Experian API Exposed Credit Scores of Most Americans

Posted on by

Big-three consumer credit bureau Experian just fixed a weakness with a partner website that let anyone look up the credit score of tens of millions of Americans just by supplying their name and mailing address, KrebsOnSecurity has learned. Experian says it has plugged the data leak, but the researcher who reported the finding says he fears the same weakness may be present at countless other lending websites that work with the credit bureau.

Bill Demirkapi, an independent security researcher who’s currently a sophomore at the Rochester Institute of Technology, said he discovered the data exposure while shopping around for student loan vendors online.

Demirkapi encountered one lender’s site that offered to check his loan eligibility by entering his name, address and date of birth. Peering at the code behind this lookup page, he was able to see it invoked an Experian Application Programming Interface or API — a capability that allows lenders to automate queries for FICO credit scores from the credit bureau.

[…]

Demirkapi found the Experian API could be accessed directly without any sort of authentication, and that entering all zeros in the “date of birth” field let him then pull a person’s credit score. He even built a handy command-line tool to automate the lookups, which he dubbed “Bill’s Cool Credit Score Lookup Utility.”

Demirkapi’s Experian credit score lookup tool.

KrebsOnSecurity put that tool to the test, asking permission from a friend to have Demirkapi look up their credit score. The friend agreed and said he would pull his score from Experian (at this point I hadn’t told him that Experian was involved). The score he provided matched the score returned by Demirkapi’s lookup tool.

In addition to credit scores, the Experian API returns for each consumer up to four “risk factors,” indicators that might help explain why a person’s score is not higher.

For example, in my friend’s case Bill’s tool said his mid-700s score could be better if the proportion of balances to credit limits was lower, and if he didn’t owe so much on revolving credit accounts.

“Too many consumer finance company accounts,” the API concluded about my friend’s score.

[…]

Source: Experian API Exposed Credit Scores of Most Americans – Krebs on Security

BadAlloc: Microsoft looked at memory allocation code in tons of devices and found this one common security flaw

Posted on by

Microsoft has taken a look at memory management code used in a wide range of equipment, from industrial control systems to healthcare gear, and found it can be potentially exploited to hijack devices.

[…]

Drilling down to the nitty-gritty: Microsoft’s Azure Defender for IoT security research group looked at memory allocation functions, such as malloc(), provided by real-time operating systems, standard C libraries, and software development kits all aimed at embedded electronics: that’s Internet-of-Things (IoT) devices, industrial control systems, and so-called operational technology (OT).

The team found a programming blunder common among much of the software: integer overflows during heap memory allocation. This occurs when an attacker is able to, usually via malicious data inputs, trick application code into making a very large memory allocation for a buffer to hold further incoming information.

The trouble is that a vulnerable memory allocator could take that large size – eg, 0xffffffff on a 32-bit embedded system – and add something like 8 to it because the requested memory block needs eight bytes of metadata to describe it. The size then overflows to 7 and the allocator finds space in memory that’s seven bytes in size for the requested buffer.

The allocator returns a pointer to that small space to the application, which assumes the allocation succeeded for the huge request, and then copies way more than seven bytes of data into the buffer from the attacker. This causes the application to overwrite the memory allocation metadata, structures, and contents. Now the attacker who sent over the data can take full control of the system by overwriting function pointers or altering other values.

The allocations should fail due to the large sizes, but the integer overflow allows them to partially succeed and in a way that’s exploitable. To pull this off, an attacker would need to be able to feed data to the application – either as a file or network traffic or whatever – that causes it to allocate a huge block of heap memory. It would be nice if application code trapped oversize allocations, but in any case, Microsoft found OS and library-level code let it all sail through, too, due to the overflows.

[…]

For devices that cannot be patched immediately, we recommend mitigating controls such as: reducing the attack surface by minimizing or eliminating exposure of vulnerable devices to the internet; implementing network security monitoring to detect behavioral indicators of compromise; and strengthening network segmentation to protect critical assets.”

What is affected? Good question. The US government’s Cybersecurity and Infrastructure Security Agency (CISA) has a summary here.

[…]

its advisory here

Source: BadAlloc: Microsoft looked at memory allocation code in tons of devices and found this one common security flaw • The Register

People rebel against WiFi Tracking in Maassluis with Robin Hood action

Posted on by

A resident of Maassluis registered the Mac addresses of 54,000 smartphones and passed them on to an opt-out register. The action of the “Robin 2.4Ghz Hood” keeps all these phone owners out of the municipality’s Wi-Fi tracking.

The promotion is intended to protect the privacy of the residents of Maassluis. The man behind the initiative, Jerry Hopper, also exposed a privacy leak in the neighborhood app Nextdoor in 2019.

Hopper’s current action is against the municipality’s plan to count visits to the center by April 2021 by registering the unique ID codes of WiFi transmitters (MAC addresses). Anyone who does not want that, says Maassluis, should switch off the Wi-Fi antenna of his phone. According to the technical blogger, that is the other way around, because European privacy rules are opt-in. Don’t opt ​​out.

For a few weeks now, the resident of the city has therefore been measuring the MAC addresses of cars that pass his house. “Knowing that I am also violating the privacy law with this plan, I feel like a kind of Robin Hood in the shadowy realm of data collectors. As far as possible, I have tried to use the same techniques. There is even an opt-out. We anonymize the mac address “on the sensor” by hashing it 2x, and “cutting off” part of the hash. ”

The purpose of the action: “If the hash does not exist, we will send the MAC over a secure connection to the MOA opt-out register.” That register called Wifi Me Niet is the place where people can extract the address of their phone, tablet and computer from the measurement. That is a private initiative.

