The Linkielist

Linking ideas with the world

The Linkielist

Flushing toilets create clouds of virus-containing particles

Posted on by

Researchers used a computer simulation to show how a flushing toilet can create a cloud of virus-containing aerosol droplets that is large and widespread and lasts long enough that the droplets could be breathed in by others.

With recent studies showing the novel coronavirus that causes COVID-19 can survive in the human digestive tract and show up in feces of the infected, this raises the possibility the disease could be transmitted with the use of toilets.

Toilet flushing creates a great deal of turbulence, and qualitative evidence suggests this can spread both bacteria and viruses. The public, however, remains largely unaware of this infection pathway, since few quantitative studies have been carried out to investigate this possible mechanism.

In the journal Physics of Fluids, precise computer models were used to simulate water and air flows in a flushing and the resulting droplet cloud. The investigators used a standard set of fluid dynamic formulas, known as the Navier-Stokes equations, to simulate flushing in two types of toilet—one with a single inlet for flushing water, and another with two inlets to create a rotating flow.

The investigators also used a discrete phase model to simulate movement of the numerous tiny likely to be ejected from the toilet bowl into the air. A similar model was used recently to simulate the movement of aerosol droplets ejected during a human cough.

The results of the simulations were striking.

As water pours into the toilet bowl from one side, it strikes the opposite side, creating vortices. These vortices continue upward into the air above the bowl, carrying droplets to a height of nearly 3 feet, where they might be inhaled or settle onto surfaces. These droplets are so small they float in the air for over a minute. A toilet with two inlet ports for water generates an even greater velocity of upward flowing aerosol particles.

“One can foresee that the velocity will be even higher when a toilet is used frequently, such as in the case of a family toilet during a busy time or a public toilet serving a densely populated area,” said co-author Ji-Xiang Wang, of Yangzhou University.

The simulations show that nearly 60% of the ejected particles rise high above the seat for a toilet with two inlet ports. A solution to this deadly problem is to simply close the lid before flushing, since this should decrease aerosol spread.

However, in many countries, including the United States, toilets in are often without lids. This poses a serious hazard. The investigators also suggest a better toilet design would include a lid that closes automatically before flushing.

Source: Flushing toilets create clouds of virus-containing particles

More information: “Can a toilet promote virus transmission? From a fluid dynamics perspective,” Physics of Fluids, aip.scitation.org/doi/10.1063/5.0013318

Journal information: Physics of Fluids

Researchers Have Created a Tool That Can Perfectly Depixelate Faces

Posted on by

The typical approach to increasing the resolution of an image is to start with the low-res version and use intelligent algorithms to predict and add additional details and pixels in order to artificially generate a high-res version. But because a low-res version of an image can lack significant details, fine features are often lost in the process, resulting in, particularly with faces, an overly soft and smoothed out appearance in the results lacking fine details. The approach a team of researchers from Duke University has developed, called Pulse (Photo Upsampling via Latent Space Exploration), tackles the problem in an entirely different way by taking advantage of the startling progress made with machine learning in recent years.

The Pulse research team from Duke University demonstrating the results (the lower row of headshots) of Pulse processing a low-res image (the middle row of headshots) compared to the original (the top row of headshots) high-res photos.
The Pulse research team from Duke University demonstrating the results (the lower row of headshots) of Pulse processing a low-res image (the middle row of headshots) compared to the original (the top row of headshots) high-res photos.
Photo: Duke University

Pulse starts with a low-res image, but it doesn’t work with or process it directly. It instead uses it as a target reference for an AI-based face generator that relies on generative adversarial networks to randomly create realistic headshots. We’ve seen these tools used before in videos where thousands of non-existent but lifelike headshots are generated, but in this case, after the faces are created, they’re downsized to the resolution of the original low-res reference and compared it against it, looking for a match. It seems like an entirely random process that would take decades to find a high-res face that matches the original sample when it’s shrunk, but the process is able to quickly find a close comparison and then gradually tweak and adjust it until it produces a down-sampled result that matches the original low-res sample.

Source: Researchers Have Created a Tool That Can Perfectly Depixelate Faces

T-Mobile US outage finally ends after more than twelve hours (updated)

Posted on by

T-Mobile’s network is having an issue with voice and data service. There was a huge spike in outage reports on Down Detector starting at around 1 PM ET today, with many people across the US suggesting on that site and Twitter that they’re having problems. By around 3:30 PM ET, Down Detector had collected more than 82,000 outage reports.

Some people are unable to make or receive calls, but Wi-Fi calling still seems to work (in case you’re wondering why you can still call someone else from a T-Mobile phone right now). There are problems with data service too. T-Mobile’s president of technology Neville Ray confirmed the issue and said the company’s engineers are working to resolve them:

Source: T-Mobile outage finally ends after more than twelve hours (updated) | Engadget

Apple Pay and the App Store are under EU antitrust investigation

Posted on by

The European Commission has launched two separate antitrust investigations into Apple, focused on the App Store and Apple Pay.

The executive branch of the European Union said it would consider App Store rules that force developers to use its own payment and in-app purchase system. In a press release, the Commission referenced a complaint filed by Spotify more than a year ago. At the time, CEO and founder Daniel Ek argued that the 30 percent cut that Apple takes on all transactions — including in-app purchases, which includes Free to Premium Spotify conversions — meant that it would have to raise its prices beyond those offered by Apple Music.

“To keep our price competitive for our customers, that isn’t something we can do,” he explained in a blog post. Of course, it’s possible for Spotify users to upgrade their account on a different platform, including the web. But if you try to sidestep Apple’s payment system, the company will limit your marketing and communications with customers, Elk argued. “In some cases, we aren’t even allowed to send emails to our customers who use Apple,” he wrote. “Apple also routinely blocks our experience-enhancing upgrades. Over time, this has included locking Spotify and other competitors out of Apple services such as Siri, HomePod, and Apple Watch.”

The Commission said it had completed a “preliminary investigation” and found “concerns” that discouraged competition against Apple’s own services. “Apple’s competitors have either decided to disable the in-app subscription possibility altogether or have raised their subscription prices in the app and passed on Apple’s fee to consumers,” the executive branch explained in its press release. “In both cases, they were not allowed to inform users about alternative subscription possibilities outside of the app.”

[…]

The second antitrust investigation will look at Apple Pay, which is effectively the only mobile payments solution available to iPhone and iPad users.

Following a preliminary investigation, the Commission has “concerns” that the situation is stifling competition and reducing consumer choice on the platform. Vestager noted that mobile payments will likely increase even further as European citizens looks to minimize physical contact with physical money and store clerks.

