between surface and deeper water—that transports some of the microplastic down below the surface.

This approach can also target smaller regions over shorter periods of time. For example, we examined episodic outflow events from the mouths of the China’s Yangtze and Qiantang rivers where they empty into the East China Sea. These events may have been associated with increases in industrial production activity, or with increases in the rate at which managers allowed the rivers to flow through dams.

[…]

While the ocean roughness anomalies that we observed correlate strongly with concentrations, our estimates of concentration are based on the correlations that we observed, not on a known physical relationship between floating microplastics and ocean roughness. It could be that the roughness anomalies are caused by something else that is also correlated with the presence of microplastics.

One possibility is surfactants on the ocean surface. These liquid chemical compounds, which are widely used in detergents and other products, move through the oceans in ways similar to microplastics, and they also have a damping effect on wind-driven ocean roughening.

Further study is needed to identify how the smooth areas that we identified occur, and if they are caused indirectly by surfactants, to better understand exactly how their transport mechanisms are related to those of microplastics.

[…]

Source: The ocean is full of tiny plastic particles – we found a way to track them with satellites

OnePlus Admits to Throttling OnePlus 9 and 9 Pro for battery life

After a recent investigation by Anandtech pointed out that a number of popular apps were experiencing sluggish performance on the OnePlus 9 and OnePlus 9 Pro, OnePlus has now admitted to throttling hundreds of popular apps to help “reduce power consumption.”

Anandtech’s Andrei Frumusanu noticed that a number of popular browsers, including Google Chrome, performed significantly worse on benchmarks such as Jetstream 2.o and Speedometer 2.0, posting results more similar to those from old budget phones than a modern high-end device. And while Gizmodo does not use those benchmarks as part of our review process (due in part to previous tampering from companies including OnePlus and others), we can confirm similar numbers in our own testing.

Upon further review, Anandtech discovered that OnePlus had installed a custom OnePlus Performance Service function that throttled the performance of apps like YouTube, Snapchat, Discord, Twitter, Zoom, Facebook, Microsoft Office apps, and even a number of first-party apps from OnePlus. And by limiting the performance of certain cores in the OnePlus 9 and 9 Pro’s Snapdragon 888 processor, OnePlus was effectively throttling these apps in order to help deliver increased battery life.

In a statement provided to XDA Developers, OnePlus has confirmed it throttled the performance of apps on the OnePlus 9 and 9 Pro

[…]

Source: OnePlus Admits to Throttling OnePlus 9 and 9 Pro

Sam Altman’s New Startup Wants to Give You Crypto for Eyeball Scans – yes this is a terrible dr evil plan idea

hould probably sit down for this one. Sam Altman, the former CEO of famed startup incubator Y Combinator, is reportedly working on a new cryptocurrency that’ll be distributed to everyone on Earth. Once you agree to scan your eyeballs.

Yes, you read correctly.

You can thank Bloomberg for inflicting this cursed news on the rest of us. In its report, Bloomberg says Altman’s forthcoming cryptocurrency and the company behind it, both dubbed Worldcoin, recently raised $25 million from investors. The company is purportedly backed by Andreessen Horowitz, LinkedIn founder Reid Hoffman, and Day One Ventures.

“I’ve been very interested in things like universal basic income and what’s going to happen to global wealth redistribution and how we can do that better,” Altman told Bloomberg, explaining what fever dream inspired this.
[…]

What supposedly makes Worldcoin different is it adds a hardware component to cryptocurrency in a bid to “ensur[e] both humanness and uniqueness of everybody signing up, while maintaining their privacy and the overall transparency of a permissionless blockchain.” Specifically, Bloomberg says the gadget is a portable “silver-colored spherical gizmo the size of a basketball” that’s used to scan people’s irises. It’s undergoing testing in some cities, and since Worldcoin is not yet ready for distribution, the company is giving volunteers other cryptocurrencies like Bitcoin in exchange for participating. There are supposedly fewer than 20 prototypes of this eyeball scanning orb, and currently, each reportedly costs $5,000 to make.

Supposedly the whole iris scanning thing is “essential” as it would generate a “unique numerical code” for each person, thereby discouraging scammers from signing up multiple times. As for the whole privacy problem, Worldcoin says the scanned image is deleted afterward and the company purportedly plans to be “as transparent as possible.”

Source: Sam Altman’s New Startup Wants to Give You Crypto for Eyeball Scans

Just 100 Companies Create 90% of Plastic Waste

Plastic producers have tried to make us think that individuals can solve pollution by improving our recycling and shopping habits. A new study makes it clear why that’s their tactic. Just 20 companies are responsible for more than half of the world’s trashed single-use plastic.

