The Linkielist

Linking ideas with the world

The Linkielist

Firefox to block Backspace key from working as “Back” button

Mozilla developers plan to remove support for using the Backspace key as a Back button inside Firefox.The change is currently active in the Firefox Nightly version and is expected to go live in Firefox 86, scheduled to be released next month, in late February 2021.ZDNet RecommendsThe best free video streaming servicesThe best free video streaming servicesIs money tight? Have you binge-watched everything on Netflix that you ever wanted to see? Here are ways to find new-to-you, great movies plus TV shows for free.Read MoreThe removal of the Backspace key as a navigational element didn’t come out of the blue. It was first proposed back in July 2014, in a bug report opened on Mozilla’s bug tracker.At the time, Mozilla engineers argued that many users who press the Backspace key don’t always mean to navigate to the previous page (the equivalent of pressing the Back button).”Pressing backspace does different things depending on where the cursor is. If it’s in a text input field, it deletes the character to the left. If it’s not in a text input field, it’s the same as hitting the back button,” said Blair McBride, a senior software engineer for Mozilla at the time.”Whether to keep this behaviour has been argued For A Very Long Time,” McBride said. “It’s confusing for many people, but we’ve assumed it would break muscle memory for many people.”Back in 2014, McBride asked other Mozilla engineers to gather data and see exactly how many people press this key before taking a decision.Subsequent data showed that the Backspace key is, by far, the most pressed keyboard shortcut inside the Firefox user interface, with 40 million monthly active users pressing the key and triggering a “Back” navigation.To put it in perspective, this was well above the 16 million Firefox users pressing the CTRL+F shortcut to search content inside a page and 15 million Firefox users who pressed the page reload shortcuts (F5 and CTRL+R).

Source: Firefox to block Backspace key from working as “Back” button | ZDNet

Every Deleted Parler Post, Many With Users’ Location Data, Has Been Archived. Parler goes down. Still can’t export your Whatsapp history.

In the wake of the violent insurrection at the U.S. Capitol by scores of President Trump’s supporters, a lone researcher began an effort to catalogue the posts of social media users across Parler, a platform founded to provide conservative users a safe haven for uninhibited “free speech” — but which ultimately devolved into a hotbed of far-right conspiracy theories, unchecked racism, and death threats aimed at prominent politicians.

The researcher, who asked to be referred to by her Twitter handle, @donk_enby, began with the goal of archiving every post from January 6, the day of the Capitol riot; what she called a bevy of “very incriminating” evidence. According to the Atlantic Council’s Digital Forensic Research Lab, among other sources, Parler is one of a several apps used by the insurrections to coordinate their breach of the Capitol, in a plan to overturn the 2020 election results and keep Donald Trump in power.

Five people died in the attempt.

Hoping to create a lasting public record for future researchers to sift through, @donk_enby began by archiving the posts from that day. The scope of the project quickly broadened, however, as it became increasingly clear that Parler was on borrowed time. Apple and Google announced that Parler would be removed from their app stores because it had failed to properly moderate posts that encouraged violence and crime. The final nail in the coffin came Saturday when Amazon announced it was pulling Parler’s plug.

In an email first obtained by BuzzFeed News, Amazon officials told the company they planned to boot it from its clouding hosting service, Amazon Web Services, saying it had witnessed a “steady increase” in violent content across the platform. “It’s clear that Parler does not have an effective process to comply with the AWS terms of service,” the email read.

Operating on little sleep, @donk_enby began the work of archiving all of Parler’s posts, ultimately capturing around 99.9 percent of its content. In a tweet early Sunday, @donk_enby said she was crawling some 1.1 million Parler video URLs. “These are the original, unprocessed, raw files as uploaded to Parler with all associated metadata,” she said. Included in this data tranche, now more than 56 terabytes in size, @donk_enby confirmed that the raw video files include GPS metadata pointing to exact locations of where the videos were taken.

@donk_enby later shared a screenshot showing the GPS position of a particular video, with coordinates in latitude and longitude.

The privacy implications are obvious, but the copious data may also serve as a fertile hunting ground for law enforcement. Federal and local authorities have arrested dozens of suspects in recent days accused of taking part in the Capitol riot, where a Capitol police officer, Brian Sicknick, was fatally wounded after being struck in the head with a fire extinguisher.

[…]

Kirtaner, creator of 420chan — a.k.a. Aubrey Cottle — reported obtaining 6.3 GB of Parler user data from an unsecured AWS server in November. The leak reportedly contained passwords, photos and email addresses from several other companies as well. Parler CEO John Matze later claimed to Business Insider that the data contained only “public information” about users, which had been improperly stored by an email vendor whose contract was subsequently terminated over the leak. (This leak is separate from the debunked claim that Parler was “hacked” in late November, proof of which was determined to be fake.)

In December, Twitter suspended Kirtaner for tweeting, “I’m killing Parler and its fucking glorious,” citing its rules against threatening “violence against an individual or group of people.” Kirtaner’s account remains suspended despite an online campaign urging Twitter’s safety team to reverse its decision. Gregg Housh, an internet activist involved in many early Anonymous campaigns, noted online that the tweet was “not aimed at a person and [was] not actually violent.”

Source: Every Deleted Parler Post, Many With Users’ Location Data, Has Been Archived

Ubiquiti iniquity: Wi-Fi box slinger warns hackers may have peeked at customers’ personal information

Networking vendor Ubiquiti has written to its customers to advise them of a possible leak of their personal information.

“We recently became aware of unauthorized access to certain of our information technology systems hosted by a third-party cloud provider,” the email opens, before adding: “We have no indication that there has been unauthorized activity with respect to any user’s account.”

But the mail, seen by The Reg and sent out within the past few hours, also says Ubiquiti “cannot be certain that user data has not been exposed,” and admits that if the unauthorized actors did get in, they’ll have been able to access users’ “name, email address, and the one-way encrypted password to your account (in technical terms, the passwords are hashed and salted).”

Customers who stored their physical address and phone number in their account were advised that data may also have been accessed.