“It is important that Apple’s measures do not deny consumers the benefits of new payment technologies, including better choice, quality, innovation and competitive prices,” she argued. “I have therefore decided to take a close look at Apple’s practices regarding Apple Pay and their impact on competition.”

Source: Apple Pay and the App Store are under EU antitrust investigation | Engadget

845GB of racy dating app records exposed to entire internet via leaky AWS buckets

Posted on by

Hundreds of thousands of sensitive dating app profiles – including images of “a graphic, sexual nature” – were exposed online for anyone stumbling across them to download.

Word of the uncontrolled emission burst forth from vpnMentor this week, which claims it found a misconfigured AWS S3 bucket containing 845GB of private dating app records.

Data exposed included photos, many of a graphic, sexual nature; private chats and details of financial transactions; audio recordings; and limited personally identifiable information, the biz stated, adding that it thinks it found sufficient data to blackmail people.

“Aside from exposing potentially millions of users of the apps to danger, the breach also exposed the various apps’ entire AWS infrastructure through unsecured admin credentials and passwords,” vpnMentor’s researchers wrote.

The haul is estimated to contain hundreds of thousands of users’ data, all exposed to the public internet without any authentication. We note vpnMentor thinks this figure could be in the millions.

The storage silo was used by nine rather niche dating apps, including SugarD, which connects sugar daddies with sugar babies, whom they financially support with gifts and cash. Gay Daddy Bear, which targets plus-sized, hairy gay men, was also exposed, we’re told. Data from the-self-explanatory-but-puzzling-in-other-ways Herpes Dating was also revealed.

Just who built the apps and made the fateful decision to misconfigure the buckets is not known, though vpnMentor suspects the nine services share a common developer. Whoever is to blame, they ignored the regular warnings Amazon Web Services sends to S3 customers regarding controlling and limiting access to cloud-hosted data.

Users of the apps can take some small comfort from the fact the buckets were taken offline on 27 May, a day after the researchers informed one of the websites about the risk of unauthorized access

Source: 845GB of racy dating app records exposed to entire internet via leaky AWS buckets • The Register

Polish President Says LGBT ‘Ideology’ Worse Than Communism

Posted on by

Polish President Andrzej Duda accused the LGBT rights movement Saturday of promoting a viewpoint more harmful than communism and said he agreed with another conservative politician who stated that “LGBT is not people, it’s an ideology.”

Duda made his comments in the small southwestern town of Brzeg as he campaigns for reelection in Poland, a predominantly Catholic nation that spent more than four decades under communist governments.

Gay rights is emerging as a key campaign theme in the presidential election as the race grows close between Duda, backed by the nationalist conservative ruling party, and Warsaw Mayor Rafal Trzaskowski, who has called for tolerance for gays and lesbians.

Duda, who is 48, told his supporters that his parents’ generation did not struggle to cast off communism only to now accept “an ideology” that he thinks “is even more destructive to the human being.”

The president said that during Poland’s communist era, regimes ensured survival by indoctrinating the youngest generation.

“That was Bolshevism. It was the ideologizing of children,” he said. “Today, there are also attempts to push an ideology on us and our children, but different. It’s totally new, but it is also neo-Bolshevism.”

Earlier in the week, Duda signed a declaration drafted for the stated purpose of helping families that included language on “protecting children from LGBT ideology” with a ban on “propagating LGBT ideology in public institutions.”

Many conservative politicians in Poland say they are not against gay men and lesbians as individuals, but insist they oppose the goals of a civil rights movement they claim is imported from abroad and threatens to sexualize young people.

But gay and lesbian Poles and liberal Poles say government officials are adopting a language of dehumanization. They believe Duda and others are targeting homosexuals to curry favor with the powerful Catholic church — which faces allegations of covering up clerical abuse — and shore up support among conservative voters ahead of the election.

Some analysts also suspect that Duda and the governing Law and Justice party are making a bid for far-right voters who will mostly support the candidate of a smaller party, Confederation, in the election’s first round but whose votes will be up for grabs in a runoff.

Source: Polish President Says LGBT ‘Ideology’ Worse Than Communism | Time

Trillions of Words Analyzed, OpenAI Sets Loose AI Language Colossus – The API

Posted on by

Over the past few months, OpenAI has vacuumed an incredible amount of data into its artificial intelligence language systems. It sucked up Wikipedia, a huge swath of the rest of the internet and tons of books. This mass of text – trillions of words – was then analyzed and manipulated by a supercomputer to create what the research group bills as a major AI breakthrough and the heart of its first commercial product, which came out on Thursday.

The product name — OpenAI calls it “the API” — might not be magical, but the things it can accomplish do seem to border on wizardry at times. The software can perform a broad set of language tasks, including translating between languages, writing news stories and poems and answering everyday questions. Ask it, for example, if you should keep reading a story, and you might be told, “Definitely. The twists and turns keep coming.”

OpenAI wants to build the most flexible, general purpose AI language system of all time. Typically, companies and researchers will tune their AI systems to handle one, limited task. The API, by contrast, can crank away at a broad set of jobs and, in many cases, at levels comparable with specialized systems. While the product is in a limited test phase right now, it will be released broadly as something that other companies can use at the heart of their own offerings such as customer support chat systems, education products or games, OpenAI Chief Executive Officer Sam Altman said.

[…]

Software developers can begin training the AI system just by showing it a few examples of what they want the code to do. If you ask it a number of questions in a row, for example, the system starts to sense it’s in question-and-answer mode and tweaks its responses accordingly. There are also tools that let you alter how literal or creative you want the AI to be.

But even a layperson – i.e. this reporter – can use the product. You can simply type text into a box, hit a button and get responses. Drop a couple paragraphs of a news story into the API, and it will try to complete the piece with results that vary from I-kinda-fear-for-my-job good to this-computer-might-be-on-drugs bad.

Source: Trillions of Words Analyzed, OpenAI Sets Loose AI Language Colossus – Bloomberg

Amazon Set to Face Antitrust Charges in European Union

Posted on by

European Union officials are preparing to bring antitrust charges against Amazon for abusing its dominance in internet commerce to box out smaller rivals, according to people with knowledge of the case.

Nearly two years in the making, the case is one of the most aggressive attempts by a government to crimp the power of the e-commerce giant, which has largely sidestepped regulation throughout its 26-year history.

The European Union regulators, who already have a reputation as the world’s most aggressive watchdogs of the technology industry, have determined that Amazon is stifling competition by unfairly using data collected from third-party merchants to boost its own product offerings, said the people, who spoke on the condition of anonymity because the deliberations were private.

The case against Amazon is part of a broader attempt in the United States and Europe to probe the business practices of the world’s largest technology companies, as authorities on both sides of the Atlantic see what they believe is a worrying concentration of power in the digital economy.