The Plastic Waste Makers Index, published Tuesday by the Australian foundation Minderoo, is a comprehensive account of the companies manufacturing plastic that goes into disposable products. It shows that energy giants and chemical conglomerates are among the 20 companies that created 55% of global plastic waste. Expanding the view just a bit further, the report also shows that just 100 businesses account for more than 90% of trashed plastic.

The top contributor to throwaway plastics, the report found, is Exxon. In 2019, it contributed 5.9 million metric tons of plastic that got thrown away. In close second and third were the world’s two largest chemical companies, U.S.-based Dow and China’s Sinopec. They created 5.5 million metric tons and 5.3 million metric tons of the stuff respectively.

The research also showed that recycled plastic account for just 2% of the world’s disposable plastics. The vast majority are made from virgin materials, meaning new fossil fuels were extracted to create them.

[…]

Source: Just 100 Companies Create 90% of Plastic Waste

FSF doubles down on Richard Stallman’s return: Sure, he is ‘troubling for some’ but we need him, says org – doesn’t kneel for self entitled cancel culture idiots who can’t read Stallman’s actual quotes.

The Free Software Foundation (FSF) on Monday apologized for mishandling the announcement last month that founder Richard Stallman, or RMS, had been reelected to its board of directors – and published a statement from RMS both justifying his behavior and apologizing for it.

“FSF staff should have been informed and consulted first,” the FSF said. “The announcement by RMS at LibrePlanet was a complete surprise to staff, all those who worked so hard to organize a great event, to LibrePlanet speakers and to the exhibitors. We had hoped for a more inclusive and thoughtful process and we apologize that this did not occur.”

[…]

Source: FSF doubles down on Richard Stallman’s return: Sure, he is ‘troubling for some’ but we need him, says org • The Register

Suez Canal Totally Blocked After One Of the World’s Largest Container Ships Runs Aground

One of the world’s most important international shipping arteries remains blocked this evening after the MV Ever Given, a 1,300-foot, 220,000-ton container ship, ran aground and got stuck almost completely sideways in the Suez Canal—cutting off a vital shipping lane between Europe and Asia and leading to a massive backup of over a hundred giant vessels as attempts to refloat the ship have so far failed, according to Bloomberg, local reports and satellite data.

Loaded with nearly 20,000 containers, the Panama-flagged MV Ever Given—notably one of the largest container ships in the world—was sailing from China for Rotterdam in the Netherlands and had just left port in Suez, Egypt at the southern edge of the canal when it ran aground Tuesday morning. It’s not known yet how exactly it happened, but at only 80 feet deep and 673 feet wide, the canal offers little room for maneuvering, relatively speaking, should a huge ship veer off course or suffer some sort of control failure.

via Twitter

Satellite tracking data and photos from the scene show a flotilla of small tugs and even a land-bound excavator have spend all day trying to free the ship, but so far, it remains lodged lengthwise across the canal. There’s literally no room for anything larger than a tugboat to pass by. The fleet director for the company that manages the Ever Given confirmed to Bloomberg that the ship suffered a “grounding incident” but added there were no injuries or reports of any pollution.

Source: Suez Canal Totally Blocked After One Of the World’s Largest Container Ships Runs Aground

Double bongcloud: why grandmasters are playing the worst move in chess

An otherwise meaningless game during Monday’s preliminary stage of the $200,000 Magnus Carlsen Invitational left a pair of grandmasters in stitches while thrusting one of chess’s most bizarre and least effective openings into the mainstream.

Norway’s Magnus Carlsen and Hikaru Nakamura of the United States had already qualified for the knockout stage of the competition with one game left to play between them. Carlsen, the world’s top-ranked player and reigning world champion, started the dead rubber typically enough by moving his king’s pawn with the common 1 e4. Nakamura, the five-time US champion and current world No 18, mirrored it with 1 … e5. And then all hell broke loose.

Carlsen inched his king one space forward to the rank where his pawn had started. The self-destructive opening (2 Ke2) is known as the bongcloud for a simple reason: you’d have to be stoned to the gills to think it was a good idea.

The wink-wink move immediately sent Nakamura, who’s been a visible champion of the bongcloud in recent years, into an uncontrollable fit of laughter. Naturally, the American played along with 2 … Ke7, which marked the first double bongcloud ever played in a major tournament and its official entry to chess theory (namely, the Bongcloud Counter-Gambit: Hotbox Variation).

[…]

Why is the bongcloud so bad? For one, it manages to break practically all of the principles you’re taught about chess openings from day one: it doesn’t fight for the center, it leaves the king exposed and it wastes time, all while eliminating the possibility of castling and managing to impede the development of the bishop and queen. Even the worst openings tend to have some redeeming quality. The bongcloud, not so much.