“As a precaution, we encourage you to change your password,” the mail states, adding that two-factor authentication is a very fine idea that customers should enable ASAP on their online accounts if it’s not already employed. A warning about password re-use across multiple sites is also offered.

[…]

Source: Ubiquiti iniquity: Wi-Fi box slinger warns hackers may have peeked at customers’ personal information • The Register

Maybe now these guys will start taking security seriously. The last I looked you could get to the admin password just by telnetting into the boxes password free.

ODoH: Cloudflare and Apple design a new privacy-friendly internet protocol for DNS

Engineers at Cloudflare and Apple say they’ve developed a new internet protocol that will shore up one of the biggest holes in internet privacy that many don’t know even exists. Dubbed Oblivious DNS-over-HTTPS, or ODoH for short, the new protocol makes it far more difficult for internet providers to know which websites you visit.

But first, a little bit about how the internet works.

Every time you go to visit a website, your browser uses a DNS resolver to convert web addresses to machine-readable IP addresses to locate where a web page is located on the internet. But this process is not encrypted, meaning that every time you load a website the DNS query is sent in the clear. That means the DNS resolver — which might be your internet provider unless you’ve changed it — knows which websites you visit. That’s not great for your privacy, especially since your internet provider can also sell your browsing history to advertisers.

Recent developments like DNS-over-HTTPS (or DoH) have added encryption to DNS queries, making it harder for attackers to hijack DNS queries and point victims to malicious websites instead of the real website you wanted to visit. But that still doesn’t stop the DNS resolvers from seeing which website you’re trying to visit.

Enter ODoH, which builds on previous work by Princeton academics. In simple terms, ODoH decouples DNS queries from the internet user, preventing the DNS resolver from knowing which sites you visit.

Here’s how it works: ODoH wraps a layer of encryption around the DNS query and passes it through a proxy server, which acts as a go-between the internet user and the website they want to visit. Because the DNS query is encrypted, the proxy can’t see what’s inside, but acts as a shield to prevent the DNS resolver from seeing who sent the query to begin with.

“What ODoH is meant to do is separate the information about who is making the query and what the query is,” said Nick Sullivan, Cloudflare’s head of research.

In other words, ODoH ensures that only the proxy knows the identity of the internet user and that the DNS resolver only knows the website being requested. Sullivan said that page loading times on ODoH are “practically indistinguishable” from DoH and shouldn’t cause any significant changes to browsing speed.

A key component of ODoH working properly is ensuring that the proxy and the DNS resolver never “collude,” in that the two are never controlled by the same entity, otherwise the “separation of knowledge is broken,” Sullivan said. That means having to rely on companies offering to run proxies.

Sullivan said a few partner organizations are already running proxies, allowing for early adopters to begin using the technology through Cloudflare’s existing 1.1.1.1 DNS resolver. But most will have to wait until ODoH is baked into browsers and operating systems before it can be used. That could take months or years, depending on how long it takes for ODoH to be certified as a standard by the Internet Engineering Task Force.

Source: Cloudflare and Apple design a new privacy-friendly internet protocol | TechCrunch

Light Commands: Hacking Voice Assistants with Lasers / Light Commands: Laser-Based Audio Injection Attacks on Voice-Controllable

Our laser-based injection attack Light Commands shows how microphones can respond to light as if it was sound. By simply modulating the amplitude of laser light, we can inject fully inaudible and invisible commands into microphones of smart speakers, phones, and tablets, across large distances and through glass windows.

In this talk, we will show:

  1. How Light Commands works by exploiting a physical vulnerability of MEMS microphones,
  2. How it’s possible to remotely inject and execute unauthorized commands on Alexa, Portal, Google, and Siri voice assistants
  3. How the ecosystem of devices connected to these voice assistants, such as smart-locks, home switches, and even cars, fail under common security vulnerabilities (e.g. PIN bruteforcing) that make the attack more dangerous

Source: Light Commands: Hacking Voice Assistants with Lasers – Black Hat Europe 2020 | Briefings Schedule

Turn a Touch Interface Touchless with Intel RealSense TCS

Today, Intel announced Intel® RealSense™ Touchless Control Software (TCS), a simple solution for converting a touch-based kiosk or digital sign into a safer, touchless one while maintaining a familiar and intuitive user experience. With the pandemic affecting people worldwide, pay and check-in stations, automated teller machines and ordering kiosks could use the Intel RealSense software and camera to offer safer, touch-free options.

Source: Turn a Touch Interface Touchless with Intel RealSense TCS | Intel Newsroom

Content Moderation Case Study: SoundCloud Combats Piracy By Giving Universal Music The Power To Remove Uploads (2014)

n most cases, allegedly infringing content is removed at the request of rights holders following the normal DMCA takedown process. A DMCA notice is issued and the site responds by removing the content and — in some cases — allowing the uploader to challenge the takedown.

SoundCloud has positioned itself as a host of user-created audio content, relying on content creators to upload original works. But, like any content hosting site, it often found itself hosting infringing content not created by the uploader.

Realizing the potential for SoundCloud to be overrun with infringing content, the platform became far more proactive as it gained users and funding.

Rather than allow the normal DMCA process to work, SoundCloud allowed one major label to set the terms of engagement. This partnership resulted in Universal being able to unilaterally remove content it believed was infringing without any input from SoundCloud or use of the normal DMCA process.

One user reported his account was closed due to alleged infringement contained in his uploaded radio shows. When he attempted to dispute the removals and the threatened shuttering of his account, he was informed by the platform it was completely out of SoundCloud’s hands.

Your uploads were removed directly by Universal. This means that SoundCloud had no control over it, and they don’t tell us which part of your upload was infringing.

The control of removing content is completely with Universal. This means I can’t tell you why they removed your uploads and not others, and you would really need to ask them that question.

Unfortunately, there was no clear appeal process for disputing the takedown, leaving the user without his account or his uploads.