The more than fifty thousand mac addresses collected by Hopper are more than the thirty thousand inhabitants of his city, he explains on his blog.

“Another question is: how long will it remain technically possible to send unlimited mac addresses to the opt-out register. I am also very curious about how the mac addresses sent by this project are handled if they notice that they have been added via an automated process. Would they be removed? ”

The municipality of Maassluis is not alone in measuring visits to its city center by counting Wi-Fi antennas. Enschede is doing the same. For that, however, the municipality was fined six hundred thousand euros on Wednesday. Research by the Dutch Data Protection Authority showed that the privacy of citizens was not properly guaranteed. They could be tracked without it being necessary.

In Enschede, it was technical politician Dave Borghuis who put the city on fire with his Wi-Fi move.

Municipalities cannot be surprised by the popular slap on the fingers. The Dutch Data Protection Authority already warned shops and municipalities in June 2016 that they must have a legal basis for tracking citizens.

Enschede does not agree with the decision and says it will object to the decision.


Source: Burgerverzet tegen wifi-tracking in Maassluis – Emerce

AI Dungeon text adventure generator’s sessions generate NSFW + violence (turns out people like porn), but some involved sex with children. So they put a filter on.

Posted on by

AI Dungeon, which uses OpenAI’s GPT-3 to create online text adventures with players, has a habit of acting out sexual encounters with not just fictional adults but also children, prompting the developer to add a content filter.

AI Dungeon is straightforward: imagine an online improvised Zork with an AI generating the story with you as you go. A player types in a text prompt, which is fed into an instance of GPT-3 in the cloud. This backend model uses the input to generate a response, which goes back to the player, who responds with instructions or some other reaction, and this process repeats.

It’s a bit like talking to a chat bot though instead of having a conversation, it’s a joint effort between human and computer in crafting a story on the fly. People can write anything they like to get the software to weave a tapestry of characters, monsters, animals… you name it. The fun comes from the unexpected nature of the machine’s replies, and working through the strange and absurd plot lines that tend to emerge.

Unfortunately, if you mention children, there was a chance it would go from zero to inappropriate real fast, as the SFW screenshot below shows. This is how the machine-learning software responded when we told it to role-play an 11-year-old:

A screenshot from AI Dungeon

Er, not cool … Software describes the fictional 11-year-old as a girl in a skimpy school uniform standing over you. Click to enlarge

Not, “hey, mother, shall we visit the magic talking tree this morning,” or something innocent like that in response. No, it’s straight to creepy.

Amid pressure from OpenAI, which provides the game’s GPT-3 backend, AI Dungeon’s maker Latitude this week activated a filter to prevent the output of child sexual abuse material. “As a technology company, we believe in an open and creative platform that has a positive impact on the world,” the Latitude team wrote.

“Explicit content involving descriptions or depictions of minors is inconsistent with this value, and we firmly oppose any content that may promote the sexual exploitation of minors. We have also received feedback from OpenAI, which asked us to implement changes.”

And by changes, they mean making the software’s output “consistent with OpenAI’s terms of service, which prohibit the display of harmful content.”

The biz clarified that its filter is designed to catch “content that is sexual or suggestive involving minors; child sexual abuse imagery; fantasy content (like ‘loli’) that depicts, encourages, or promotes the sexualization of minors or those who appear to be minors; or child sexual exploitation.”

And it added: “AI Dungeon will continue to support other NSFW content, including consensual adult content, violence, and profanity.”

[…]

it was also this week revealed programming blunders in AI Dungeon could be exploited to view the private adventures of other players. The pseudonymous AetherDevSecOps, who found and reported the flaws, used the holes to comb 188,000 adventures created between the AI and players from April 15 to 19, and saw that 46.3 per cent of them involved lewd role-playing, and about 31.4 per cent were pure pornographic.

[…]

disclosure on GitHub.

[…]

AI Dungeon’s makers were, we’re told, alerted to the API vulnerabilities on April 19. The flaws were addressed, and their details were publicly revealed this week by AetherDevSecOps.

Exploitation of the security shortcomings mainly involved abusing auto-incrementing ID numbers used in API calls, which are easy to enumerate to access data belonging to other players; no rate limits to mitigate this abuse; and a lack of monitoring for anomalous requests that could be malicious activity.

[…]

Community reaction

The introduction of the content filter sparked furor among fans. Some are angry that their free speech is under threat and that it ruins intimate game play with fictional consenting adults, some are miffed that they had no warning this was landing, others are shocked that child sex abuse material was being generated by the platform, and many are disappointed with the performance of the filter.

When it detects sensitive words, the game simply instead says the adventure “took a weird turn.” It appears to be triggered by obvious words relating to children, though the filter is spotty. An innocuous text input describing four watermelons, for example, upset the filter. A superhero rescuing a child was also censored.

Latitude admitted its experimental-grade software was not perfect, and repeated it wasn’t trying to censor all erotic consent – only material involving minors. It also said it will review blocked material to improve its code; given the above, that’s going to be a lot of reading.

[…]

Source: Not only were half of an AI text adventure generator’s sessions NSFW but some involved depictions of sex with children • The Register

EU Charges Apple With Antitrust Violations in Spotify Case

Posted on by

the European Union has charged Apple with allegedly “abus[ing] its dominant position” in the music streaming market.

The charges stem from an initial complaint filed by Spotify in 2019. At the time, Spotify accused Apple of having “an unfair advantage at every turn” by imposing a series of obstacles that favored its own services at the expense of competitors. As it turns out, the European Commission seems to agree with Spotify.