What makes it funny (well, not to everyone) is the idea that two of the best players on the planet would use an opening so pure in its defiance of conventional wisdom.

This bongcloud has been a cult favorite in chess circles since the dawn of the internet, a popularity only fueled by Bobby Fischer’s rumored deployment of the opening in his alleged series of games with Nigel Short on the Internet Chess Club back in 2000. But its origins as a meme can be traced to Andrew Fabbro’s underground book Winning with the Bongcloud, a pitch-perfect parody of chess opening manuals and the purple, ponderous language that fills their pages.

[…]

 

Source: Double bongcloud: why grandmasters are playing the worst move in chess | Chess | The Guardian

Tucows closes its once-popular software download site

It was inevitable, really. In the early days of the internet, Tucows was known as a reliable place to find and download new software. Today, however, most people are happy to use a modern App Store — Microsoft and Apple both run their own — or navigate to developer websites directly. And if you’re looking for inspiration, there’s always Product Hunt. Tucows has decided, therefore, to finally shut down Tucows Downloads. “Tucows Downloads is old,” Elliot Noss, CEO of Tucows said. “Old sites are a maintenance challenge and therefore a risk.“

It’s a decision that the team has been mulling for some time. “We talked about shutting the site down before,” Noss explained. But the site’s history, combined with a sense of sentimentality, gave them pause. In 2016, the company decided to treat Tucows Downloads as a public service, rather than a legacy moneymaker. It stripped the site of ads, admitting that the site had become “less relevant when looking at the balance sheet” anyway. Now, though, the company is ready to move on. It has enough work as a domain registrar, domain name seller and the company behind Ting, an internet service provider in the US.

Source: Tucows closes its once-popular software download site | Engadget

Reading tables from images with magick

There are many times where someone shares data as an image, whether intentionally due to software constraints (ie Twitter) or as a result of not understanding the implications (image inside a PDF or in a Word Doc). xkcd.com jokingly refers to this as .norm or as the Normal File Format. While it’s far from ideal or a real file format, it’s all too common to see data as images in the “wild”. I’ll be using some examples from Twitter images and extracting the raw data from these. There are multiple levels of difficulty, namely that screenshots on Twitter are not uniform, often of relatively low quality (ie DPI), and contain additional “decoration” like colors or grid-lines. We’ll do our best to make it work!

[…]

Source: The Mockup Blog: Reading tables from images with magick

No, Cellebrite cannot ‘break Signal encryption.’

Yesterday, the BBC ran a story with the factually untrue headline, “Cellebrite claimed to have cracked chat app’s encryption.” This is false. Not only can Cellebrite not break Signal encryption, but Cellebrite never even claimed to be able to.

Since we weren’t actually given the opportunity to comment in that story, we’re posting this to help to clarify things for anyone who may have seen the headline.

 

This world of ours

Last week, Cellebrite posted a pretty embarrassing (for them) technical article to their blog documenting the “advanced techniques” they use to parse Signal on an Android device they physically have with the screen unlocked.

This is a situation where someone is holding an unlocked phone in their hands and could simply open the app to look at the messages in it. Their post was about doing the same thing programmatically (which is equally simple), but they wrote an entire article about the “challenges” they overcame, and concluded that “…it required extensive research on many different fronts to create new capabilities from scratch.”

[…]

It’s also hard to know how such an embarrassing turn of events became anything other than a disaster for Cellebrite, but several news outlets, including the BBC, published articles about Cellebrite’s “success,” despite the existence of clarifying information already available online.

What really happened

  1. If you have your device, Cellebrite is not your concern. It is important to understand that any story about Cellebrite Physical Analyzer starts with someone other than you physically holding your device, with the screen unlocked, in their hands. Cellebrite does not even try to intercept messages, voice/video, or live communication, much less “break the encryption” of that communication. They don’t do live surveillance of any kind.
  2. Cellebrite is not magic. Imagine that someone is physically holding your device, with the screen unlocked, in their hands. If they wanted to create a record of what’s on your device right then, they could simply open each app on your device and take screenshots of what’s there. This is what Cellebrite Physical Analyser does. It automates the process of creating that record. However, because it’s automated, it has to know how each app is structured, so it’s actually less reliable than if someone were to simply open the apps and manually take the screenshots. It is not magic, it is mediocre enterprise software.
  3. Cellebrite did not “accidentally reveal” their secrets. This article, and others, were written based on a poor interpretation of a Cellebrite blog post about adding Signal support to Cellebrite Physical Analyzer. Cellebrite posted something with a lot of detail, then quickly took it down and replaced it with something that has no detail. This is not because they “revealed” anything about some super advanced technique they have developed (remember, this is a situation where someone could just open the app and look at the messages). They took it down for the exact opposite reason: it made them look bad. Articles about this post would have been more appropriately titled “Cellebrite accidentally reveals that their technical abilities are as bankrupt as their function in the world.”
  4. […]

Source: Signal >> Blog >> No, Cellebrite cannot ‘break Signal encryption.’