[…]

SoundCloud continues to allow labels like Universal to perform content removals without utilizing the DMCA process or engaging with the platform directly. Users are still on their own when it comes to content declared infringing by labels. This appears to flow directly from SoundCloud’s long-running efforts to secure licensing agreements with major labels. And that appears to flow directly from multiple threats of copyright litigation from some of the same labels SoundCloud is now partnered with

Source: Content Moderation Case Study: SoundCloud Combats Piracy By Giving Universal Music The Power To Remove Uploads (2014) | Techdirt

And having said that, DMCA is a process that is very very far from perfect and is used to bully smaller players in the market by the big boys with big lawyer pockets.

Whatsapp locks you in – you can’t export all your chats. And now it will share everything with Facebook

Yes, you can back up your database and if you’re rooted, you can find a key to it, but that will give you the chat in database form. You won’t get your pictures and videos etc. You can download them seperately though.

Yes, you can export a single chat / chatgroup, but doing that for the thousands of chats you probably have is not practically possible.

So you’re stuck. Either you share all your data with Facebook or you get rid of your chat history.

Lock down the permissions WhatsApp has – it has way too many!

WhatsApp Has Shared Your Data With Facebook since 2016, actually.

Since Facebook acquired WhatsApp in 2014, users have wondered and worried about how much data would flow between the two platforms. Many of them experienced a rude awakening this week, as a new in-app notification raises awareness about a step WhatsApp actually took to share more with Facebook back in 2016.

On Monday, WhatsApp updated its terms of use and privacy policy, primarily to expand on its practices around how WhatsApp business users can store their communications. A pop-up has been notifying users that as of February 8, the app’s privacy policy will change and they must accept the terms to keep using the app. As part of that privacy policy refresh, WhatsApp also removed a passage about opting out of sharing certain data with Facebook: “If you are an existing user, you can choose not to have your WhatsApp account information shared with Facebook to improve your Facebook ads and products experiences.”

Some media outlets and confused WhatsApp users understandably assumed that this meant WhatsApp had finally crossed a line, requiring data-sharing with no alternative. But in fact the company says that the privacy policy deletion simply reflects how WhatsApp has shared data with Facebook since 2016 for the vast majority of its now 2 billion-plus users.

When WhatsApp launched a major update to its privacy policy in August 2016, it started sharing user information and metadata with Facebook. At that time, the messaging service offered its billion existing users 30 days to opt out of at least some of the sharing. If you chose to opt out at the time, WhatsApp will continue to honor that choice. The feature is long gone from the app settings, but you can check whether you’re opted out through the “Request account info” function in Settings.

Meanwhile, the billion-plus users WhatsApp has added since 2016, along with anyone who missed that opt-out window, have had their data shared with Facebook all this time. WhatsApp emphasized to WIRED that this week’s privacy policy changes do not actually impact WhatsApp’s existing practices or behavior around sharing data with Facebook.

[…]

None of this has at any point impacted WhatsApp’s marquee feature: end-to-end encryption. Messages, photos, and other content you send and receive on WhatsApp can only be viewed on your smartphone and the devices of the people you choose to message with. WhatsApp and Facebook itself can’t access your communications.

[…]

In practice, this means that WhatsApp shares a lot of intel with Facebook, including  account information like your phone number, logs of how long and how often you use WhatsApp, information about how you interact with other users, device identifiers, and other device details like IP address, operating system, browser details, battery health information, app version, mobile network, language and time zone. Transaction and payment data, cookies, and location information are also all fair game to share with Facebook depending on the permissions you grant WhatsApp in the first place.

[…]

Source: WhatsApp Has Shared Your Data With Facebook for Years, Actually | WIRED

Boeing Reaches $2.5 Billion Settlement of U.S. Probe Into 737 MAX Crashes, has to admit a lot of wrongdoing

Boeing Co. will pay $2.5 billion to resolve a Justice Department criminal investigation and admit employees deceived aviation regulators about safety issues that led to two deadly crashes of the 737 MAX, authorities said.

The settlement, which was filed Thursday in Dallas federal court, would lift a legal cloud that has hung over the aerospace company for about two years since the fatal crashes. Federal prosecutors had been investigating the role of two Boeing employees who interacted with the Federal Aviation Administration about the design of the 737 MAX and how much pilot training would be required for the new model.

The settlement includes a nearly $244 million fine as well as almost $2.3 billion in compensation to airline customers and families of the 346 people who perished in two MAX crashes.

The plane maker was charged with one count of conspiracy to defraud the U.S. But it will avoid prosecution on that charge—allowing it to stay eligible for federal contracts—as long as it avoids legal trouble for a period of three years. The deal also calls for Boeing to comply with any ongoing investigations, including probes by foreign law-enforcement and regulatory authorities, and to beef up compliance programs, according to its settlement agreement.

[…]

Source: Boeing Reaches $2.5 Billion Settlement of U.S. Probe Into 737 MAX Crashes – WSJ

DARPA Announces Subterranean Challenge Finals: mapping out underground tunnels, caves, evil lairs by robot

After three years of development, DARPA Subterranean (SubT) Challenge teams will get the chance to compete in the Final Event being held at the Louisville Mega Cavern in Louisville, Kentucky on September 21-23, 2021.

The DARPA SubT Challenge aims to develop innovative technologies that can rapidly map, navigate, and search complex underground environments such as human-made tunnel systems, urban undergrounds, and natural cave networks. Teams compete by demonstrating how their autonomy, networking, perception, and mobility capabilities perform on either physical courses in the Systems Competition or simulated environments in the Virtual Competition. The best performing team in the Systems Competition will be awarded a $2 million prize while the best performing team in the Virtual Competition will be awarded a $750,000 prize.

Over the last two years, teams faced a series of preliminary circuit events – the Tunnel Circuit, Urban Circuit, and Cave Circuit – to demonstrate how their solutions address the unique challenges of each subdomain. Teams will now tackle competition courses that include challenge elements from all three subdomains at the same time.

“Whether it’s the systems courses that we are building inside the Mega Cavern, or the wildly varying virtual environments we’re designing in the SubT Virtual Testbed, I’m excited to see how all of the SubT Challenge competitors build on the knowledge they gained during the Circuit Events to be successful in the Final Event.” said Dr. Timothy Chung, program manager for the Subterranean Challenge in DARPA’s Tactical Technology Office.