Margarethe Vestager, the European Commissioner who leads antitrust enforcement and digital policy, is also examining practices by Apple and Facebook. In Washington, the Justice Department, Federal Trade Commission and Congress are targeting Amazon, Apple, Facebook and Google.

William Kovacic, a law professor at George Washington University, said the tech industry was facing a “striking critical mass” of attention from governments around the world, including Australia, Brazil and India. He said that regulators in Brussels and Washington may deploy so-called interim measures against the companies, a rarely used tool that could force Amazon and other large tech platforms to halt certain practices while a case is litigated.

[…]

The case stems from Amazon’s treatment of third-party merchants who rely on its website to reach customers. Investigators have focused on Amazon’s dual role as both the owner of its online store and a seller of goods that compete with other sellers, creating a conflict of interest.

Authorities in Europe have concluded that Amazon abuses its position to give its own products preferential treatment. European officials have spent the past year interviewing merchants and others who depend on Amazon to better understand how it collects data to use to its advantage, including agreements that require them to share certain data with Amazon as a condition of selling goods on the platform.

Many merchants have complained that if they have a product that is selling well on Amazon, the company will then introduce its own product at a lower price, or give it more prominent placement on the website.

Source: Amazon Set to Face Antitrust Charges in European Union – The New York Times

So yeah, I had a talk about that in 2019

Internet Archive Ends Free Ebook Program Early due to money grubbing copyright enforcers suing them for being a library

Posted on by

Back in March, the Internet Archive launched its National Emergency Library, a program that made roughly 1.4 million books available to the public without the usual waitlists. But on Wednesday, the organization announced it was ending the program two weeks early after four major publishers decided to sue Internet Archive for copyright infringement.

Internet Archive explained in a blog post that after June 16, it would revert to a controlled digital lending model, in which libraries lend patrons digitized copies of a physical book one at a time. “We moved up our schedule because, last Monday, four commercial publishers chose to sue Internet Archive during a global pandemic,” the non-profit said. “However, this lawsuit is not just about the temporary National Emergency Library. The complaint attacks the concept of any library owning and lending digital books, challenging the very idea of what a library is in the digital world.”

By eliminating waitlists, the National Emergency Library program effectively upended how publishers have thus far controlled how libraries distribute ebooks. Under the usual system, publishers sell two-year licenses that cost several times more than what you’d pay if you just bought the book outright. Internet Archive’s program basically made it so any number of people could temporarily download a single ebook an infinite number of times between March 24 and June 30, the original end date for the program.

In their complaint, Hachette, HarperCollins, Penguin Random House, and John Wiley & Sons allege that in addition to violating copyrights, Internet Archive’s free ebook program “grossly exceed legitimate library services” and “constitute willful digital piracy on an industrial scale.”

Before blasting Internet Archive for capitulating, this lawsuit has the ability to tank the organization—probably best known for its Wayback Machine web archiving tool—for good. Publishers could claim up to $150,000 in damages per title. When you multiply that by the 1.4 million works Internet Archive put up for free, the final number could be astronomical, and well beyond the nonprofit’s ability to pay. A win for publishers would put Internet Archive’s other projects at risk.

It appears that publishers aren’t just after Internet Archive’s temporary free ebook initiative. The complaint also contends that controlled digital lending is an “invented theory” and that its rules “have been concocted from whole cloth and continue to get worse.” It also contends that Internet Archive’s “one-to-one conflation of print and ebooks is fundamentally flawed.” Controlled digital lending, however, isn’t unique to Internet Archive. It’s a framework that’s been supported by several libraries over the years, including many university libraries like UC Berkeley Library. Publishers winning this lawsuit may potentially also put the kibosh on the entire controlled digital lending model.

It’s clear that Internet Archive’s decision was intended to appease publishers into dropping the suit. According to Internet Archive, some academic publishers who were initially displeased with the National Emergency Library eventually came around. That said, it’s unclear whether commercial publishers would do the same, as they have everything to gain by strengthening their hold over ebook copyrights.

Source: Internet Archive Ends Free Ebook Program Early

Spies Can Eavesdrop by Watching a Light Bulb’s Vibrations

Posted on by

The list of sophisticated eavesdropping techniques has grown steadily over years: wiretaps, hacked phones, bugs in the wall—even bouncing lasers off of a building’s glass to pick up conversations inside. Now add another tool for audio spies: Any light bulb in a room that might be visible from a window.

Researchers from Israeli’s Ben-Gurion University of the Negev and the Weizmann Institute of Science today revealed a new technique for long-distance eavesdropping they call “lamphone.” They say it allows anyone with a laptop and less than a thousand dollars of equipment—just a telescope and a $400 electro-optical sensor—to listen in on any sounds in a room that’s hundreds of feet away in real-time, simply by observing the minuscule vibrations those sounds create on the glass surface of a light bulb inside. By measuring the tiny changes in light output from the bulb that those vibrations cause, the researchers show that a spy can pick up sound clearly enough to discern the contents of conversations or even recognize a piece of music.

“Any sound in the room can be recovered from the room with no requirement to hack anything and no device in the room,” says Ben Nassi, a security researcher at Ben-Gurion who developed the technique with fellow researchers Yaron Pirutin and Boris Zadov, and who plans to present their findings at the Black Hat security conference in August. “You just need line of sight to a hanging bulb, and this is it.”

In their experiments, the researchers placed a series of telescopes around 80 feet away from a target office’s light bulb, and put each telescope’s eyepiece in front of a Thorlabs PDA100A2 electro-optical sensor. They then used an analog-to-digital converter to convert the electrical signals from that sensor to digital information. While they played music and speech recordings in the faraway room, they fed the information picked up by their set-up to a laptop, which analyzed the readings.

side by side images of telescope pointing to window and aerial of bridge
The researchers’ experimental setup, with an electro-optical sensor behind the eyepiece of a telescope, pointing at a lightbulb inside an office building more than 80 feet away.Courtesy of Ben Nassi

The researchers found that the tiny vibrations of the light bulb in response to sound—movements that they measured at as little as a few hundred microns—registered as a measurable changes in the light their sensor picked up through each telescope. After processing the signal through software to filter out noise, they were able to reconstruct recordings of the sounds inside the room with remarkable fidelity: They showed, for instance, that they could reproduce an audible snippet of a speech from President Donald Trump well enough for it to be transcribed by Google’s Cloud Speech API. They also generated a recording of the Beatles’ “Let It Be” clear enough that the name-that-tune app Shazam could instantly recognize it.