Judge Rules Trump Must Say Himself If His Tweets Are True or Bullshit. It can be one or the other.

On Friday, a federal judge decided that he’s had enough of reading the tea leaves when it comes to exactly what the fuck Trump is talking about.

The president’s tweets have become more central to his tenure in office than ever before as he’s been recovering from covid-19 infection and lashing out in every direction to save his floundering campaign. On Oct. 6, between retweeting supporters and spreading conspiracies about the FDA, Trump tweeted: “I have fully authorized the total Declassification of any & all documents pertaining to the single greatest political CRIME in American History, the Russia Hoax. Likewise, the Hillary Clinton Email Scandal. No redactions!” And in case you didn’t get the message, he tweeted it again later that day.

This was news to anyone who has been trying to get their hands on a copy of the full unredacted Mueller Report—including reporters at CNN and BuzzFeed who are involved in ongoing litigation around the report. And like clockwork, BuzzFeed filed two emergency motions requesting all documents related to the Russia investigation

Earlier this week, Justice Department lawyers told a federal court that no such declassification order exists and the department would continue to make redactions and declassify documents at its discretion. “The White House Counsel’s Office informed the Department that there is no order requiring wholesale declassification or disclosure of documents at issue in this matter,” the DOJ said in a court filing.

U.S. District Court Judge Reggie Walton is done taking the word of people in this administration. On a brief hearing by telephone this morning, Walton told the DOJ that he wants Trump to say whether or not the tweets were serious or just more bullshit he hopes people believe and forget about.

[…]

Writing about BuzzFeed’s promising morning in court, Jason Leopold pointed out that this could be a “watershed moment” for individuals who’ve had to fight battles in court over Trump tweets. The administration has argued in the past that his tweets shouldn’t be taken seriously and are official statements by the president, depending on what argument suits them in a given case. We’ve even seen a court fight over whether Trump has the right to selectively block Americans from viewing his tweets.

Judge Walton is done with this nonsense and now puts Trump in a difficult position. Does Trump admit that he was lying, or does he just say screw it and unleash more chaos with a flood of unredacted documents that might not paint him in the greatest of lights? This is a man who has said he has “no regrets” about his administration’s response to the covid-19 pandemic that has left the U.S. with the highest recorded case-load and death toll in the world. He doesn’t admit when he’s wrong. On the other hand, declassifying the documents could, at minimum, amount to a political situation that finds Trump essentially doing to himself what FBI Director James Comey did to Hillary Clinton a week before the 2016 election.

Source: Judge Rules Trump Must Say Himself If His Tweets Are True

YouTube celebrates Deaf Awareness Week by killing crowd-sourced captions

Today’s the day YouTube is killing its “Community Contributions” feature for videos, which let content creators crowdsource captions and subtitles for their videos. YouTube announced the move back in July, which triggered a community outcry from the deaf, hard of hearing, and fans of foreign media, but it does not sound like the company is relenting. In one of Google’s all-time, poor-timing decisions, YouTube is killing the feature just two days after the International Week of the Deaf, which is the last full week in September.

Once enabled by a channel owner, the Community Contributions feature would let viewers caption or translate a video and submit it to the channel for approval. YouTube currently offers machine-transcribed subtitles that are often full of errors, and if you also need YouTube to take a second pass at the subtitles for machine translation, they’ve probably lost all meaning by the time they hit your screen. The Community Caption feature would load up those machine-written subtitles as a starting point and allow the user to make corrections and add text that the machine transcription doesn’t handle well, like transcribed sound cues for the deaf and hard of hearing.

YouTube says it’s killing crowd-source subtitles due to spam and low usage. “While we hoped Community Contributions would be a wide-scale, community-driven source of quality translations for Creators,” the company wrote, “it’s rarely used and people continue to report spam and abuse.” The community does not seem to agree with this assessment, since a petition immediately popped up asking YouTube to reconsider, and so far a half-million people have signed. “Removing community captions locks so many viewers out of the experience,” the petition reads. “Community captions ensured that many videos were accessible that otherwise would not be.”

[…]

Source: YouTube celebrates Deaf Awareness Week by killing crowd-sourced captions | Ars Technica

Facebook Fights Climate Change by Mass Banning of Climate Groups

Just last week, Facebook launched an initiative to uplift climate science. It was wildly misguided, yes, but the company was trying to show it’s down for the cause or something. Now, the company is proving just how devoted to climate activism it is by, um, booting environmental justice organizers from the platform. Tight!