“By setting strict rules on the App Store that disadvantage competing music streaming services, Apple deprives users of cheaper music streaming choices and distorts competition,” the European Commission said in a tweet.

The Commission further explained in a press release that it took issue with Apple’s role as a gatekeeper to the iOS ecosystem. Because the App Store is the only venue for developers to reach iOS users, the Commission contends that elevates Apple to a dominant position within the music streaming market. In particular, it singled out Apple’s mandatory 30% commission for in-app purchases and “anti-steering provisions.” The latter refers to limitations within the App Store that prevent developers from informing consumers of alternative payment options that might be cheaper. That in turn forces rival music streaming services to raise subscription prices for consumers to make up for their higher costs—all while Apple benefits by acting as a middle man for in-app billing and communications with consumers.

[…]

It’s a no-brainer that each company would point to the other as being in the wrong here. But it’s clear that Apple’s 30% commission and control over in-app transactions is a sore point for multiple companies. Next week, Epic Games will also go to federal court to argue that Apple abused its power to kick Fortnite out of the App Store. That dramatic brouhaha last summer sparked a number of app developers—including Spotify, Tile, and Epic Games—to form the Coalition for App Fairness (CAF), a nonprofit that aims to fight against the so-called Apple tax and other anticompetitive app store policies.

[…]

. If found guilty, Apple could face up to a 10% fine on its annual revenue—which, any way you slice it would be a lot of money. However, the Commission says that there are “no legal deadlines for bringing an antitrust investigation to an end” and that an investigation will last as long as it needs to, “depend[ing] on a number of factors.” In other words, while this is a major milestone in Apple’s App Store antitrust saga, it’s far, far, far from being over.

Source: EU Charges Apple With Antitrust Violations in Spotify Case

I have been talking about ending the monopoly stranglehold big tech has been excersising since early 2019 so it’s good to see the end of this is all coming together finally

ENVG-B – latest iteration of night vision goggles offer augmented reality, stereo vision, white lines

Posted on by

The ENVG-B is a helmet-mounted, dual-waveband goggle with industry-leading, fused white phosphor and thermal technologies.

[…]

Flexible 40 Field-Of-View with options of white-hot, black-hot and outline modes

[…]

Augmented Reality

Soldiers keep eyes on target without having to look down to read maps or check radios for critical information.

High-resolution goggle display

Data display includes waypoints, Blue Force tracking and battlespace imagery

Intel is shared real time, up and down echelon

Rapid Target Acquisition

Soldiers can bring weapon’s sight images into their goggle.

Soldiers can see around corners without risk of exposure

Allows soldiers to identify, assess and engage targets with greater accuracy and speed

Proven clarity even in degraded battlefield conditions

[…]

Primary use as binocular with monocular option to provide dominant or non-dominant eye relief.

Simple rotation of lens into stow position changes monocular to binocular visioning

Advanced design includes low-profile stow position against helmet

Twin-tube design provides in-field protection from failure or damage

Source: ENVG-B

Covid-19 Vaccine Crisis Shows Intellectual Property Dangers

Posted on by

Virologist and medical researcher Jonas Salk developed a successful polio vaccine that was approved in 1955, helping the world all but eradicate the disease.

When the late journalist Edward Murrow asked Salk who owned that vaccine’s patent, he famously responded, “Could you patent the sun?” It was in large part his commitment to keeping the jab’s recipe open-source that vaccines were produced globally and millions around the world were able to get it.

As the covid-19 health crisis unfolds, multinational pharmaceutical corporations like Moderna and Pfizer have taken a different approach. Their tight hold on the technology for their covid-19 vaccines has made them billions of dollars. While these strict intellectual property laws protections have allowed the rich to get even richer, they’ve put a damper on efforts to manufacture vaccines at scale. And with supply limited, the U.S. and other rich nations have engaged in bilateral negotiations with pharmaceutical corporations and hoarded all the doses they can, leaving poor nations in the dust.

The loss of life and suffering sparked by these strict patent protections are a major warning sign for our climate future. To avert environmental catastrophe, everyone needs access to clean energy. Intellectual property law could get in the way of that. And in the end, we could all suffer the consequences of a clean energy apartheid.

[…]

At its general council meeting next week, the World Trade Organization has the opportunity to help staunch the spread of covid-19 by waiving some protections on covid-19 vaccines developed by Moderna and Pfizer under the Trade-Related Aspects of Intellectual Property Rights Agreement. More than 100 nations, including India, have urged it to do. The Biden administration is reportedly considering endorsing this move, though then again, it’s been reportedly “considering” it for months.

This isn’t just something World Trade Organization negotiators should do out of the goodness of their hearts—though it absolutely is that, assuming they have hearts. Failing to do so could result in variants that bypass vaccines, which could harm those lucky enough to have gotten the shot and send the world economy back into a tailspin.

“As the pandemic ravages the Global South, what are wealthy northern countries going to do? Just completely ban all contact with poorer countries? It won’t work,” said Basav Sen, climate justice project director at the Institute for Policy Studies. “It is extremely short-sighted to push this kind of logic of intellectual property and corporate profit over what is clearly a prominent threat for all of humanity.”

[…]

Source: Covid-19 Vaccine Crisis Shows Intellectual Property Dangers

Florida Keys Mosquito Control District and Oxitec Announce Site Participation for Florida Keys Pilot Project to Combat Disease Transmitting Mosquito Type

Posted on by

The Florida Keys Mosquito Control District and Oxitec Ltd today announced location participation plans for its landmark Florida Keys pilot project. Project managers anticipate that during the last week of April and first week of May release boxes, non-release boxes and netted quality control boxes will be placed in six locations: two on Cudjoe Key, one on Ramrod Key and three on Vaca Key. Throughout all release locations less than 12,000 mosquitoes are expected to emerge each week for approximately 12 weeks. Untreated comparison sites will be monitored with mosquito traps on Key Colony Beach, Little Torch Key, and Summerland Key.