The technique nonetheless has some limitations. In their tests, the researchers used a hanging bulb, and it’s not clear if a bulb mounted in a fixed lamp or a ceiling fixture would vibrate enough to derive the same sort of audio signal. The voice and music recordings they used in their demonstrations were also louder than the average human conversation, with speakers turned to their maximum volume. But the team points out that they also used a relatively cheap electro-optical sensor and analog-to-digital converter, and could have upgraded to a more expensive one to pick up quieter conversations. LED bulbs also offer a signal-to-noise ratio that’s about 6.3 times that of an incandescent bulb and 70 times a fluorescent one.

Source: Spies Can Eavesdrop by Watching a Light Bulb’s Vibrations  | WIRED

Someone got so fed up with GE fridge DRM – yes, fridge DRM – they made a whole website on how to bypass it

Posted on by

Fed up with the DRM in a General Electric refrigerator that pushed the owner to buy expensive manufacturer-approved replacement water filters, an anonymous hacker went to the trouble of buying a domain name and setting up a website at gefiltergate.com to pen a screed about appliance digital rights restriction management (DRM) and how to bypass it.

The fridge in question required a GE RPWFE refrigerator water filter. It has an RFID chip, which the fridge uses to verify the authenticity of the part. The RPWFE filter costs much more than unapproved filters: about $50 compared to $13.

“Some ******* at GE thought it would be a good idea to include a ******* RFID DRM module in select refrigerators,” the unidentified individual wrote, without using the asterisks we’ve included because online profanity filters are awful.

The Register contacted GE to ask about this, and the American giant’s corporate communications director promptly replied that GE sold its appliance unit to China-based Haier in 2016, which continues to use its brand. Haier did not immediately respond to our inquiry.

The gefiltergate.com website, borrowing from a similar post on another website back in May, explains how to hack your Haier GE-brand fridge by affixing an RFID tag – stripped from a component for bypassing the water filter system – to the RFID sensor.

The GE website suggests that a water filter is a good idea to avoid exposure to unfiltered water and sediment, inadvertently offering a sad commentary on public water infrastructure and government funding priorities. It recommends its RFID water filter because the chip chats with the fridge to report leaks, and will shut off the water supply if a leak is detected.

But the appliance doesn’t require the RFID filter; fridge owners can use the bypass plug, and still get unfiltered water.

“Non-GE filters and counterfeit filters without this technology will not perform the same way in the event of a water leak,” the company’s website explains. “The refrigerator has the option to use a bypass plug should you not want to use a genuine GE Appliances water filter.”

That makes it sound as if fridge owners can use water filters from another vendor but that’s not the case – the bypass plug is just to silence the fridge display screen warnings coming from the filtration system’s RFID sensor. “The ID chip on the filter detects when a wrong or non-genuine GE Appliance part is used,” the GE Appliances website states. “If this happens, the dispenser will not work and the display may read ‘Leak Detected.'”

Hence the need to hack the fridge, which is something product owners evidently have been doing for years. The Amazon.com webpage for the bypass plug contains a string of user reviews indicating that customers only purchased the thing for its RFID chip. And complaints abound on discussion site Reddit.

In a phone interview with The Register, Gay Gordon-Byrne, executive director of The Repair Association, said product hacking of this sort is entirely legal, in America at least. The US Copyright Office, she said, included software-enabled appliance repair in its 2018 rulemaking [PDF], and patents are not an issue in this case. And the Magnuson-Moss Warranty Act guarantees that consumers can use parts not from the original manufacturer.

Asked whether such practices generate enough ill-will to make them unprofitable, Gordon-Byrne said they can, pointing to Keurig’s problems selling coffee makers with digital locks, but added that people have to be aware of the problem.

“It generates some ill will but not enough to offset the value of controlling the whole parts market,” she said. “But it’s a stupid, stupid thing to do. There’s no reason to do this.”

Right-to-repair legislation, which aims to ensure consumers have a legal right to repair products where product makers or laws deny that possibility, was being considered in about 20 US states last year. However, Gordon-Byrne said that progress has stalled due to the coronavirus outbreak. She expects repair bills will have to be reintroduced in January next year.

Current US Copyright Office exemptions, she said, should be renewed for 2021 and she expects to lobby for new exemptions for product categories where repairs that require breaking digital locks are still not allowed, like boats, medical equipment, and game consoles.

Source: Someone got so fed up with GE fridge DRM – yes, fridge DRM – they made a whole website on how to bypass it • The Register

Trump Administration Eliminates Transgender Health Protections

Posted on by

In an utterly heartless move, the Trump administration on Friday eliminated health care protections for transgender people during an ongoing global pandemic that has claimed more lives in the U.S. than in any other country.

It did this by finalizing a rule under Section 1557 of the Affordable Care Act (ACA), which prohibits health programs or activities from discriminating on the basis of race, color, national origin, sex, age, or disability. The Trump administration rule—announced on the fourth anniversary of the Pulse nightclub shooting and in the middle of Pride month—changes the definition of sex discrimination, eliminating protections due to gender identity, and considers the word “sex” to refer to “male or female and as determined by biology.”

[…]

The nondiscrimination provisions were established by the Obama administration in 2016. That year, the Obama administration issued a rule to implement Section 1557 that redefined sex discrimination to include gender identity, which it defined as, “an individual’s internal sense of gender, which may be male, female, neither, or a combination of male and female, and which may be different from an individual’s sex assigned at birth.”

Under the new rule, a transgender person could be refused care for a checkup at a doctor’s office, according to NPR. Other possible scenarios include a transgender man being denied treatment for ovarian cancer, or a hysterectomy not being covered by an insurer. Some experts say that the rule opens the door for medical providers to refuse to test someone for covid-19, the disease caused by the novel coronavirus, simply because they’re transgender.

When it comes to health insurance and health care, transgender people are vulnerable to being treated negatively by their insurance and health care providers. According to the (old broken link: 2015 U.S. Transgender Survey) 2015 US Transgender Survey (new link) carried out by the National Center for Transgender Equality, transgender people have been denied coverage for care related to their gender transition, for routine care because they were transgender, or for transition-related surgery.

The survey found that 23 percent of respondents reported not going to see a doctor when they needed to because of fear of being mistreated as a transgender person. Of those who did go see a healthcare provider, 33 percent reported that they had had at least one negative experience related to being transgender, such as being refused treatment, verbally harassed, or physically or sexually assaulted, among other horrible experiences.

Source: Trump Administration Eliminates Transgender Health Protections

So Trump is following in the illustrious footsteps of Hungary, whos president immediately used the emergency dictatorial powers bestowed upon him due to Covid to changes the “sex” category in official documents like birth certificates to “sex at birth,” which can never be changed.