Hundreds of Indigenous, environmental, and social justice groups and members had their accounts blocked this past weekend, leaving them unable to post or send messages. Greenpeace USA, Climate Hawks Vote, Stand.earth, Wet’suwet’en Access Point on Gidimt’en Territory, and Rainforest Action Network were among the groups that saw their accounts affected.

The accounts blocked were involved in planning a communications blockade event against KKR & Co., the U.S. investment firm that’s majority funder of the destructive Coastal Link natural gas pipeline, which is set to cut through land controlled by Indigenous people without consent. In other words, these groups were blocked while fighting climate injustice.

“Facebook is actively suppressing those who oppose fascism and the colonial capitalists,” activist Delee Nikal, a Wet’suwet’en band member of the Gitdimt’en clan, said in a statement emailed to Earther.

In a statement, Facebook said these suspensions were all just a random accident.

“Our systems mistakenly removed these accounts and content,” Facebook spokesman Andy Stone said.

He said all limits imposed had been lifted, but according to Greenpeace USA, though many accounts have now been restored, some are still blocked.

Source: Facebook Conducts ‘Mass Censorship’ of Climate Activists

Angry 123-Reg customers in the UK wake up to another day where hosted mail doesn’t get through to users on Microsoft email accounts

Users of UK web hosting firm 123-Reg’s email service told The Reg this morning that 96 hours after clocking the issue, they are still having trouble sending emails to users with Microsoft’s Live, Outlook or Hotmail accounts.

For its part, 123-Reg has confirmed “delays in delivering emails to Hotmail/Outlook/Live email addresses,” but provided no ETA for a fix. According to the issue ticket on its status page, filed on Saturday, September 5, the firm claimed to have identified the root cause – which it has yet to explain – and said it was “working with Microsoft” to resolve it. The issue is not believed to affect the delivery of emails being sent by customers on 123-Reg’s Microsoft 365 “platform”.

Several users have claimed the mail-forwarding issues actually began on Friday morning.

Predictably, punters are irate, with many complaining the outage is causing lost business and reputational damage.

Source: Angry 123-Reg customers in the UK wake up to another day where hosted mail doesn’t get through to users on Microsoft email accounts • The Register

As a private host with email, I feel the frustration. MS and Google are good at this.

Um, almost the entire Scots Wikipedia was written by someone with no idea of the language – 10,000s of articles

In an extraordinary and somewhat devastating discovery, it turns out virtually the entire Scots version of Wikipedia, comprising more than 57,000 articles, was written, edited or overseen by a netizen who clearly had nae the slightest idea about the language.

The user is not only a prolific contributor, they are an administrator of sco.wikipedia.org, having created, modified or guided the vast majority of its pages in more than 200,000 edits. The result is tens of thousands of articles in English with occasional, and often ridiculous, letter changes – such as replacing a “y” with “ee.”

That’s right, someone doing a bad impression of a Scottish accent and then writing it down phonetically is the chief maintainer of the online encyclopedia’s Scots edition. And although this has been carrying on for the best part of a decade, the world was mostly oblivious to it all – until today, when one Redditor finally had enough of reading terrible Scots and decided to look behind the curtain.

“People embroiled in linguistic debates about Scots often use it as evidence that Scots isn’t a language, and if it was an accurate representation, they’d probably be right,” noted the Reddit sleuth, Ultach. “It uses almost no Scots vocabulary, what little it does use is usually incorrect, and the grammar always conforms to standard English, not Scots.”

[…]

Source: Um, almost the entire Scots Wikipedia was written by someone with no idea of the language – 10,000s of articles • The Register

New study detects global atmosphere rings like a bell

A ringing bell vibrates simultaneously at a low-pitched fundamental tone and at many higher-pitched overtones, producing a pleasant musical sound. A recent study, just published in the Journal of the Atmospheric Sciences by scientists at Kyoto University and the University of Hawai’i at Mānoa, shows that the Earth’s entire atmosphere vibrates in an analogous manner, in a striking confirmation of theories developed by physicists over the last two centuries.

In the case of the , the “music” comes not as a sound we could hear, but in the form of large-scale waves of spanning the globe and traveling around the equator, some moving east-to-west and others west-to-east. Each of these waves is a resonant vibration of the global atmosphere, analogous to one of the resonant pitches of a bell. The basic understanding of these atmospheric resonances began with seminal insights at the beginning of the 19th century by one of history’s greatest scientists, the French physicist and mathematician Pierre-Simon Laplace. Research by physicists over the subsequent two centuries refined the theory and led to detailed predictions of the wave frequencies that should be present in the atmosphere. However, the actual detection of such waves in the has lagged behind the theory.