This marks the start of the US EPA approved project to evaluate this safe, sustainable and environmentally-friendly solution to control the invasive Aedes aegypti mosquito species.

Oxitec’s non-biting male mosquitoes will emerge from the boxes to mate with the local biting female mosquitoes. The female offspring of these encounters cannot survive, and the population of Aedes aegypti is subsequently controlled.

The Aedes aegypti mosquito makes up about four percent of the mosquito population in the Keys but is responsible for virtually all mosquito-borne diseases transmitted to humans. This species of mosquito transmits dengue, Zika, yellow fever and other human diseases, and can transmit heartworm and other potentially deadly diseases to pets and animals.

Source: Florida Keys Mosquito Control District and Oxitec Announce Site Participation for Florida Keys Pilot Project to Combat Disease Transmitting Mosquito — Oxitec

There’s a lot of fear mongering on this one, based on some outright lies and old facts, eg using an old nature article that has since been rescinded, inflating massively the number of mosquitos to be released, saying people aren’t told where the mosquitos will be released (they do tell people, just read above), etc etc. I’m sure that maybe some of their fears are legitimate but throwing in all of this bullshit really weakens their case and makes me too bored to find the hidden gem in the codswallop after I keep factchecking and finding out that the fearmongers are lying yet again.

One-Third of Basecamp Employees Have Reportedly Quit at Once after being told they can’t talk about politics

Posted on by

Within a week, Basecamp’s loathed no-politics-at-work rule has escalated to a mass exodus. This afternoon, reporter Casey Newton tweeted that around one-third of the company’s employees accepted buyouts following a “contentious all-hands meeting.” The software company behind Ruby on Rails, Campfire, and HEY was, until this week or so, generally perceived by outsiders as one of the good ones.

The stir came out of left field on Tuesday, when co-founder and CEO Jason Fried announced a ban on “societal and political discussions” within the company Basecamp account. The move depressingly aligned with similar internal policies at companies like Google and Amazon, who’ve also lost all semblance of moral superiority.

[…]

Source: One-Third of Basecamp Employees Have Reportedly Quit at Once

Microsoft shakes up PC gaming by reducing Windows store cut to “just” 12 percent

Posted on by

Microsoft is shaking up the world of PC gaming today with a big cut to the amount of revenue it takes from games on Windows. The software giant is reducing its cut from 30 percent to just 12 percent from August 1st, in a clear bid to compete with Steam and entice developers and studios to bring more PC games to its Microsoft Store.

“Game developers are at the heart of bringing great games to our players, and we want them to find success on our platforms,” says Matt Booty, head of Xbox Game Studios at Microsoft. “A clear, no-strings-attached revenue share means developers can bring more games to more players and find greater commercial success from doing so.”

These changes will only affect PC games and not Xbox console games in Microsoft’s store. While Microsoft hasn’t explained why it’s not reducing the 30 percent it takes on Xbox game sales, it’s likely because the console business model is entirely different to PC. Microsoft, Sony, and Nintendo subsidize hardware to make consoles more affordable, and offer marketing deals in return for a 30 percent cut on software sales.

Microsoft’s new reduction on the PC side is significant, and it matches the same revenue split that Epic Games offers PC game developers while also putting more pressure on Valve to reduce its Steam store cut. Valve still takes a 30 percent cut on sales in its Steam store, which is reduced to 25 percent when sales hit $10 million, and then 20 percent for every sale after $50 million.

[…]

Source: Microsoft shakes up PC gaming by reducing Windows store cut to just 12 percent – The Verge

Let’s be clear – it’s still taking 12% of everything it has put virtually no effort in to making. All it does is hold up an electronic store front on some servers. And the point the article is making: that it’s cheap compared to the seeming “industry standard” 30% shows really that there is and has been a price cartel between the tiny amount of major players in the electronic market place.

This is the kind of monopoloy I have been talking about since the beginning of 2019.

China’s Space Station Is Closer to Reality With Launch of Core Module

Posted on by

China today launched the main module of its new space station into low Earth orbit. The ambitious project is set to be China’s answer to the International Space Station, which has never included China in its membership.

The 55-foot core module is called Tianhe, or Harmony of the Heavens. It blasted off from the Wenchang Launch Center in Hainan in the wee hours of Thursday morning, late Wednesday night for the United States. It launched aboard a 190-foot-tall Long March-5b Rocket, which has been the flagship launcher of the program since 2016. This is the first of 11 launches planned to see the finished product of the Chinese Space Station in operation by late 2022.

Should all go according to plan, Tianhe is the section of the station that will actually house Chinese astronauts, for stints of up to half a year. The next launches will send up two experimental modules, which will attach to either side of Tianhe, four cargo shipments, and four crewed missions, the first of which is slated for June. Tianhe has a total of five docking ports, which could be expanded to six.

The core module is the largest spacecraft yet developed by China, according to Chinese state media. The total station weight will be around 66 tons. While a far cry from the over 450 tons the ISS was at its completion in 1998, the main goals of the space station—conducting experiments in space and exploring how properties of space affect the results—doesn’t really require a ton of room.

[…]

Source: China’s Space Station Is Closer to Reality With Launch of Core Module

Stratolaunch sends world’s biggest airplane on second test flight

Posted on by

Stratolaunch, the aerospace company founded by the late Seattle billionaire Paul Allen, put the world’s biggest airplane through its second flight test today, two years after the first flight.

