To find the best parking spot, do the math

Posted on by

The next time you’re hunting for a parking spot, mathematics could help you identify the most efficient strategy, according to a recent paper in the Journal of Statistical Mechanics. It’s basically an optimization problem: weighing different variables and crunching the numbers to find the optimal combination of those factors. In the case of where to put your car, the goal is to strike the optimal balance of parking close to the target—a building entrance, for example—without having to waste too much time circling the lot hunting for the closest space.

Paul Krapivsky of Boston University and Sidney Redner of the Santa Fe Institute decided to build their analysis around an idealized parking lot with a single row (a semi-infinite line), and they focused on three basic parking strategies. A driver who employs a “meek” strategy will take the first available spot, preferring to park as quickly as possible even if there might be open spots closer to the entrance. A driver employing an “optimistic” strategy will go right to the entrance and then backtrack to find the closest possible spot.

Finally, drivers implementing a “prudent” strategy will split the difference. They might not grab the first available spot, figuring there will be at least one more open spot a bit closer to the entrance. If there isn’t, they will backtrack to the space a meek driver would have claimed immediately.

[…]

Based on their model, the scientists concluded that the meek strategy is the least effective of the three, calling it “risibly inefficient” because “many good parking spots are unfilled and most cars are parked far from the target.”

Determining whether the optimistic or prudent strategy was preferable proved trickier, so they introduced a cost variable. They defined it as “the distance from the parking spot to the target plus time wasted looking for a parking spot.” Their model also assumes the speed of the car in the lot is the same as average walking speed.

“On average, the prudent strategy is less costly,” the authors concluded. “Thus, even though the prudent strategy does not allow the driver to take advantage of the presence of many prime parking spots close to the target, the backtracking that must always occur in the optimistic strategy outweighs the benefit.” Plenty of people might indeed decide that walking a bit farther is an acceptable tradeoff to avoid endlessly circling a crowded lot hunting for an elusive closer space. Or maybe they just want to rack up a few extra steps on their FitBit.

The authors acknowledge some caveats to their findings. This is a “minimalist physics-based” model, unlike more complicated models used in transportation studies that incorporate factors like parking costs, time limits, and so forth. And most parking lots are not one-dimensional (a single row). The model used by the authors also assumes that cars enter the lot from the right at a fixed rate, and every car will have time to find a spot before the next car enters—a highly unrealistic scenario where there is no competition between cars for a given space. (Oh, if only…)

Source: To find the best parking spot, do the math | Ars Technica

US, UK and Australia want Zuckerberg To Halt Plans For End-To-End Encryption Across Facebook’s Apps – because they want to be able to spy on you. As will other criminals. What happened to the “Free world”?

Posted on by

Attorney General Bill Barr, along with officials from the United Kingdom and Australia, is set to publish an open letter to Facebook CEO Mark Zuckerberg asking the company to delay plans for end-to-end encryption across its messaging services until it can guarantee the added privacy does not reduce public safety.

A draft of the letter, dated Oct. 4, is set to be released alongside the announcement of a new data-sharing agreement between law enforcement in the US and the UK; it was obtained by BuzzFeed News ahead of its publication.

Signed by Barr, UK Home Secretary Priti Patel, acting US Homeland Security Secretary Kevin McAleenan, and Australian Minister for Home Affairs Peter Dutton, the letter raises concerns that Facebook’s plan to build end-to-end encryption into its messaging apps will prevent law enforcement agencies from finding illegal activity conducted through Facebook, including child sexual exploitation, terrorism, and election meddling.

Source: Attorney General Bill Barr Will Ask Zuckerberg To Halt Plans For End-To-End Encryption Across Facebook’s Apps

Bitcoin Isn’t the World’s Most-Used Cryptocurrency – it’s a centralised one run by some private company in Hong Kong

Posted on by

With Tether’s monthly trading volume about 18% higher than that of Bitcoin, it’s arguably the most important coin in the crypto ecosystem. Tether’s also one of the main reasons why regulators regard cryptocurrencies with a wary eye, and have put the breaks on crypto exchange-traded funds amid concern of market manipulation.

“If there is no Tether, we lose a massive amount of daily volume — around $1 billion or more depending on the data source,” said Lex Sokolin, global financial technology co-head at ConsenSys, which offers blockchain technology. “Some of the concerning potential patters of trading in the market may start to fall away.”