Now in a new study by Takatoshi Sakazaki, an assistant professor at the Kyoto University Graduate School of Science, and Kevin Hamilton, an Emeritus Professor in the Department of Atmospheric Sciences and the International Pacific Research Center at the University of Hawai?i at Mānoa, the authors present a detailed analysis of observed atmospheric pressure over the globe every hour for 38 years. The results clearly revealed the presence of dozens of the predicted wave modes.

The study focused particularly on waves with periods between 2 hours and 33 hours which travel horizontally through the atmosphere, moving around the globe at great speeds (exceeding 700 miles per hour). This sets up a characteristic “chequerboard” pattern of high and low pressure associated with these waves as they propagate (see figure).

Pressure patterns for 4 of the modes as they propagate around the globe. Credit: Sakazaki and Hamilton (2020)

“For these rapidly moving wave modes, our observed frequencies and global patterns match those theoretically predicted very well,” stated lead author Sakazaki. “It is exciting to see the vision of Laplace and other pioneering physicists so completely validated after two centuries.”

But this discovery does not mean their work is done.

“Our identification of so many modes in real data shows that the atmosphere is indeed ringing like a bell,” commented co-author Hamilton. “This finally resolves a longstanding and classic issue in atmospheric science, but it also opens a new avenue of research to understand both the processes that excite the waves and the processes that act to damp the waves.”

So let the atmospheric music play on!


More information: Takatoshi Sakazaki et al, An Array of Ringing Global Free Modes Discovered in Tropical Surface Pressure Data, Journal of the Atmospheric Sciences (2020). DOI: 10.1175/JAS-D-20-0053.1

Source: New study detects ringing of the global atmosphere

Ex-Green Beret arrested in Carlos Ghosn case has no stranger to danger

This Dec. 30, 2019, image from security camera video shows Michael L. Taylor, center, and George-Antoine Zayek at passport control at Istanbul Airport in Turkey. Taylor, a former Green Beret, and his son, Peter Taylor, 27, were arrested Wednesday in Massachusetts on charges they smuggled Nissan ex-Chairman Carlos Ghosn out of Japan in a box in December 2019, while he awaited trial there on financial misconduct charges. / AP

Decades before a security camera caught Michael Taylor coming off a jet that was carrying one of the world’s most-wanted fugitives, the former Green Beret had a hard-earned reputation for taking on dicey assignments.

Over the years, Taylor had been hired by parents to rescue abducted children. He went undercover for the FBI to sting a Massachusetts drug gang. And he worked as a military contractor in Iraq and Afghanistan, an assignment that landed him in a Utah jail in a federal fraud case.

So when Taylor was linked to the December escape of former Nissan CEO Carlos Ghosn from Japan, where the executive awaited trial on financial misconduct charges, some in U.S. military and legal circles immediately recognized the name.

Taylor has “gotten himself involved in situations that most people would never even think of, dangerous situations, but for all the right reasons,” Paul Kelly, a former federal prosecutor in Boston who has known the security consultant since the early 1990s, said earlier this year.

“Was I surprised when I read the story that he may have been involved in what took place in Japan? No, not at all.”

Wednesday, after months as fugitives, Taylor, 59, and his son, Peter, 27, were arrested in Massachusetts on charges accusing them of hiding Ghosn in a shipping case drilled with air holes and smuggling him out of Japan on a chartered jet. Investigators were still seeking George-Antoine Zayek, a Lebanese-born colleague of Taylor.

“He is the most all-American man I know,” Taylor’s assistant, Barbara Auterio, wrote to a federal judge before his sentencing in 2015. “His favorite song is the national anthem.”

Kelly, now serving as the attorney for the Taylors, said they plan to challenge Japan’s extradition request “on several legal and factual grounds.”

“Michael Taylor is a distinguished veteran and patriot, and both he and his son deserve a full and fair hearing regarding these issues,” Kelly said in an email.

Some of those who know Taylor say he is a character of questionable judgment, with a history of legal troubles dating back well before the Utah case. But others praise him as a patriot, mentor and devoted family man, who regularly put himself at risk for his clients, including some with little ability to pay.

“He is the most all-American man I know,” Taylor’s assistant, Barbara Auterio, wrote to a federal judge before his sentencing in 2015. “His favorite song is the national anthem.”

In 1993, a Massachusetts state trooper investigated Taylor for drug running and sued his supervisor after being told to stop scrutinizing the prized FBI informant. In 1998, Taylor was granted immunity in exchange for testifying against a Teamsters official accused of extortion. In 1999, he pleaded guilty to planting marijuana in the car of a client’s estranged wife, leading to her arrest, according to a 2001 report in the Boston Herald.