“We are airborne!” Stratolaunch reported in a tweet.

Today’s takeoff from California’s Mojave Air and Space Port at 7:28 a.m. PT marked the first time the plane, nicknamed Roc after the giant bird of Arabian and Persian mythology, got off the ground since Stratolaunch’s acquisition by Cerberus Capital Management in October 2019.

Roc rose as high as 14,000 feet and traveled at a top speed of 199 mph during a flight that lasted three hours and 14 minutes — which is close to an hour longer than the first flight on April 13, 2019. During that earlier flight, the airplane reached a maximum speed of 189 mph and maximum altitude of 17,000 feet.

Zachary Krevor, Stratolaunch’s chief operating officer, said today’s flight accomplished all of its test objectives by checking the performance of improved instrumentation, a more robust flight control system and an environmental control system that allowed the pilots to work in a pressurized cockpit. Krevor said the crew included chief pilot Evan Thomas, pilot Mark Giddings and flight engineer Jake Riley.

[…]

Since Roc’s first flight in 2019, the business model for the 10-year-old venture has shifted: In its early years, Stratolaunch focused on using Roc as a flying launch pad for sending rockets and their payloads to orbit. The concept capitalizes on the air launch system pioneered by SpaceShipOne, which won financial backing from Allen and won the $10 million Ansari X Prize in 2004,

The new owners still expect to use Roc for air launch, but the current focus is on using the plane as a testbed for Stratolaunch’s hypersonic flight vehicles, Once the plane is cleared for regular operations, perhaps next year, Stratolaunch could begin launching its Talon-A prototype hypersonic plane.

[…]

Other companies, principally including Virgin Orbit, are also working on next-generation air launch technology. Such systems hold the promise of greater versatility and quicker response time for launching payloads, due to the fact that the carrier planes can take off from a wide variety of runways, fly around inclement weather and theoretically launch their payloads in any desired orbital inclination.

Stratolaunch’s twin-fuselage, six-engine Roc airplane is in a class by itself, thanks to its world-record wingspan of 385 feet. In comparison, the wingspan of the modified Boeing 747 that Virgin Orbit is using comes to 211 feet. The previous record-holder was the Spruce Goose, a prototype seaplane that made its debut in 1947 and had a 320-foot wingspan. Built by Mojave-based Scaled Composites, Roc has the capacity to carry more than 500,000 pounds of payload.

Source: Stratolaunch sends world’s biggest airplane on second test flight

F-22 And F-35 Datalinks *Finally* Talk Freely With Each Other Thanks To A U-2 Flying Translator

Posted on by

Five F-35A Joint Strike Fighters and a single F-22 Raptor “talked” with each other using their proprietary stealthy datalinks via a U-2S Dragon Lady spy plane carrying a specialized communications gateway payload, during a recent demonstration. This marks the first time that the Air Force’s two stealth fighters were able to exchange data freely in flight, something that has been years in the making. The U-2 was also able to simultaneously share information with assets on the ground and at sea, as well as with non-stealthy combat aircraft, all in near-real-time. That info was used to initiate strikes from ground-based artillery and naval assets as part of the high-stakes capability demonstration.

This demonstration event was known as Project Hydra. The company’s Skunk Works advanced projects division worked together with the Air Force and the Missile Defense Agency (MDA) to carry out the tests. Elements of the U.S. Army and U.S. Navy were also involved.

[…]

Source: F-22 And F-35 Datalinks Finally Talk Freely With Each Other Thanks To A U-2 Flying Translator

It only took 10 years or so. For a military so entrenched in netcentric engagement to have their premier aviation assets not be able to communicate at all for so long is a major embarrassment. That they can only do it using a U2 within range is pretty weak.

Superspreaders of Malign and Subversive Information on COVID-19: Russian and Chinese Efforts Targeting the United States

Posted on by

Both Russia and China appear to have employed information manipulation during the COVID-19 pandemic in service to their respective global agendas. This report uses exploratory qualitative analysis to systematically describe the types of COVID-19-related malign and subversive information efforts with which Russia- and China-associated outlets appear to have targeted U.S. audiences from January 2020 to July 2020 and organizes them into a framework. This work lays the foundation for a better understanding of how and whether Russia and China might act and coordinate in the domain of malign and subversive information efforts in the future.

[..]

Key Findings

  • Both countries disseminated messages through a wide variety of channels and platforms, including social media.
  • Both countries attempted to tarnish the reputation of the United States by emphasizing challenges with its pandemic response and characterizing U.S. systems as inadequate.
  • Both countries falsely accused the United States of developing and intentionally spreading the virus.
  • The two countries appeared to differ in their principal goals for COVID-19-related information efforts: Russia aimed to destabilize the United States; China aimed to protect and enhance its own international reputation.
  • Both countries modified their COVID-19-related messaging over time, focusing on conspiracy theories about the virus’s origins and impacts from March 2020 to April 2020 and later moving to concentrate on perceived U.S. failure in responding to the pandemic.
  • While Russia deployed media with wide-ranging ideologies and a variety of audiences, China-linked messaging was ideologically uniform, consistent across multiple information outlets, and appeared to target audiences that were less varied.
  • Countering apparent Russian and Chinese malign and subversive information efforts will require campaigns that consider the capabilities and thematic emphasis of each of these actors.
  • Profiling Russian and Chinese sources known to frequently create and disseminate disinformation and propaganda can also inform counter-messaging efforts.
  • China and Russia appear to amplify one another’s messages, when opportune. This might eventually lead to some collaboration, albeit limited in nature.
  • Public health messaging should account for potential impacts of Russian and Chinese messaging on vaccination uptake

Source: Superspreaders of Malign and Subversive Information on COVID-19: Russian and Chinese Efforts Targeting the United States | RAND

Tesla Loses A Lot Of Money Selling Cars, But Makes It All Back On Credits And Bitcoin

Posted on by

On Monday after the close of business, Tesla announced its Q1 2021 financial results in its quarterly earnings call. The company turned a surprisingly large profit this quarter, but it didn’t do it by selling cars. Q1 net profit reached a new record for Tesla, at $438 million. Revenue for the electric car company was up massively to $10.39 billion. Unfortunately, all of that profit is accounted for in the company selling $518 million in regulatory credits, and $101 million was found in buying and then later selling Bitcoin.