Coins With Biggest Daily Trading Volumes

In billions of U.S. dollars

Source: CoinMarketCap.com

Values as of Sept. 27, 2019

Tether is the world’s most used stablecoin, a category of tokens that seek to avoid price fluctuations, often through pegs or reserves. It’s also a pathway for most of the world’s active traders into the crypto market. In countries like China, where crypto exchanges are banned, people can pay cash over the counter to get Tethers with few questions asked, according to Sokolin. From there, they can trade Tethers for Bitcoin and other cryptocurrencies, he said.

“For many people in Asia, they like the idea that it’s this offshore, opaque thing out of reach of the U.S. government,” said Jeremy Allaire, chief executive officer of Circle, which supports a rival stablecoin called USD Coin. “It’s a feature, not a problem.”

Read more: A QuickTake explains the allure of stablcoins

Tether, which is being sued by New York for allegedly commingling funds including reserves, says using a know-your-customer form and approval process is required to issue and redeem the coin.

Asian traders account for about 70% of all crypto trading volume, according to Allaire, and Tether was used in 40% and 80% of all transactions on two of the world’s top exchanges, Binance and Huobi, respectively, Coin Metrics said earlier this year.

Many people don’t even know they use Tether, said Thaddeus Dryja, a research scientist at the Massachusetts Institute of Technology. Because traditional financial institutions worry that they don’t sniff out criminals and money launderers well enough, most crypto exchanges still don’t have bank accounts and can’t hold dollars on behalf of customers. So they use Tether as a substitute, Dryja said.

“I don’t think people actually trust Tether — I think people use Tether without realizing that they are using it, and instead think they have actual dollars in a bank account somewhere,” Dryja said. Some exchanges mislabel their pages, to convey the impression that customers are holding dollars instead of Tethers, he said.

Tether’s Market Cap Balloons

In U.S. dollars

Source: CoinMarketCap.com

The way Tether is managed and governed makes it a black box. While Bitcoin belongs to no one, Tether is issued by a Hong Kong-based private company whose proprietors also own the Bitfinex crypto exchange. The exact mechanism by which Tether’s supply is increased and decreased is unclear. Exactly how much of the supply is covered by fiat reserves is in question, too, as Tether is not independently audited. In April, Tether disclosed that 74% of the Tethers are covered by cash and short-term securities, while it previously said it had a 100% reserve.

The disclosure was a part of an ongoing investigation into Tether by the New York Attorney General, which accused the companies behind the coin of a coverup to hide the loss of $850 million of comingled client and corporate funds.

John Griffin, a finance professor at the University of Texas at Austin, said that half of Bitcoin’s runup in 2017 was the result of market manipulation using Tether. Last year Bloomberg reported that the U.S. Justice Department is investigating Tether’s role in this market manipulation.

Convenience Versus Risk

“Being controlled by centralized parties defeats the entire original purpose of blockchain and decentralized cryptocurrencies,” Griffin said. “By avoiding government powers, stablecoins place trust instead in the hands of big tech companies, who have mixed accountability. So while the idea is great in theory, in practice it is risky, open to abuse, and plagued by similar problems to traditional fiat currencies.”

Source: Bitcoin Isn’t the World’s Most-Used Cryptocurrency – Bloomberg

Egypt caught spying on journalists and human rights activists through malware and phishing

Posted on by

Back in March 2019, Amnesty International published a report that uncovered a targeted attack against journalists and human rights activists in Egypt. The victims even received an e-mail from Google warning them that government-backed attackers attempted to steal their passwords.

According to the report, the attackers did not rely on traditional phishing methods or credential-stealing payloads, but rather utilized a stealthier and more efficient way of accessing the victims’ inboxes: a technique known as “OAuth Phishing”. By abusing third-party applications for popular mailing services such as Gmail or Outlook, the attackers manipulated victims into granting them full access to their e-mails.

Fig 1: Previous OAuth phishing campaign

Recently, we were able to find previously unknown or undisclosed malicious artifacts belonging to this operation. A new website we attributed to this malicious activity revealed that the attackers are going after their prey in more than one way, and might even be hiding in plain sight: developing mobile applications to monitor their targets, and hosting them on Google’s official Play Store.