While many competitors are already preparing for the Final Event, new teams still have an opportunity to qualify for the Systems and Virtual Competitions. In order to participate, teams must deploy autonomous robotic systems – either real or virtual – into the competition courses to map, navigate, and search for artifacts of interest. The locations of each artifact must be reported with an accuracy of at least five meters to score a point. The competition courses are intentionally designed to emulate the dangers of rescue efforts in collapsed mines, post-earthquake search and rescue in urban underground settings, and cave rescue operations for injured or lost spelunkers.

For additional information on the DARPA Subterranean Challenge, including how to compete in this September’s event, please visit www.subtchallenge.com

Source: DARPA Announces Subterranean (SubT) Challenge Final Event Site and Date

‘DALL-E’ AI generates an image out of anything you describe

with DALL-E (a portmanteau of “Wall-E” and “Dali”), an AI app that can create an image out of nearly any description. For example, if you ask for “a cat made of sushi” or a “high quality illustration of a giraffe turtle chimera,” it will deliver those things, often with startlingly good quality (and sometimes not).DALL-E can create images based on a description of its attributes, like “a pentagonal green clock,” or “a collection of glasses is sitting on a table.” In the latter example, it places both drinking and eye glasses on a table with varying degrees of success.

It can also draw and combine multiple objects and provide different points of view, including cutaways and object interiors. Unlike past text-to-image programs, it even infers details that aren’t mentioned in the description but would be required for a realistic image. For instance, with the description “a painting of a fox sitting in a field during winter,” the agent was able to determine that a shadow was needed.

“Unlike a 3D rendering engine, whose inputs must be specified unambiguously and in complete detail, DALL·E is often able to ‘fill in the blanks’ when the caption implies that the image must contain a certain detail that is not explicitly stated,” according to the OpenAI team.

'DALL-E' AI generates an image out of anything you describe

OpenAI also exploits a capability called “zero-shot reasoning.” This allows an agent to generate an answer from a description and cue without any additional training, and has been used for translation and other chores. This time, the researchers applied it to the visual domain to perform both image-to-image and text-to-image translation. In one example, it was able to generate an image of a cat from a sketch, with the cue “the exact same cat on the top as the sketch on the bottom.”

The system has numerous other talents, like understanding how telephones and other objects change over time, grasping geographic facts and landmarks and creating images in photographic, illustration and even clip-art styles.

For now, DALL-E is pretty limited. Sometimes, it delivers what you expect from the description and other times you just get some weird or crappy images. As with other AI systems, even the researchers themselves don’t understand exactly how it produces certain images due to the black box nature of the system.

Still, if developed further, DALL-E has vast potential to disrupt fields like stock photography and illustration, with all the good and bad that entails. “In the future, we plan to analyze how models like DALL·E relate to societal issues like economic impact on certain work processes and professions, the potential for bias in the model outputs, and the longer term ethical challenges implied by this technology,” the team wrote. To play with DALL-E yourself, check out OpenAI’s blog.

Source: ‘DALL-E’ AI generates an image out of anything you describe | Engadget

The Earth has been spinning faster lately

Scientists around the world have noted that the Earth has been spinning on its axis faster lately—the fastest ever recorded. Several scientists have spoken to the press about the unusual phenomenon, with some pointing out that this past year saw some of the shortest days ever recorded.

For most of the history of mankind, time has been marked by the 24-hour day/night cycle (with some alterations made for convenience as the seasons change). The cycle is governed by the speed at which the planet spins on its axis. Because of that, the length of a day has become the standard by which time is marked—each day lasts approximately 86,400 seconds. The day/night cycle is remarkably consistent despite the fact that it actually varies slightly on a regular basis.

Several decades ago, the development of atomic clocks began allowing scientists to record the passage of time in incredibly small increments, in turn, allowing for measuring the length of a given day down to the millisecond. And that has led to the discovery that the spin of the planet is actually far more variable than once thought. Since such measurements began, scientists have also found that the Earth was slowing its spin very gradually (compensated by the insertion of a leap second now and then)—until this past year, when it began spinning faster—so much so that some in the field have begun to wonder if a negative leap negative second might be needed this year, an unprecedented suggestion. Scientists also noted that this past summer, on July 19, the shortest day ever was recorded—it was 1.4602 milliseconds shorter than the standard.

Planetary scientists are not concerned about the new finding; they have learned that there are many factors that have an impact on planetary spin—including the moon’s pull, snowfall levels and mountain erosion. They also have begun wondering if might push the Earth to spin faster as the snow caps and high-altitude snows begin disappearing. Computer scientists, on the other hand, are somewhat concerned about the shifting spin speed—so much of is based on what they describe as “true time.” Adding a negative leap second could lead to problems, so some have suggested shifting the world’s clocks from solar time to atomic .

Source: The Earth has been spinning faster lately

If you’re a WhatsApp user, you’ll have to share your personal data with Facebook from next month – and no, you can’t opt out this time

WhatsApp users must agree to share their personal information with Facebook if they want to continue using the messaging service from next month, according to new terms and conditions.

“As part of the Facebook Companies, WhatsApp receives information from, and shares information with, the other Facebook Companies,” its privacy policy, updated this week, stated.

“We may use the information we receive from them, and they may use the information we share with them, to help operate, provide, improve, understand, customize, support, and market our Services and their offerings, including the Facebook Company Products.”

Yes, said information includes your personal information. Thus, in other words, WhatsApp users must allow their personal info to be shared with Facebook and its subsidiaries as and when decided by the tech giant. Presumably, this is to serve personalized advertising.

If you’re a user today, you have two choices: accept this new arrangement, or stop using the end-to-end encrypted chat app (and use something else, like Signal.) The changes are expected to take effect on February 8.

When WhatsApp was acquired by Facebook in 2014, it promised netizens that its instant-messaging app would not collect names, addresses, internet searches, or location data. CEO Jan Koum wrote in a blog post: “Above all else, I want to make sure you understand how deeply I value the principle of private communication. For me, this is very personal. I was born in Ukraine, and grew up in the USSR during the 1980s.