Taylor also made headlines in 2011 when he resigned as football coach at a Massachusetts prep school, Lawrence Academy, which was stripped of two titles. Taylor was accused of inappropriate donations, including covering tuition for members of a team that included seven Division I recruits.

“Michael Taylor was the only person in this great country that was able to help me, and he did,” a California woman whose son was taken to Beirut, wrote to the sentencing judge in the Utah military contracting case. “Michael Taylor brought my son back.”

“It wasn’t pleasant what he was yelling at us across the field. He was calling us out for not being man enough to kick the ball,” said John Mackay, who opposed Taylor as coach of St. George’s School in Rhode Island. “His zeal, probably like he does everything in life, is to the Nth degree.”

The security business that Taylor and a partner set up decades ago was initially focused on private investigations but their caseload grew through corporate work and unofficial referrals from the State Department and FBI, including parents whose children had been taken overseas by former spouses.

“Michael Taylor was the only person in this great country that was able to help me, and he did,” a California woman whose son was taken to Beirut, wrote to the sentencing judge in the Utah military contracting case. “Michael Taylor brought my son back.”

In 2012, federal prosecutors alleged that Taylor won a U.S. military contract to train Afghan soldiers by using secret information passed along from an American officer. The prosecutors said that when Taylor learned the contract was being investigated, he asked an FBI agent and friend to intervene.

The government seized $5 million from the bank account of Taylor’s company and he spent 14 months in jail before agreeing to plead guilty to two counts. The government agreed to return $2 million to the company as well as confiscated vehicles.

The plot to free Ghosn apparently began last fall, when operatives began scouting Japanese terminals reserved for private jets. Tokyo has two airports within easy reach of Ghosn’s home. But the group settled on the private terminal at Osaka’s Kansai International Airport, where machines used to X-ray baggage could not accommodate large boxes.

On the day of the escape, Michael Taylor and Zayek flew into Japan on a chartered jet with two large black boxes, claiming to be musicians carrying audio equipment, according to court papers.

Around 2:30 that afternoon, Ghosn, free on hefty bail, left his house on a leafy street in Tokyo’s Roppongi neighborhood and walked to the nearby Grand Hyatt Hotel, going to a room there and departing two hours later to board a bullet train for Osaka.

That evening, his rescuers wheeled shipping boxes through the Osaka private jet terminal known as Premium Gate Tamayura — “fleeting moment” in Japanese. Terminal employees let the men pass without inspecting their cargo.

At 11:10 p.m., the chartered Bombardier, its windows fitted with pleated shades, lifted off. The flight went first to Turkey, then to Lebanon, where Ghosn has citizenship, but which has no extradition treaty with Japan.

“I didn’t run from justice,” Ghosn told reporters after he resurfaced. “I left Japan because I wanted justice.”

Source: Ex-Green Beret arrested in Carlos Ghosn case has done dangerous work | Autoblog

Elon Musk Tweets ‘FREE AMERICA NOW’ As His Coronavirus Predictions Prove Very Wrong

Billionaire Elon Musk, America’s dumbest smart guy, spent the night tweeting about how America needs to “reopen” its economy, despite Musk’s failed predictions about the trajectory of the coronavirus crisis. A month ago, Musk insisted that new coronavirus cases in the U.S. would be “close to zero” by the end of April. Well, it’s the end of April, and the country is still reporting over 20,000 new cases per day, according to the CDC.

“FREE AMERICA NOW,” Musk tweeted overnight after sending out news articles about plans to relax social distancing restrictions in various parts of the U.S., the country with the highest number of coronavirus deaths in the world by far.

“Give people their freedom back!” Musk wrote in another tweet that linked to a Wall Street Journal opinion piece by millionaire T.J. Rodgers. The 72-year-old libertarian held up Sweden’s relaxed lockdown rules as a relative success because, “Older people in care homes accounted for half of Sweden’s deaths.”

“Bravo Texas!” Musk exclaimed in yet another tweet overnight about how Texas plans to reopen restaurants, malls, and movie theaters on Friday. Texas has seen at least 690 coronavirus deaths, though the real number is believed by experts to be much higher.

Musk also agreed with a pro-Trump conspiracy theorist overnight who tweeted, “The scariest thing about this pandemic is not the virus itself, it’s seeing American so easily bow down & give up their blood bought freedom to corrupt politicians who promise them safety.” Musk simply replied, “True.”

The U.S. has identified at least 1,012,583 cases of covid-19 and 58,355 deaths as of Wednesday morning, according to the Johns Hopkins University coronavirus tracker. And those numbers are expected to rise if the social distancing restrictions denounced by Musk are lifted too early, according to the latest projections by the CDC. But over the past few months, Musk has shown he’s not the guy you want to be taking advice from during this worldwide pandemic.