That second point is particularly interesting, as Tesla purchased $1.5 billion worth of BTC, announced that the company would begin accepting BTC as payment for its cars, which drove up the value of BTC, then sold enough BTC to make a hundred million in profit. Strange how that works, eh? Surely nothing untoward going on there. Not at all. DOGE TO THE MOON! #hodlgang

Without the $619 million in credits and BTC sales, Tesla would have actually managed to lose $181 million in Q1. In that time, the company shifted 184,800 3/Y units, and while it didn’t build a single X or S in Q1, it sold 2020 units from previously-built inventory. That means the company lost around $970 per car sold in Q1.

[…]

Source: Tesla Loses A Lot Of Money Selling Cars, But Makes It All Back On Credits And Bitcoin

Court Chides F.B.I., but Re-Approves Warrantless Surveillance Program

Posted on by

For a second year, the nation’s surveillance court has pointed with concern to “widespread violations” by the F.B.I. of rules intended to protect Americans’ privacy when analysts search emails gathered without a warrant — but still signed off on another year of the program, a newly declassified ruling shows.

In a 67-page ruling issued in November and made public on Monday, James E. Boasberg, the presiding judge on the Foreign Intelligence Surveillance Court, recounted several episodes uncovered by an F.B.I. audit where the bureau’s analysts improperly searched for Americans’ information in emails that the National Security Agency collected without warrants.

Rather than a new problem, however, those instances appeared largely to be additional examples of an issue that was already brought to light in a December 2019 ruling by Judge Boasberg. The government made it public in September.

The F.B.I. has already sought to address the problem by rolling out new system safeguards and additional training, although the coronavirus pandemic has hindered the bureau’s ability to assess how well they are working. Still, Judge Boasberg said he was willing to issue a legally required certification for the National Security Agency’s warrantless surveillance program to operate for another year.

“While the court is concerned about the apparent widespread violations of the querying standard,” Judge Boasberg wrote, “it lacks sufficient information at this time to assess the adequacy of the F.B.I. system changes and training, post-implementation.”

Because of that, he added, the court concluded that “the F.B.I.’s querying and minimization procedures meet statutory and Fourth Amendment requirements.”

[…]

Source: Court Chides F.B.I., but Re-Approves Warrantless Surveillance Program – The New York Times

Responsible Space Behavior for the New Space Era: Preserving the Province of Humanity

Posted on by

Humans have explored and exploited near-earth space for more than six decades. More recently, the past two decades have seen the start of a New Space Era, characterized by more spacefaring nations and companies and a growing risk of collisions and conflict. Yet the basic treaties and mechanisms that were crafted 50 years ago to govern space activities have only marginally changed.

The calls for more progress on space governance and responsible space behavior are growing louder and coming from a larger group. To help address the gap between current space governance and future needs, the authors of this Perspective summarize the development of space governance and key problem areas, identify challenges and barriers to further progress, and, most importantly, offer recommended first steps on a trajectory toward responsible space behavior norms appropriate for the New Space Era. The authors used a review of relevant literature and official documents, expert workshops, and subject-matter expert interviews and discussions to identify these challenges, barriers, and potential solutions.

Source: Responsible Space Behavior for the New Space Era: Preserving the Province of Humanity | RAND

In 2008 there were 10k objects circling our planet. Now we have 20k. Especially with mr Musk sending up huge amounts of only partially working satellites in his Starlink program we need better agreements on how we use this incredibly congested area above us. For a visualisation of how bad it is, take a look at stuffin.space.

Google Is Saving Over $1 Billion a Year by Working From Home

Posted on by

During the first quarter, Google parent Alphabet Inc. saved $268 million in expenses from company promotions, travel and entertainment, compared to same period a year earlier, “primarily as a result of COVID-19,” according to a company filing.

On an annualized basis, that would be more than $1 billion. Indeed, Alphabet said in its annual report earlier this year that advertising and promotional expenses dropped by $1.4 billion in 2020 as the company reduced spending, paused or rescheduled campaigns, and changed some events to digital-only formats due to the pandemic. Travel and entertainment expenses fell by $371 million.

The savings offset many of the costs that came with hiring thousands more workers. And the pandemic prudence allowed the company to keep its marketing and administrative costs effectively flat for the first quarter, despite boosting revenue by 34%.

[…]

Google is notorious for perks such as massage tables, catered cuisine and corporate retreats, which have influenced much of Silicon Valley work culture. Most Google staff have worked remotely and without those perks since March of 2020.

[…]

Source: Google Is Saving Over $1 Billion a Year by Working From Home – Bloomberg

Satellites show world’s glaciers melting much faster than ever

Posted on by

Glaciers are melting faster, losing 31 percent more snow and ice per year than they did 15 years earlier, according to three-dimensional satellite measurements of all the world’s mountain glaciers.