“One of my strongest memories from that time is a phrase I’d frequently hear when my mother was talking on the phone: ‘This is not a phone conversation; I’ll tell you in person.’ The fact that we couldn’t speak freely without the fear that our communications would be monitored by KGB is in part why we moved to the United States when I was a teenager.”

Two years later, however, that vow was eroded by, well, capitalism, and WhatsApp decided it would share its users’ information with Facebook though only if they consented. That ability to opt-out, however, will no longer be an option from next month. Koum left in 2018.

That means users who wish to keep using WhatsApp must be prepared to give up personal info such as their names, profile pictures, status updates, phone numbers, contacts lists, and IP addresses, as well as data about their mobile devices, such as model numbers, operating system versions, and network carrier details, to the mothership. If users engage with businesses via the app, order details such as shipping addresses and the amount of money spent can be passed to Facebook, too.

Source: If you’re a WhatsApp user, you’ll have to share your personal data with Facebook from next month – and no, you can’t opt out this time • The Register

These Repair Bulletins for Tesla’s Quality Problems Are Downright Embarrassing—and Serious

t’s no secret that Tesla tends to ship cars to customers with questionable fit and finish. Sometimes components don’t fit the way they should, so fake wood from Home Depot is used to ensure they do. Other times, glass roofs simply detach while driving down the highway. This time, however, it’s not a random Facebook rant or one-off tweet telling us Tesla is selling vehicles of questionable quality, it’s the National Highway Traffic Safety Administration (NHTSA), via recalls and service bulletins.

Thanks to Bozi Tatarevic on Twitter, we know about errors numerous enough to warrant a response from the NHTSA, and some of them are pretty bad. They include low-grade rust repair, fixes to bodywork using a dead-blow hammer, and missing fasteners. We’re not talking about a couple of loose lug nuts, either. We’re talking parts missing from the car’s power system that may affect battery charge and discharge, and even nuts missing in the front suspension.

NHTSA

The service bulletins are sort of humorous in their official language of very basic fixes to really obvious issues with these cars. If the “DC link busbar” bolts are missing in the Model 3, replace them! If the charging door isn’t sitting flush—this defect is present on the 3 and Y—hit the non-flush panel with a hammer until it sits right. But if you start roleplaying as the village blacksmith and take it just a tad too far, replace the entire panel. Also, if you mess up the paint when you do this, make sure you touch it up. It looks like there’s a little bit of rust forming in that area anyway, so it’s probably a good idea to do that in any case.

The most alarming one of these issues is the self-locking nylon nut that’s straight-up missing from the front suspension. Apparently, this issue is widespread enough on the Model Y to warrant a service bulletin. If this bolt fell out during driving—which it would if there was no nut holding it on—one side of the front suspension would just collapse. Obviously, that’s something you don’t want to happen while you’re driving, and could lead to a serious accident and bodily injury. Possibly even worse.

Reading through other complaints on the NHTSA’s page for the Model 3, it seems like suspension issues are very common. Problems with ball joints snapping seem to be by far the most common issue. It’s safe to read clearly inflammatory messages with a little bit of skepticism, but looking through wrecked Model 3s on Copart, it seems like that is at least a somewhat common issue.

Unfortunately, this just sort of seems like business as usual for Tesla. Its vehicles are known to have these sorts of issues, and they aren’t doing a ton to attempt to shed this image. There is certainly something to be said for the strides the company has made with battery technology and drivetrain design, but quality control has to catch up with those innovations. Making advanced cars is one thing, making safe and reliable cars is entirely another.

Source: These Repair Bulletins for Tesla’s Quality Problems Are Downright Embarrassing—and Serious

Compromised Amazon Ring Devices Combined With Swatting

Late last year, it was discovered that yet another set of IoT devices were being turned against their owners by malicious people. It would be a stretch to call these losers “hackers,” considering all they did was utilize credentials harvested from multiple security breaches to take control of poorly secured cameras made by Ring.

Password reuse is common and these trolls made the most of it. Streaming their exploits to paying users, the perpetrators shouted racist abuse at homeowners, talked to/taunted their children, and interrupted their sleep by blaring loud noises through the cameras’ mics.

This string of events landed Ring in court. Ring claims this isn’t the company’s fault since the credentials weren’t obtained from Ring itself. But Ring’s lax security standards allowed users to bypass two-factor authentication and, until recently, didn’t warn users of unrecognized login attempts or lock their accounts after a certain number of login failures.

There’s another insidious twist to this new form of online/offline abuse. And it’s caught the attention of the feds. The FBI says these cameras are now being combined with swatting to inflict additional misery on camera owners.

Recently, offenders have been using victims’ smart devices, including video and audio capable home surveillance devices, to carry out swatting attacks. To gain access to the smart devices, offenders are likely taking advantage of customers who re-use their email passwords for their smart device. The offenders use stolen email passwords to log into the smart device and hijack features, including the live-stream camera and device speakers.

They then call emergency services to report a crime at the victims’ residence. As law enforcement responds to the residence, the offender watches the live stream footage and engages with the responding police through the camera and speakers. In some cases, the offender also live streams the incident on shared online community platforms.

Combining two things people hate into one dangerous blend is someone’s idea of a good time. Two recent incidents involving hacked devices and swatting fortunately ended without anyone being killed by law enforcement.

One Florida woman was called by a “hacker” and told to go outside and see if the local SWAT team was there. She was met by police shortly afterwards who told her they’d received a call she’d been murdered by her husband. No raid happened but officers were showered with insults and obscenities by “hackers” via the compromised Ring doorbell/camera for failing to provide the entertainment the online assholes were seeking.

A similar incident happened in Virginia, with the “hacker” taunting both the family and officers as they investigated a fake suicide call.

Through the family’s four Ring cameras, a hacker screamed, “Help me!” as officers checked inside the home to make sure everyone was safe.

Back outside, the officers realized the intermittent screaming was coming from the home’s Ring cameras.