Source: Hungary bans legal recognition of its transgender citizens

Tanvas Haptic Touch Screen

Posted on by

With touch screens getting more and more prevalent, we’re seeing more experimentation with haptics. Being able to feel something other than just the smooth glass surface can be incredibly advantageous. Have you been in a car with a touch screen radio system? If so you’ll know the frustration.

Tanvas is a system that adds haptics by changing the amount of adhesion your finger tip experiences on the screen. Basically, they’re increasing the friction in a controlled manner. The result is a distinct difference between various areas of the screen. To be clear, you’re not feeling ridges, edges, or other 3 dimensional items, but you can definitely feel where something exists and something does not.

The touch screen itself isn’t really a consumer product. This is a dev kit, so you could incorporate their tech into your projects. Admittedly, this is only appealing to a very narrow subset of our readership (those developing a product that uses a touch screen) but I felt the tech was very interesting and wanted to share. Personally, I’d love to see this technology employed in popular consumer devices such as iPads!

Source: Quick Look: Tanvas Haptic Touch Screen

Keepnet fires legal threats at bloggers for exposing their 876GB unsecured database with years of leaked credentials, backfires

Posted on by

UK-based infosec outfit Keepnet Labs left an 867GB database of previously compromised website login details accessible to world+dog earlier this year – then sent lawyers’ letters to bloggers in a bid to erase their reports of its blunder.

A contractor left the Keepnet Elasticsearch database unsecured back in March after disabling a firewall, exposing around five billion harvested records to the public internet, the firm admitted in a statement yesterday.

The database was indexed by a search engine, and came to the attention of noted infosec blogger Volodymyr “Bob” Diachenko, who wrote it all up. Keepnet disputed Diachenko’s initial characterisation of the breach, and things spiralled from there.

As reported by news website Verdict, Keepnet was stung by Diachenko’s initial post about the gaffe, which Keepnet interpreted as the blogger blaming the business for leaking its own customers’ data – none of its own clients’ data was exposed, but rather info from previous publicly known database exposures. Diachenko said the database contained email addresses, hashed passwords, the sources of the information, and other details, all gathered from previous leaks by hackers.

What actually happened, Keepnet later insisted, was that a contractor had screwed up by turning off a firewall. The 867GB database, claimed Keepnet, contained email addresses harvested from other data spillages that took place between 2013 and 2019.

“As part of the Keepnet Labs Solution, we provide a ‘compromised email credentials’ threat intelligence service. To provide this service, we are continuously collecting publicly known data-breach data from online public resources. We then store this data in our own secure Elasticsearch database and provide companies with the information relating to their business email domains via our Keepnet platform,” the firm insisted.

Nonetheless, Keepnet responded to the bloggerati by sending lawyers’ letters to all and sundry, demanding its name be removed from the posts about the prone Elasticsearch database. Unfortunately for Keepnet, one of those letters landed on the doormat of veteran infosec scribbler Graham Cluley. Not one to be cowed, Cluley removed the firm’s name from his blog post – then tweeted about it.

In a subsequent post about the kerfuffle, Cluley said: “I gave Keepnet Labs multiple opportunities to tell me what was incorrect in my article, or to offer me a public statement that I could include in the article. I told them I was keen to present the facts accurately.” This is best practice for bloggers and standard practice for reputable news organs.

El Reg has received its fair share of lawyers’ letters commissioned by red-faced company execs determined to disrupt and deter news reporting of their doings. The letter sent to Cluley (seen by The Register and screenshotted at the link just above) seemingly complained that Cluley had defamed the company. It called out words that weren’t actually in his blog post; cited part of an EU directive that has nothing to do with defamation law either in the political bloc or in the UK as justification; and threatened legal action, injunctions, costs and damages (£££) unless the entire blog post was deleted.

Whether the Elasticsearch database truly was exposed for just 10 minutes as Keepnet claimed, and whether those 10 minutes were long enough for it to be indexed, that index to be seeded through BinaryEdge, Diachenko to notice the new result, click around as required, download 2MB of it, inspect the download and then figure out who owned the database, is all moot. Keepnet’s actions after the discovery eclipsed the original screw-up completely.

An unrepentant Keepnet said in its statement: “We have been working over the past few months to get in contact with the authors of posts who have shared inaccurate aspects of this story and have politely asked them to update their articles,” which is a funny way of saying “hired a lawyer to threaten a defamation lawsuit unless the posts were deleted.” This was only ever going to produce one result, and not the one Keepnet wanted.

As Cluley put it: “Security firms should be examples for all businesses on how to behave after a security breach. Transparency, disclosure of what went wrong, and what steps are being taken to ensure that something similar doesn’t happen again are key to building trust and confidence from customers and the rest of the industry.”

For what it’s worth, El Reg didn’t cover the breach at the time it was first reported because, well, it involved public information becoming public again. It is to be hoped that Keepnet’s entirely self-inflicted reputational harm here teaches its founder a sharp and valuable lesson.

Keepnet did not respond last week when we asked the firm for comment.

Source: Keepnet kerfuffle: Firing legal threats at bloggers did infosec biz more damage than its exposed database • The Register

Planet’s SkySats zoom in for a closer look at the Earth, get 50cm per pixel granularity

Posted on by

The remote-sensing firm Planet operates more than one hundred satellites that constantly orbit the earth, collecting imagery of the world’s entire landmass each day. Now, to offer more clarity to its customers, it has flown a handful of its satellites 50 km closer to the Earth.

This literal zoom-in effort will allow the firm to offer imagery with a resolution of 50 cm of earth per pixel, an increase from 80 cm. In one example, that means that as well as seeing the shape of a car, analysts will also be able to clearly discern the position of its windshield.

By the end of the summer, the company plans to add six new satellites to its constellation, allowing it to take those higher resolution pictures of the same area twelve times a day.

“We felt like 50 centimeters was an important threshold, but where we are really pushing the envelope is on that revisit,” Jim Thomason, a Planet vice president, told Quartz.

The ability to view the same area repeatedly means customers will get their imagery sooner after they request it, and they may be able to see what is changing on the ground. That also means a higher chance of dodging the bane of optical space imagery: clouds.

Planet
A “before” image.
An “after” image. “Orthorectified” refers to the process where sensor data taken of uneven terrain is accurately mapped onto a flat image.

Planet was founded in 2010 by former NASA scientists who wanted to leverage new advances in satellite technology and expand access to space data. Its customers include US intelligence agencies, the NGOs that second-guess them, agricultural conglomerates, and firms that use machine learning to gain insight from remote-sensing data.