[…]

Using 20 years of recently declassified satellite data, scientists calculated that the world’s 220,000 mountain glaciers are losing more than 328 billion tons (298 billion metric tons) of ice and snow per year since 2015, according to a study in Wednesday’s journal Nature. That’s enough melt flowing into the world’s rising oceans to put Switzerland under almost 24 feet (7.2 meters) of water each year.

The annual melt rate from 2015 to 2019 is 78 billion more tons (71 billion metric tons) a year than it was from 2000 to 2004. Global thinning rates, different than volume of water lost, doubled in the last 20 years

[…]

Almost all the world’s glaciers are melting, even ones in Tibet that used to be stable, the study found. Except for a few in Iceland and Scandinavia that are fed by increased precipitation, the melt rates are accelerating around the world.

[…]

Source: Satellites show world’s glaciers melting faster than ever

Fraudulent orders via Afterpay stupidly easy. To resolve Afterpay wants to breach victims privacy, cost them lots of time.

Posted on by

Online shoppen en de rekening naar iemand anders sturen, blijkt kinderlijk eenvoudig met Afterpay. Dat constateert de Consumentenbond, die de beveiliging van de achterafbetaaldienst heeft onderzocht.

Honderden consumenten kregen spookfacturen van Afterpay en Klarna, betaaldiensten waarmee consumenten online aankopen pas na ontvangst hoeven te betalen. De bedragen varieren van enkele tientjes tot honderden euro’s.

Met een simpele truc bestelt de oplichter online op naam en adres van een ander. Vervolgens laat hij het pakket naar een ander afleveradres sturen, het zijne. Als Afterpay na een maand nog geen betaling heeft ontvangen, stuurt het een herinnering naar het opgegeven factuuradres.

Het bedrijf zegt dat het zijn fraudebestrijding op orde heeft. Consumenten die een onterechte rekening kregen kunnen aangifte doen bij de politie.

‘Het slachtoffer moet zijn onschuld bewijzen, terwijl het lek bij Afterpay zit,’ zegt de Consumentenbond. ‘Ook vragen een aangifte aan te leveren is niet in de haak. Afterpay vraagt zo persoonsgegevens af te staan, die notabene al een keer zijn misbruikt. We hebben de Autoriteit Persoonsgegevens hierover geïnformeerd, want we betwijfelen of dit volgens de regels is.’

Source: ‘Bestelfraude via Afterpay kinderlijk eenvoudig’ – Emerce

Study finds GAEN Google Apple contact tracing apps allow user + contact location tracking. NL stops use of tracking app.

Posted on by

A study describes the data transmitted to backend servers by the Google/Apple based contact tracing (GAEN) apps in use in Germany, Italy, Switzerland, Austria, and Denmark and finds that the health authority client apps are generally well-behaved from a privacy point of view, although the Irish, Polish, Danish, and Latvian apps could be improved in this respect. However, the study also finds that the Google Play Services component of the apps contacts Google servers as often as every 20 minutes, potentially enabling fine-grained location tracking. Google Play Services, which users cannot turn off if they want to use the contact tracing app, also shares numerous details – serial numbers of SIM cards and hardware, phone IMEI, MAC address, and user email address with Google, along with fine-grained information about other apps running on the phone. While data protection impact assessments have been carried out for the health authority client app components, they have not been made public for the GAEN component.

Source: https://www.scss.tcd.ie/Doug.Leith/pubs/contact_tracing_app_traffic.pdf

Source: Study finds gaps in GAEN contact tracing apps privacy protection | Privacy International

De CoronaMelder-app stuurt tijdelijk geen waarschuwingen van mogelijke besmettingen naar andere gebruikers vanwege privacyproblemen.

Het stopzetten van de meldingen heeft te maken met het onveilig opslaan van de codes van CoronaMelder op Android-telefoons. Met het stopzetten wordt voorkomen dat gebruikers van de app in Nederland gekoppeld kunnen worden aan gegevens die toegankelijk zijn voor derden via het systeem van Google.

CoronaMelder maakt gebruik van het Google Apple Exposure Notification (GAEN) framework om ontmoetingen te detecteren. Het framework maakt gebruik van steeds wisselende willekeurige codes die worden uitgewisseld wanneer twee telefoons dichtbij elkaar zijn. Zo kan worden vastgesteld of iemand in contact is geweest met iemand die achteraf besmet bleek. Dit is een privacyvriendelijke manier om ontmoetingen bij te houden.

Derden zouden deze codes niet moeten kunnen verzamelen en inzien. Op telefoons die gebruik maken van Google Android is dit wel mogelijk. Apps die meegeleverd werden met een telefoon konden vaststellen of de telefoon in bezit is van iemand die eerder als besmet is gemeld in CoronaMelder en welke ontmoetingen met besmette personen hebben plaatsgevonden.

Woensdag gaf Google aan het probleem te hebben verholpen. Om hier zeker van te zijn worden de komende 48 uur geen codes van Nederlandse gebruikers van CoronaMelder die zich besmet hebben gemeld gedeeld met andere gebruikers van CoronaMelder. Deze tijd wordt gebruikt om te onderzoeken of Google het lek daadwerkelijk heeft gedicht.

Source: Temporary stop NL Corona Tracing App due to privacy problems (Dutch) | Emerce

Google used ‘double-Irish’ to shift $75.4bn in profits out of Ireland

Posted on by

Google shifted more than $75.4 billion (€63 billion) in profits out of the Republic using the controversial “double-Irish” tax arrangement in 2019, the last year in which it used the loophole.

The technology giant availed of the tax arrangement to move the money out of Google Ireland Holdings Unlimited Company via interim dividends and other payments. This company was incorporated in Ireland but tax domiciled in Bermuda at the time of the transfer.