A man started talking to the officers through the cameras, saying he hacked the homeowner’s accounts and faked the 911 call.

[…]

Officer: “What is it that you need from us?”

Hacker: “Oh nothing, we were just [messing] around, after this we’ll log out, tell him to change his Yahoo password, his Ring password, and stop using the same passwords for the same [stuff].”

Chesapeake Police officers covered up the cameras and asked who was screaming. The hacker told officers it was him yelling for help, claiming he livestreamed the Ring cameras when officers arrived and charged people five dollars each to watch online.

So, that’s where we’re at, hellscape-wise. A nation full of devices that can be taken over by anyone with the right credentials and turned into entertainment for sociopaths. Of course, being better about locking down IoT devices won’t stop these same sociopaths from weaponizing local law enforcement agencies. Choosing a strong, unique password isn’t going to keep assholes from swatting people. It’s only going to deprive them of their ability to witness the potentially deadly results of their actions.

Source: FBI Warns Assholes Are Now Combining Compromised IoT Devices With Swatting Because That’s The Hell We Now Live In | Techdirt

Singapore police can access now data from the country’s contract tracing app

With a nearly 80 percent uptake among the country’s population, Singapore’s TraceTogether app is one of the best examples of what a successful centralized contact tracing effort can look like as countries across the world struggle to contain the coronavirus pandemic. To date, more than 4.2 million people in Singapore have download the app or obtained the wearable the government has offered to people.

In contrast to Apple’s and Google’s Exposure Notifications System — which powers the majority of COVID-19 apps out there, including ones put out by states and countries like California and Germany — Singapore’s TraceTogether app and wearable uses the country’s own internally developed BlueTrace protocol. The protocol relies on a centralized reporting structure wherein a user’s entire contact log is uploaded to a server administered by a government health authority. Outside of Singapore, only Australia has so far adopted the protocol.

In an update the government made to the platform’s privacy policy on Monday, it added a paragraph about how police can use data collected through the platform. “TraceTogether data may be used in circumstances where citizen safety and security is or has been affected,” the new paragraph states. “Authorized Police officers may invoke Criminal Procedure Code (CPC) powers to request users to upload their TraceTogether data for criminal investigations.”

Previous versions of the privacy policy made no mention of the fact police could access any data collected by the app; in fact, the website used to say, “data will only be used for COVID-19 contact tracing.” The government added the paragraph after Singapore’s opposition party asked the Minister of State for Home Affairs if police could use the data for criminal investigations. “We do not preclude the use of TraceTogether data in circumstances where citizens’ safety and security is or has been affected, and this applies to all other data as well,” said Minister Desmond Tan.

What’s happening in Singapore is an example of the exact type of potential privacy nightmare that experts warned might happen with centralized digital contact tracing efforts. Worse, a loss of trust in the privacy of data could push people further away from contact tracing efforts altogether, putting everyone at more risk.

Source: Singapore police can access data from the country’s contract tracing app | Engadget

Uber wasted $100 million on useless digital ad campaigns

[…]

the estimated $100 million Uber apparently straight-up squandered on incredibly obvious, third-party digital advertising scams… something that is garnering mainstream coverage in the first days of 2021, despite coming to light back in February of last damn year.

You Google Played yourself — Former Sleeping Giants alum and co-founder of Check My Ads, Nandini Jammi, caught most of us up on the whole situation yesterday in a lengthy Twitter thread detailing just how Uber, the poster child of startup capitalism’s unethical robber baron mentality, managed to recently waste a mind-boggling $100 million in pointless digital advertising campaigns through a host of blatantly shady ad networks.

One such instance involved launching “‘battery saver’ style apps in Google Play, giving them root access to your phone.” Upon typing “Uber” into Google Play, the service “auto-fires a click to make it look like you clicked on an Uber ad and attribute the install to themselves.”

[…]

Source: Uber wasted $100 million on useless digital ad campaigns

A lot more moralising in the article on how Uber is evil and how this writer would spend someone else’s money but we’re seeing more and more about how the huge digital “targetted” ad spends are actually not delivering on their promises

Scientists turn CO2 into jet fuel

Researchers may have found a way to reduce the environmental impact of air travel in situations when electric aircraft and alternative fuels aren’t practical. Wired reports that Oxford University scientists have successfully turned CO2 into jet fuel, raising the possibility of conventionally-powered aircraft with net zero emissions.

The technique effectively reverses the process of burning fuel by relying on the organic combustion method. The team heated a mix of citric acid, hydrogen and an iron-manganese-potassium catalyst to turn CO2 into a liquid fuel capable of powering jet aircraft.

The approach is inexpensive, uncomplicated and uses commonplace materials. It’s cheaper than processes used to turn hydrogen and water into fuel.

There are numerous challenges to bringing this to aircraft. The lab method only produced a few grams of fuel — you’d clearly need much more to support even a single flight, let alone an entire fleet. You’d need much more widespread use of carbon capture. And if you want effectively zero emissions, the capture and conversion systems would have to run on clean energy.

The researches are talking with industrial partners, though, and don’t see any major scientific hurdles. It might also be one of the most viable options for fleets. Many of them would have to replace their aircraft to go electric or switch fuel types. This conversion process would let airlines keep their existing aircraft and go carbon neutral until they’re truly ready for eco-friendly propulsion.

Source: Scientists turn CO2 into jet fuel | Engadget

Zyxel products have a hardcoded root user you can access from internet

TL;DR: If you have a Zyxel USG, ATP, VPN, ZyWALL or USG FLEX you should update to the latest firmware version today. You can find the full list of affected devices here and the Zyxel advisory here.

Zyxel is a popular brand for firewalls that are marketed towards small and medium businesses. Their Unified Security Gateway (USG) product line is often used as a firewall or VPN gateway. As a lot of us are working from home, VPN-capable devices have been quite selling well lately.

When doing some research (rooting) on my Zyxel USG40, I was surprised to find a user account ‘zyfwp’ with a password hash in the latest firmware version (4.60 patch 0). The plaintext password was visible in one of the binaries on the system. I was even more surprised that this account seemed to work on both the SSH and web interface.