Planet operates more than 150 satellites, most of which are Doves, toaster-oven sized craft that collectively “scan” the earth each day, producing imagery with a resolution about three meters per pixel. You may have seen the company’s widely-shared image of a new mural in Washington, D.C.

Source: Planet’s SkySats zoom in for a closer look at the Earth — Quartz

Obscure Indian cyber firm spied on politicians, investors worldwide

Posted on by

New Delhi-based BellTroX InfoTech Services targeted government officials in Europe, gambling tycoons in the Bahamas, and well-known investors in the United States including private equity giant KKR and short seller Muddy Waters, according to three former employees, outside researchers, and a trail of online evidence.

Aspects of BellTroX’s hacking spree aimed at American targets are currently under investigation by U.S. law enforcement, five people familiar with the matter told Reuters. The U.S. Department of Justice declined to comment.

Reuters does not know the identity of BellTroX’s clients. In a telephone interview, the company’s owner, Sumit Gupta, declined to disclose who had hired him and denied any wrongdoing.

Muddy Waters founder Carson Block said he was “disappointed, but not surprised, to learn that we were likely targeted for hacking by a client of BellTroX.” KKR declined to comment.

Researchers at internet watchdog group Citizen Lab, who spent more than two years mapping out the infrastructure used by the hackers, released a report here on Tuesday saying they had “high confidence” that BellTroX employees were behind the espionage campaign.

“This is one of the largest spy-for-hire operations ever exposed,” said Citizen Lab researcher John Scott-Railton.

Although they receive a fraction of the attention devoted to state-sponsored espionage groups or headline-grabbing heists, “cyber mercenary” services are widely used, he said. “Our investigation found that no sector is immune.”

A cache of data reviewed by Reuters provides insight into the operation, detailing tens of thousands of malicious messages designed to trick victims into giving up their passwords that were sent by BellTroX between 2013 and 2020. The data was supplied on condition of anonymity by online service providers used by the hackers after Reuters alerted the firms to unusual patterns of activity on their platforms.

The data is effectively a digital hit list showing who was targeted and when. Reuters validated the data by checking it against emails received by the targets.

On the list: judges in South Africa, politicians in Mexico, lawyers in France and environmental groups in the United States. These dozens of people, among the thousands targeted by BellTroX, did not respond to messages or declined comment.

Reuters was not able to establish how many of the hacking attempts were successful.

BellTroX’s Gupta was charged in a 2015 hacking case in which two U.S. private investigators admitted to paying him to hack the accounts of marketing executives. Gupta was declared a fugitive in 2017, although the U.S. Justice Department declined to comment on the current status of the case or whether an extradition request had been issued.

Speaking by phone from his home in New Delhi, Gupta denied hacking and said he had never been contacted by law enforcement. He said he had only ever helped private investigators download messages from email inboxes after they provided him with login details.

Source: Exclusive: Obscure Indian cyber firm spied on politicians, investors worldwide – Reuters

Hospital-busting hacker crew may be behind ransomware attack that made Honda halt car factories, say researchers

Posted on by

Japanese car maker Honda has been hit by ransomware that disrupted its production of vehicles and also affected internal communications, according to reports.

The ransomware, of an as-yet unidentified strain, appeared to have spread through the multinational firm’s network. A Honda spokesman told the media it appeared to have “hit the company’s internal servers.”

Some Honda factories around the world were forced to suspend production, though output from Turkey, India, USA and Brazil locations remain on hold at the time of writing.

Sky News reported yesterday that Honda’s networks began to suffer “issues” on Monday, and that “the company believed it was the result of unauthorised attempts to breach its systems.”

A Honda spokesbeing told several outlets: “We can confirm some impact in Europe and are currently investigating the exact nature.”

Another statement from the firm today added: “Work is being undertaken to minimise the impact and to restore full functionality of production, sales and development activities.”

In the meantime, multiple researchers have suggested the culprit was Ekans, with one Milkr3am, posting screenshots on Twitter of a sample submitted to VirusTotal today that checks for the internal Honda network name of “mds.honda.com”.

Professor Alan Woodward of the University of Surrey told El Reg: “With a just-in-time system you need only a small outage in IT to cause a problem. As it happens I think Honda have recovered quite quickly. A few countries’ facilities are still affected but they seem to be coming back very fast, which suggests they had a good response plan in place.”

The speed at which the malware spread in Honda’s network indicates that some the company has centralised functions, “the usual culprits are finance,” he added.

Source: Hospital-busting hacker crew may be behind ransomware attack that made Honda halt car factories, say researchers • The Register

WhatsApp was exposing users’ phone numbers in Google search

Posted on by

WhatsApp claims it fixed an issue that was showing users’ phone numbers in Google search results, TechCrunch reports. The change comes after security researcher Athul Jayaram revealed that phone numbers of WhatsApp users who used the Click to Chat feature were being indexed in search.

Click to Chat allows users to create a link with their phone number in plain text. According to Jayaram, because the links don’t have a robot.txt file in the server root, they cannot stop Google or other search engine bots from crawling and indexing the links. Jayaram says as many as 300,000 phone numbers may have appeared in Google search results, and they could be found by searching “site:wa.me.”

As TechCrunch notes, Jayaram isn’t the first to report this issue. WaBetaInfo pointed it out in February. While the issue seems to be fixed, it’s a pretty big security flaw and apparently it’s been a problem for at least several months.

Source: WhatsApp was exposing users’ phone numbers in Google search | Engadget

From off-prem to just off: IBM Cloud goes down planet-wide so hard even the status page didn’t work – and outside of US business hours

Posted on by

IBM’s cloud has gone down hard across the world.

We’d love to tell you just how hard the service has hit the dirt, but even the Big Blue status page is intermittently unavailable:

IBM cloud outage June 10 2020

IBM Cloud status page … Click to enlarge

Your humble hack has an IBM Cloud account, and when attempting to login in the hope that a customer-facing page could offer some information, he saw only the following error message:

IBM cloud outage login

Click to enlarge

IBM’s social feeds are silent on the outage at the time of writing.

One Australian IBM Cloud user told us that the outage has run for at least two hours, and means he is unable to deliver business services that customers depend on as they start their days. The breakdown is said to be global.

Clients are mad as hell because the blunder appears to have hit after business hours on the east coast of America, and IBM has not been responsive.

The Register has asked IBM to explain the outage, and we will update this story if and when more information becomes available. ®

Updated to add at 0020 UTC on June 10

The user we spoke to earlier tells us that their IBM-hosted services have come back to life. However, the IBM Cloud status page is still not working, and when this vulture tried to view it or to log on, this appeared…

IBM cloud outage continues

Your cloud is important to us. If you’d like to know more, press refresh for an hour or more.