The move allowed Google Ireland Holdings to escape corporation tax both in the Republic and in the United States where its ultimate parent, Alphabet, is headquartered. The holding company reported a $13 billion pretax profit for 2019, which was effectively tax-free, the accounts show.

A year earlier, Google Ireland Holdings paid out dividends of €23 billion, having recorded turnover of $25.7 billion.

Google has used the double Irish loophole to funnel billions in global profits through Ireland and on to Bermuda, effectively putting them beyond the reach of US tax authorities.

Companies exploiting the double Irish put their intellectual property into an Irish-registered company that is controlled from a tax haven such as Bermuda.

Ireland considers the company to be tax-resident in Bermuda, while the US considers it to be tax-resident here. The result is that when royalty payments are sent to the company, they go untaxed – unless or until the money is eventually sent home to the US parent.

The “double Irish” was abolished in 2015 for new companies establishing operations in the Republic. However, controversially, it allowed those already using it until the end of 2020 to phase it out.

Google overhauled its global tax structure and consolidated its intellectual property holdings back to the United States in early 2020, meaning 2019 was the final year in which it availed of the arrangement.

Up to late 2019, Google Ireland Holdings Unlimited Company was an intellectual property licensing company with turnover derived from the licensing of IP to subsidiaries. The accounts state it had no employees and that it was tax resident at the time in Bermuda, where the “standard rate tax is 0 per cent”.

[…]

Source: Google used ‘double-Irish’ to shift $75.4bn in profits out of Ireland

Parker Solar Probe Captures View of Venus’s Orbital Dust Ring

Posted on by

A band of dust that follows Venus along its entire orbital path has finally been viewed in full, thanks to a series of fortuitous maneuvers involving NASA’s Parker Solar Probe.

Astronomers suspected it was there, but now we know it’s real: a band of particles distributed along Venus’s orbital path around the Sun.

[…]

A paper detailing this discovery now appears in The Astrophysical Journal.

Combined images from WISPR, revealing Mercury, Venus, Earth and part of the Milky Way galaxy. The dust ring perfectly aligns with Venus’s orbit, as shown by the red dots.
Combined images from WISPR, revealing Mercury, Venus, Earth and part of the Milky Way galaxy. The dust ring perfectly aligns with Venus’s orbit, as shown by the red dots.
Image: Stenborg et al.

To date, the Parker Solar Probe has completed seven orbits around the Sun. Equipped with its Wide-field Imager for Solar Probe (WISPR)—a pair of visible light telescopes—the spacecraft has been analyzing the Sun’s corona and solar wind. That’s the probe’s primary focus, but mission planners had also planned on using WISPR to study the presumed dust ring.

[…]

, the dust within this circumsolar ring is approximately 10% denser than the dust in outlying areas. The tiny particles that make up this ring are likely leftovers from the formation of the solar system and/or debris from colliding asteroids and disintegrating comets,

[…]

Source: Parker Solar Probe Captures View of Venus’s Orbital Dust Ring

WordPress may automatically disable Google FLoC on websites

Posted on by

WordPress announced today that they are treating Google’s new FLoC tracking technology as a security concern and may block it by default on WordPress sites.

For some time, browsers have begun to increasingly block third-party browser cookies [1, 2, 3] used by advertisers for interest-based advertising.

In response, Google introduced a new ad tracking technology called Federated Learning of Cohorts, or FLoC, that uses a web browser to anonymously place users into interest or behavioral buckets based on how they browse the web.

After Google began testing FLoC this month in Google Chrome, there has been a consensus among privacy advocates that Google’s FLoC implementation just replaces one privacy risk with another one.

[…]

“WordPress powers approximately 41% of the web – and this community can help combat racism, sexism, anti-LGBTQ+ discrimination and discrimination against those with mental illness with four lines of code,” says WordPress.

WordPress plans to disable FLoC using the following four lines of code, which will cause the blogging platform to issue a HTTP request header tells the browser that FLoC should be disabled for the site.

function disable_floc($headers) {
    $headers['Permissions-Policy'] = 'interest-cohort=()';
    return $headers;
  }
 
add_filter('wp_headers', 'disable_floc');

WordPress explains that though some admins will likely want to enable this technology, those admins probably have the tech know-how to override the above code. WordPress also indicated that they might add a setting that allows admins to control whether FLoC is permitted.

However, WordPress’s concern is that those unaware of this new tracking technology will automatically opt into it without fully understanding what it entails. Therefore, it is in these users’ best interest for WordPress to automatically disable the technology.

[…]

Source: WordPress may automatically disable Google FLoC on websites

Let’s hope they implement this, but if not, then at least we know how to implement it ourselves.

NASA / JPL honours open source devs with a badge on their github if their code made it to Mars

Posted on by

[…]

we have worked with JPL to place a new Mars 2020 Helicopter Mission badge on the GitHub profile of every developer who contributed to the specific versions of any open source projects and libraries used by Ingenuity. You can check out the full list of projects like SciPy, Linux, and F Prime (F’) that were used by the JPL team here.

[…]

We are also using this opportunity to introduce a new Achievements section to the GitHub profile. Right now, Achievements include the Mars 2020 Helicopter Mission badge, the Arctic Code Vault badge, and a badge for sponsoring open source work via GitHub Sponsors. Watch this space!

Read the story behind the new badge and how open source contributors helped Ingenuity take flight on The ReadME Project.

Congratulations to the teams at NASA and JPL, and to the thousands of developers who made today’s first Martian flight possible. We’re all still here on Earth, but your code is now on Mars!

Source: Open source goes to Mars 🚀 – The GitHub Blog

As FOSS is hugely powered by recognition, this looks like an awesome step to recognise individual developers as well as projects.