$ ssh zyfwp@192.168.1.252
Password: Pr*******Xp
Router> show users current
No: 1
  Name: zyfwp
  Type: admin
(...)
Router>

The user is not visible in the interface and its password cannot be changed. I checked the previous firmware version (4.39) and although the user was present, it did not have a password. It seemed the vulnerability had been introduced in the latest firmware version. Even though older versions do not have this vulnerability, they do have others (such as this buffer overflow) so you should still update.

As SSL VPN on these devices operates on the same port as the web interface, a lot of users have exposed port 443 of these devices to the internet. Using publicly available data from Project Sonar, I was able to identify about 3.000 Zyxel USG/ATP/VPN devices in the Netherlands. Globally, more than 100.000 devices have exposed their web interface to the internet.

Source: Undocumented user account in Zyxel products (CVE-2020-29583) – EYE

Julian Assange will NOT be extradited to the US over WikiLeaks hacking and spy charges, rules British judge

Accused hacker and WikiLeaks founder Julian Assange should not be extradited to the US to stand trial, Westminster Magistrates’ Court has ruled.

District Judge Vanessa Baraitser told Assange this morning that there was no legal obstacle to his being sent to the US, where he faces multiple criminal charges under America’s Espionage Act and Computer Fraud and Abuse Act over his WikiLeaks website.

Assange is a suicide risk and the judge decided not to order his extradition to the US, despite giving a ruling in which she demolished all of his legal team’s other arguments against extradition.

“I am satisfied that the risk that Mr Assange will commit suicide is a substantial one,” said the judge, sitting at the Old Bailey, in this morning’s ruling. Adopting the conclusions of medical expert Professor Michael Kopelman, an emeritus professor of neuropsychiatry at King’s College London, Judge Baraitser continued:

Taking account of all of the information available to him, he considered Mr Assange’s risk of suicide to be very high should extradition become imminent. This was a well-informed opinion carefully supported by evidence and explained over two detailed reports.

[…]

All other legal arguments against extradition rejected

Judge Baraitser heard from Assange’s lawyers during this case that he was set to be extradited because he had politically embarrassed the US, rather than committed any genuine criminal offence.

Nonetheless, US lawyers successfully argued that Assange’s actions were outside journalistic norms, with the judge approvingly quoting news articles from The Guardian and New York Times that condemned him for dumping about 250,000 stolen US diplomatic cables online in clear text.

“Free speech does not comprise a ‘trump card’ even where matters of serious public concern are disclosed,” said the judge in a passage that will be alien to American readers, whose country’s First Amendment reverses that position.

[…]

The judge also found that the one-time WikiLeaker-in-chief had directly commissioned a range of people to hack into various Western countries’ governments, banks and commercial businesses, including the Gnosis hacking crew that was active in the early 2010s.

Judge Baraitser also dismissed Assange’s legal arguments that publishing stolen US government documents on WikiLeaks was not a crime in the UK, ruling that had he been charged in the UK, he would have been guilty of offences under the Official Secrets Acts 1911-1989. Had his conduct not been a crime in the UK, that would have been a powerful blow against extradition.

[…]

Summing up the thoughts of most if not all people following Assange’s case when the verdict was given, NSA whistleblower Edward Snowden took to Twitter:

Having had all of his substantive legal arguments dismissed, there isn’t much for Assange and his supporters to cheer about today. It is certain that the US will throw as much legal muscle at the appeal as it possibly can. With some British prisoners successfully avoiding extradition by expressing suicidal thoughts, it is likely American prosecutors will want to set a UK precedent that overturns the suicide barrier.

Source: Julian Assange will NOT be extradited to the US over WikiLeaks hacking and spy charges, rules British judge • The Register

Microsoft says SolarWinds hackers viewed source code

The hackers who carried out a sophisticated cyberattack on US government agencies and on private companies were able to access Microsoft’s source code, the company said Thursday.

A Microsoft investigation turned up “unusual activity with a small number of internal accounts” and also revealed that “one account had been used to view source code in a number of source code repositories,” the company said in a blog post. Microsoft said that the account didn’t have the ability to modify code and that no company services or customer data was put at risk.

[…]

Source: Microsoft says SolarWinds hackers viewed source code – CNET

T-Mobile data breach exposed phone numbers, call records for 200k customers

T-Mobile has announced a data breach exposing customers’ proprietary network information (CPNI), including phone numbers and call records.

Starting yesterday, T-Mobile began texting customers that a “security incident” exposed their account’s information.

According to T-Mobile, its security team recently discovered “malicious, unauthorized access” to their systems. After bringing in a cybersecurity firm to perform an investigation, T-Mobile found that threat actors gained access to the telecommunications information generated by customers, known as CPNI.

The information exposed in this breach includes phone numbers, call records, and the number of lines on an account.

“Customer proprietary network information (CPNI) as defined by the Federal Communications Commission (FCC) rules was accessed. The CPNI accessed may have included phone number, number of lines subscribed to on your account and, in some cases, call-related information collected as part of the normal operation of your wireless service,” T-Mobile stated in a data breach notification.

T-Mobile states that the data breach did not expose account holders’ names, physical addresses, email addresses, financial data, credit card information, social security numbers, tax IDs, passwords, or PINs.

In a statement to BleepingComputer, T-Mobile stated that this breach affected a “small number of customers (less than 0.2%).”  T-Mobile has approximately 100 million customers, which equates to around 200,000 people affected by this breach.

[…]

Source: T-Mobile data breach exposed phone numbers, call records

Access To Big Data Turns Farm Machine Makers Into Tech Firms

The combine harvester, a staple of farmers’ fields since the late 1800s, does much more these days than just vacuum up corn, soybeans and other crops. It also beams back reams of data to its manufacturer.

GPS records the combine’s precise path through the field. Sensors tally the number of crops gathered per acre and the spacing between them. On a sister machine called a planter, algorithms adjust the distribution of seeds based on which parts of the soil have in past years performed best. Another machine, a sprayer, uses algorithms to scan for weeds and zap them with pesticides. All the while sensors record the wear and tear on the machines, so that when the farmer who operates them heads to the local distributor to look for a replacement part, it has already been ordered and is waiting for them.