Final update at 0140 UTC on June 10

The IBM Cloud’s status page is live again, and users can log in once more.

The status page lists fifteen active events though offers almost no detail other than the admission that: “Technical teams are engaged and have identified a broad network incident that is impacting many cloud services.” That information appears in a notification titled “Watson Platform users are unable to access console or applications in all regions.”

Source: From off-prem to just off: IBM Cloud goes down planet-wide so hard even the status page didn’t work • The Register

Dutch Justice minister wants to put webhosters that won’t do what he wants on a shaminglist, unburdened by proof and using kiddie porn as an excuse

Posted on by

The stance seems to be: If minister Grapperhaus tells a webhost to remove content, they should do it without the court system intervening.

As soon as they invoke kiddie porn you know that something totalitarian is being justified. Because once that is allowed, then they expand the powers to all content. And noboday can be seen to be against fighting kiddie porn, right?

Source: Foute en lakse webhosters gaan per september op een zwarte lijst – Emerce

Space Force Losing Trademark Battle With Netflix’s Space Force

Posted on by

The real Space Force may be going down in flames against the fictional Space Force: According to the Hollywood Reporter, the newly founded military branch appears to be losing a trademark battle with the Netflix comedy show of the same name.

Netflix “has outmaneuvered the U.S. government to secure trademark rights to ‘Space Force’ in Europe, Australia, Mexico and elsewhere,” according to the Reporter, while the Air Force—under which the Space Force is organized—simply has a pending application stateside. This mostly has ramifications for merch. Consumers won’t have trouble discerning between the military branch and Space Force when it comes to which one stars Steve Carrell, but they might not be able who is selling a line of Space Force shirts.

The U.S. Patent and Trademark Office relies on a “first-to-use” system when assigning rights, and Netflix has been submitting trademark applications for the Space Force across the globe since the start of 2019. On the other hand, the Air Force filed a trademark application on the basis of intent to use in March 2019, per Law & Crime, and the Space Force didn’t become an actual organization until December 2019. If it comes down to a legal battle, that means Netflix may be able to easily demonstrate it was actually using the Space Force branding first. (Even if Netflix lost the case, it would have a First Amendment right to continue selling Space Force merch on the grounds of satire and parody.)

Source: Space Force Losing Trademark Battle With Netflix’s Space Force

OK, so not only is this silly but the fact that you can apparently actually trademark two words in a row seems absolutely bonkers to me.

deepart.io turns your picture into versions of existing art pictures

Posted on by

Artificial intelligence turning your photos into art

It uses the stylistic elements of one image to draw the content of another. Get your own artwork in just three steps.

  1. Upload photo

    The first picture defines the scene you would like to have painted.

  2. Choose style

    Choose among predefined styles or upload your own style image.

  3. Submit

    Our servers paint the image for you. You get an email when it’s done.

Source: deepart.io – become a digital artist

Bug bounty platforms buy researcher silence, violate labor laws, critics say

Posted on by

Used properly, bug bounty platforms connect security researchers with organizations wanting extra scrutiny. In exchange for reporting a security flaw, the researcher receives payment (a bounty) as a thank you for doing the right thing. However, CSO’s investigation shows that the bug bounty platforms have turned bug reporting and disclosure on its head, what multiple expert sources, including HackerOne’s former chief policy officer, Katie Moussouris, call a “perversion.”

Bug bounty vs. VDP

A vulnerability disclosure program (VDP) is a welcome mat for concerned citizens to report security vulnerabilities. Every organization should have a VDP. In fact, the US Federal Trade Commission (FTC) considers a VDP a best practice, and has fined companies for poor security practices, including failing to deploy a VDP as part of their security due diligence. The US Department of Homeland Security (DHS) issued a draft order in 2019 mandating all federal civilian agencies deploy a VDP.

Regulators often view deploying a VDP as minimal due diligence, but running a VDP is a pain. A VDP looks like this: Good-faith security researchers tell you your stuff is broken, give you 90 days max to fix it, and when the time is up they call their favorite journalist and publish the complete details on Twitter, plus a talk at Black Hat or DEF CON if it’s a really juicy bug.

[…]

“Bug bounties are best when transparent and open. The more you try to close them down and place NDAs on them, the less effective they are, the more they become about marketing rather than security,” Robert Graham of Errata Security tells CSO.

Leitschuh, the Zoom bug finder, agrees. “This is part of the problem with the bug bounty platforms as they are right now. They aren’t holding companies to a 90-day disclosure deadline,” he says. “A lot of these programs are structured on this idea of non-disclosure. What I end up feeling like is that they are trying to buy researcher silence.”

The bug bounty platforms’ NDAs prohibit even mentioning the existence of a private bug bounty. Tweeting something like “Company X has a private bounty program over at Bugcrowd” would be enough to get a hacker kicked off their platform.

The carrot for researcher silence is the money — bounties can range from a few hundred to tens of thousands of dollars — but the stick to enforce silence is “safe harbor,” an organization’s public promise not to sue or criminally prosecute a security researcher attempting to report a bug in good faith.

The US Department of Justice (DOJ) published guidelines in 2017 on how to make a promise of safe harbor. Severe penalties for illegal hacking should not apply to a concerned citizen trying to do the right thing, they reasoned.

Want safe harbor? Sign this NDA

Sign this NDA to report a security issue or we reserve the right to prosecute you under the Computer Fraud and Abuse Act (CFAA) and put you in jail for a decade or more. That’s the message some organizations are sending with their private bug bounty programs.

[…]

The PayPal terms, published and facilitated by HackerOne, turn the idea of a VDP with safe harbor on its head. The company “commits that, if we conclude, in our sole discretion, [emphasis ours] that a disclosure respects and meets all the guidelines of these Program Terms and the PayPal Agreements, PayPal will not bring a private action against you or refer a matter for public inquiry.”

The only way to meet their “sole discretion” decision of safe harbor is if you agree to their NDA. “By providing a Submission or agreeing to the Program Terms, you agree that you may not publicly disclose your findings or the contents of your Submission to any third parties in any way without PayPal’s prior written approval.”

HackerOne underscores that safe harbor can be contingent on agreeing to program terms, including signing an NDA, in their disclosure guidelines. Bug finders who don’t wish to sign an NDA to report a security flaw may contact the affected organization directly, but without safe harbor protections.

“Submit directly to the Security Team outside of the Program,” they write. “In this situation, Finders are advised to exercise good judgement as any safe harbor afforded by the Program Policy may not be available.”