[…]

The 48-year-old entrepreneur has been skeptical, if we can call it that, of the coronavirus pandemic from the beginning. On March 6, Musk tweeted “The coronavirus panic is dumb” and on March 19, he tweeted “kids are essentially immune” to the disease, something that’s objectively not true. As just one example, the 5-month-old daughter of a New York City firefighter died this past weekend of the novel coronavirus.

In case it wasn’t clear, Elon Musk is not volunteering to die for the economy. He’s volunteering his workers and your kids to act as guinea pigs for a disease that we still know very little about. The CDC just added six new coronavirus symptoms for diagnosing the disease, and we’re learning that most patients who’ve required hospitalization in New York have not had fevers. That’s counter to everything we thought we knew about the virus just a couple of months ago. In fact, you couldn’t get a covid-19 test in the U.S. without a fever and it’s not clear that you’d even be able to get one today if you don’t register a high body temperature.

As long as Musk has got a Twitter account, he’ll continue spewing his most ill-informed thoughts to the world in the middle of the night. And given a recent court ruling in his favor, let’s just hope he doesn’t start calling anyone with the virus a pedophile. It’s really the best we can hope for these days.

Source: Elon Musk Tweets ‘FREE AMERICA NOW’ As His Coronavirus Predictions Prove Very Wrong

Zoom admits it doesn’t have 300 million users, corrects misleading claims

Zoom has admitted it doesn’t have 300 million daily active users. The admission came after The Verge noticed the company had quietly edited a blog post making the claim earlier this month. Zoom originally stated it had “more than 300 million daily users” and that “more than 300 million people around the world are using Zoom during this challenging time.” Zoom later deleted these references from the original blog post, and now claims “300 million daily Zoom meeting participants.”

The difference between a daily active user (DAU) and “meeting participant” is significant. Daily meeting participants can be counted multiple times: if you have five Zoom meetings in a day then you’re counted five times. A DAU is counted once per day, and is commonly used by companies to measure service usage. Only counting meeting participants is an easy, somewhat misleading, way to make your platform usage seem larger than it is.

The misleading blog was edited on April 24th, a day after the numbers made headlines worldwide. After The Verge reached out for comment from Zoom, the company added a note to the blog post admitting the error yesterday, and provided the following statement:

“We are humbled and proud to help over 300 million daily meeting participants stay connected during this pandemic. In a blog post on April 22, we unintentionally referred to these participants as “users” and “people.” When we realized this error, we adjusted the wording to “participants.” This was a genuine oversight on our part.”

Zoom’s growth has been impressive, but the company has not actually provided a daily active user count. Zoom usage has soared from 10 million daily meeting participants back in December to 300 million this month. Rivals like Microsoft Teams and Google Meet appear to be closing the gap, though. Microsoft said yesterday it now has 75 million daily active users of Teams, a jump from 70 percent in a month. Microsoft also recorded 200 million meeting participants in a single day this month.

Google Meet is adding roughly 3 million new users each day, and hit over 100 million daily Meet meeting participants recently. Cisco also revealed earlier this month that it has a total of 300 million Webex users, and saw sign-ups close to 240,000 in a 24-hour period. Cisco has not yet provided daily meeting participant numbers, or daily active user counts.

Google, Microsoft, Facebook, and others are still chasing Zoom with new features and free services. Google made its Meet service free this week, and both Microsoft and Google have increased how many people you can see simultaneously in response to Zoom’s popular gallery view.

Source: Zoom admits it doesn’t have 300 million users, corrects misleading claims – The Verge

Samsung ‘s TV Boxes Can Now Be Easily Upcycled Into Cat Houses

Taking a cue from anyone under 10 years old who can come up with endless imaginative uses for an empty cardboard box, Samsung is now making it easy for anyone to recycle or upcycle its TV packaging into other useful household items like magazine racks and fancy cat houses.

As competition between flat screen TV makers pushes those companies to release larger and larger sets to woo buyers, the packaging used to safely ship those TVs has grown along with them, leaving consumers with mountains of cardboard to dispose of afterward. In order to help reduce its carbon footprint, Samsung will start using packaging made from “eco-friendly corrugated cardboard” on its higher-end TVs including The Serif, The Frame, and the rotating, portrait mode-friendly, The Sero. The company didn’t go into detail about what makes the type of cardboard its using more eco-friendly, but presumably, and hopefully, it will include a higher percentage of recycled materials.

Source: Samsung ‘s TV Boxes Can Now Be Easily Upcycled Into Cat Houses