Farming may be an earthy industry, but much of it now takes place in the cloud. Leading farm machine makers like Chicago-based John Deere & Co. DE +1.1% or Duluth’s AGCO AGCO +0.9% collect data from all around the world thanks to the ability of their bulky machines to extract a huge variety of metrics from farmers’ fields and store them online. The farmers who sit in the driver’s seats of these machines have access to the data that they themselves accumulate, but legal murk obfuscates the question of whether they actually own that data and only the machine manufacturer can see all the data from all the machines leased or sold.

[…]

Still, farmers have yet to be fully won over. Many worry that by allowing the transfer of their data to manufacturers, it will inadvertently wind up in the hands of neighboring farmers with whom they compete for scarce land, who could then mine their closely guarded information about the number of acres they plow or the types of fertilizers and pesticides they use, thus gaining a competitive edge. Others fear that information about the type of seeds or fertilizer they use will wind up in the hands of the chemicals companies they buy from, allowing those companies to anticipate their product needs and charge them more, said Jonathan Coppess, a professor at the University of Illinois.

Sensitive to the suggestion that they are infringing on privacy, the largest equipment makers say they don’t share farmers’ data with third parties unless farmers give permission. (Farmers frequently agree to share data with, for example, their local distributors and dealers.)

It’s common to hear that farmers are, by nature, highly protective of their land and business, and that this predisposes them to worry about sharing data even when there are more potential benefits than drawbacks. Still, the concerns are at least partly the result of a lack of legal and regulatory standards around the collection of data from smart farming technologies, observers say. Contracts to buy or rent big machines are many pages long and the language unclear, especially since some of the underlying legal concepts regarding the sharing and collecting of agricultural data are still evolving.

As one 2019 paper puts it, “the lack of transparency and clarity around issues such as data ownership, portability, privacy, trust and liability in the commercial relationships governing smart farming are contributing to farmers’ reluctance to engage in the widespread sharing of their farm data that smart farming facilitates. At the heart of the concerns is the lack of trust between the farmers as data contributors, and those third parties who collect, aggregate and share their data.”

[…]

Some farmers may still find themselves surprised to discover the amount of access Deere and others have to their data. Jacob Maurer is an agronomist with RDO Equipment Co., a Deere dealer, who helps farmers understand how to use their data to work their fields more efficiently. He explained that some farmers would be shocked to learn how much information about their fields he can access by simply tapping into Deere’s vast online stores of data and pulling up their details.

[…]

Based on the mountains of data flowing in to their databases, equipment makers with sufficient sales of machines around the country may in theory actually be able to predict, at least to some small but meaningful extent, the prices of various crops by analyzing the data its machines are sending in — such as “yields” of crops per acre, the amount of fertilizer used, or the average number of seeds of a given crop planted in various regions, all of which would help to anticipate the supply of crops come harvest season.

Were the company then to sell that data to a commodities trader, say, it could likely reap a windfall. Normally, the markets must wait for highly-anticipated government surveys to run their course before having an indication of the future supply of crops. The agronomic data that machine makers collect could offer similar insights but far sooner.

Machine makers don’t deny the obvious value of the data they collect. As AGCO’s Crawford put it: “Anybody that trades grains would love to have their hands on this data.”

Experts occasionally wonder about what companies could do with the data. Mary Kay Thatcher, a former official with the American Farm Bureau, raised just such a concern in an interview with National Public Radio in 2014, when questions about data ownership were swirling after Monsanto began deploying a new “precision planting” tool that required it to have gobs of data.

“They could actually manipulate the market with it. You know, they only have to know the information about what’s actually happening with harvest minutes before somebody else knows it,” Thatcher said in the interview.

“Not saying they will. Just a concern.”

Source: Access To Big Data Turns Farm Machine Makers Into Tech Firms

Apple Told This Developer That His App ‘Promoted’ Drugs – after 6 years in the store

In Apple’s world, an app can be inappropriate one day, but acceptable the next. That’s what the developer of Amphetamine—an app designed to keep Macs from going to sleep, which is useful in situations such as when a file is downloading or when a specific app is running—learned recently when Apple got in touch with him and told him that his app violated the company’s App Store guidelines.

Amphetamine developer William Gustafson published an account of the incident and his experience with Apple’s App Store review team on GitHub on Friday. In the post, Gustafson explained that Apple contacted him on Dec. 29 and told him that Amphetamine, which has been on the Mac App Store for six years, had suddenly begun violating one of the company’s App Store guidelines. Specifically, Gustafson said that Apple claimed that Amphetamine appeared to promote the inappropriate use of controlled substances given its very name—amphetamines are used to treat ADHD—and because its icon includes a pill.

[…]

“As we discussed, we found that your app includes content that some users may find upsetting, offensive, or otherwise objectionable,” an Apple representative told Gustafson on Dec. 29 according to a screenshot shared with Gizmodo. “Specifically, your app name and icon include references to controlled substances, pills.”

The representative then brought up App Store Guideline 1.4.3, which pertains to safety and physical harm. The guideline reads as follows:

“Apps that encourage consumption of tobacco and vape products, illegal drugs, or excessive amounts of alcohol are not permitted on the App Store. Apps that encourage minors to consume any of these substances will be rejected. Facilitating the sale of marijuana, tobacco, or controlled substances (except for licensed pharmacies) isn’t allowed.”

To resolve the issue, the Apple representative said that Gustafson had to remove all content that encourages inappropriate consumption of drugs or alcohol. Gustafson explained in his Github post that Apple had threatened to remove Amphetamine from the Mac App Store on Jan. 12 if he did not oblige with its request for changes.

If this is all sounding a bit wild to you, that’s because it is. Although Amphetamine uses its name and branding to lightheartedly convey the fact that the app will prevent your Mac from going to sleep, it does not do anything that violates Guideline 1.4.3.

Source: Apple Told This Developer That His App ‘Promoted’ Drugs