[…]

security researchers concerned about safe harbor protection should not rest easy with most safe harbor language, Electronic Frontier Foundation (EFF) Senior Staff Attorney Andrew Crocker tells CSO. “The terms of many bug bounty programs are often written to give the company leeway to determine ‘in its sole discretion’ whether a researcher has met the criteria for a safe harbor,” Crocker says. “That obviously limits how much comfort researchers can take from the offer of a safe harbor.”

“EFF strongly believes that security researchers have a First Amendment right to report their research and that disclosure of vulnerabilities is highly beneficial,” Crocker adds. In fact, many top security researchers refuse to participate on bug bounty platforms because of required NDAs.

[…]

Health insurance in the US is typically provided by employers to employees, and not to independent contractors. However, legal experts tell CSO that the bug bounty platforms violate both California and US federal labor law.

California AB 5, the Golden State’s new law to protect “gig economy” workers that came into effect in January 2020, clearly applies to bug bounty hunters working for HackerOne, Bugcrowd and Synack, Leanna Katz, an LLM candidate at Harvard Law School researching legal tests that distinguish between independent contractors and employees, tells CSO.

[…]

“My legal analysis suggests those workers [on bug bounty platforms] should at least be getting minimum wage, overtime compensation, and unemployment insurance,” Dubal tells CSO. “That is so exploitative and illegal,” she adds, saying that “under federal law it is conceivable that not just HackerOne but the client is a joint employer [of bug finders]. There might be liability for companies that use [bug bounty platform] services.”

“Finders are not employees,” Rice says, a sentiment echoed by Bugcrowd founder Ellis and Synack founder Jay Kaplan. Synack’s response is representative of all three platforms: “Like many companies in California, we’re closely monitoring how the state will apply AB 5, but we have a limited number of security researchers based in California and they represent only a fractional percentage of overall testing time,” a Synack representative tells CSO.

Using gig economy platform workers to discover and report security flaws may also have serious GDPR consequences when a security researcher discovers a data breach.

Bug bounty platforms may violate GDPR

When is a data breach not a data breach?

When a penetration testing consultancy with vetted employees discover the exposed data.

A standard penetrating testing engagement contract includes language that protects the penetration testers — in short, it’s not a crime if someone asks you to break into their building or corporate network on purpose, and signs a contract indemnifying you.

This includes data breaches discovered by penetration testers. Since the pen testers are brought under the umbrella of the client, say “Company X,” any publicly exposed Company X data discovered is not considered publicly exposed, since that would legally be the same as a Company X employee discovering a data breach, and GDPR’s data breach notification rules don’t come into play.

What about unvetted bug bounty hunters who discover a data breach as part of a bug bounty program? According to Joan Antokol, a GDPR expert, the EU’s data breach notification regulation applies to bug bounty platforms. Antokol is partner at Park Legal LLC and a longstanding member of the International Working Group on Data Protection in Technology (IWGDPT), which is chaired by the Berlin Data Protection Commissioner. She works closely with GDPR regulators.

“If a free agent hacker who signed up for a project via bug bounty companies to try to find vulnerabilities in the electronic systems of a bug bounty client (often a multinational company), was, in fact, able to access company personal data of the multinational via successful hacking into their systems,” she tells CSO, “the multinational (data controller) would have a breach notification obligation under the GDPR and similar laws of other countries.”

[…]

ISO 29147 standardizes how to receive security bug reports from an outside reporter for the first time and how to disseminate security advisories to the public.

ISO 30111 documents internal digestion of bug reports and remediation within an affected software maker. ISO provided CSO with a review copy of both standards, and the language is unambiguous.

These standards make clear that private bug bounty NDAs are not ISO compliant. “When non-disclosure is a required term or condition of reporting bugs via a bug bounty platform, that fundamentally breaks the process of vulnerability disclosure as outlined in ISO 29147,” Moussouris says. “The purpose of the standard is to allow for incoming vulnerability reports and [her emphasis] release of guidance to affected parties.”

ISO 29147 lists four major goals, including “providing users with sufficient information to evaluate risk due to vulnerabilities,” and lists eight different reasons why publishing security advisories is a standardized requirement, including “informing public policy decisions” and “transparency and accountability.” Further, 29147 says that public disclosure makes us all more secure in the long term. “The theory supporting vulnerability disclosure holds that the short-term risk caused by public disclosure is outweighed by longer-term benefits from fixed vulnerabilities, better informed defenders, and systemic defensive improvements.”

Source: Bug bounty platforms buy researcher silence, violate labor laws, critics say | CSO Online

Smart fridges are cool, but after a few short years you could be stuck with a big frosty brick in the kitchen

Posted on by

A report from consumer advocates Which? highlights the shockingly short lifespan of “smart” appliances, with some losing software support after just a few years, despite costing vastly more than “dumb” alternatives.

That lifespan varies between manufacturers: Most vendors were vague, with Beko offering “up to 10 years” and LG saying patches would be issued as required. Samsung said it would offer software support for a maximum of two years, according to the report.

Only one manufacturer, Miele, promised to issue software updates for a full decade after the release of a device, but then Miele tends to make premium priced products.

[…]

For consumers, that ambiguous (if not outright short) lifespan raises the possibility they could be forced to replace their expensive white goods before they otherwise would. According to the consumer watchdog, fridge-freezers typically last 11 years.

If a manufacturer decides to withdraw software support, or switch off central servers, users could find themselves with a big, frosty brick in their kitchen. In the wider IoT world, there’s precedent for this.

In 2016, owners of the Revolv smart home hub were infuriated after the Google-owned Nest deactivated the servers required for it to work. More recently, Belkin flicked the kill switch on its WeMo NetCam IP cameras, offering refunds only to those users whose devices were still in warranty and had the foresight to keep their receipts.

There’s another cause for concern. Given that smart appliances are essentially computers with a persistent connection to the internet, there’s a risk hackers could co-opt unpatched fridges and dishwashers, turning them into drones in vast botnets.

Again, there’s precedent. The Mirai botnet, for example, was effectively composed of hacked routers and IP cameras.

Source: Smart fridges are cool, but after a few short years you could be stuck with a big frosty brick in the kitchen • The Register

Secure the software development lifecycle with machine learning

Posted on by

At Microsoft, 47,000 developers generate nearly 30 thousand bugs a month. These items get stored across over 100 AzureDevOps and GitHub repositories. To better label and prioritize bugs at that scale, we couldn’t just apply more people to the problem. However, large volumes of semi-curated data are perfect for machine learning. Since 2001 Microsoft has collected 13 million work items and bugs. We used that data to develop a process and machine learning model that correctly distinguishes between security and non-security bugs 99 percent of the time and accurately identifies the critical, high priority security bugs, 97 percent of the time. This is an overview of how we did it.

Source: Secure the software development lifecycle with machine learning – Microsoft Security