After we notified Google about the involved applications, they quickly took them off of the Play Store and banned the associated developer.

 

Infrastructure: The Early Days

The full list of indicators belonging to this campaign and shared by Amnesty on GitHub showed multiple websites that used keywords such as “mail”, “secure”, or “verify”, possibly not to arouse any suspicions and to masquerade as legitimate mailing services.

By visualizing the information available about each of these websites, we saw clear connections between them: they were registered using NameCheap, had HTTPS certificates, and many of them resolved to the same IP addresses.

The addresses shared the same IPv4 range or netblock (185.125.228[.]0/22), which belongs to a Russian telecommunications company called MAROSNET.

Fig 2: Maltego visualization of campaign infrastructure

Naturally, the websites cannot be accessed nowadays, but by looking over public scans available for some of them we could see that in addition to being related to OAuth phishing, they hosted phishing pages that impersonated Outlook or Facebook and tried to steal log-in credentials for those services

[…]

Following up on the investigation first conducted by Amnesty International, we revealed new aspects of the attack that has been after Egypt’s civil society since at least 2018.

Whether it is phishing pages, legitimate-looking applications for Outlook and Gmail, and mobile applications to track a device’s communications or location, it is clear that the attackers are constantly coming up with creative and versatile methods to reach victims, spy on their accounts, and monitor their activity.

We discovered a list of victims that included handpicked political and social activists, high-profile journalists and members of non-profit organizations in Egypt.

The information we gathered from our investigation suggested that the perpetrators are Arabic speakers, and well familiar with the Egyptian ecosystem. Because the attack might be government-backed, it means that we are looking at what might be a surveillance operation of a country against its own citizens or of another government that screens some other attack using this noisy one.

Source: The Eye on the Nile – Check Point Research

Paralysed man moves in mind-reading exoskeleton

Posted on by

A man has been able to move all four of his paralysed limbs with a mind-controlled exoskeleton suit, French researchers report.

Thibault, 30, said taking his first steps in the suit felt like being the “first man on the Moon”.

His movements, particularly walking, are far from perfect and the robo-suit is being used only in the lab.

But researchers say the approach could one day improve patients’ quality of life.

Thibault had surgery to place two implants on the surface of the brain, covering the parts of the brain that control movement

Sixty-four electrodes on each implant read the brain activity and beam the instructions to a nearby computer

Sophisticated computer software reads the brainwaves and turns them into instructions for controlling the exoskeleton

[…]

in 2017, he took part in the exoskeleton trial with Clinatec and the University of Grenoble.

Initially he practised using the brain implants to control a virtual character, or avatar, in a computer game, then he moved on to walking in the suit.

Media captionMind-controlled exoskeleton allows paralysed 30-year-old man to walk in French lab

“It was like [being the] first man on the Moon. I didn’t walk for two years. I forgot what it is to stand, I forgot I was taller than a lot of people in the room,” he said.

It took a lot longer to learn how to control the arms.

“It was very difficult because it is a combination of multiple muscles and movements. This is the most impressive thing I do with the exoskeleton.”

[…]

“This is far from autonomous walking,” Prof Alim-Louis Benabid, the president of the Clinatec executive board, told BBC News.

[…]

In tasks where Thibault had to touch specific targets by using the exoskeleton to move his upper and lower arms and rotate his wrists, he was successful 71% of the time.

Prof Benabid, who developed deep brain stimulation for Parkinson’s disease, told the BBC: “We have solved the problem and shown the principle is correct. This is proof we can extend the mobility of patients in an exoskeleton.

[…]

At the moment they are limited by the amount of data they can read from the brain, send to a computer, interpret and send to the exoskeleton in real-time.

They have 350 milliseconds to go from thought to movement otherwise the system becomes difficult to control.

It means out of the 64 electrodes on each implant, the researchers are using only 32.

So there is still the potential to read the brain in more detail using more powerful computers and AI to interpret the information from the brain.

Source: Paralysed man moves in mind-reading exoskeleton – BBC News

Iran tried to hack hundreds of politicians, journalists email accounts last month, warns Microsoft

Posted on by

The Iranian government has attempted to hack into hundreds of Office 365 email accounts belonging to politicians, government officials and journalists last month, Microsoft has warned.

“We’ve recently seen significant cyber activity by a threat group we call Phosphorous, which we believe originates from Iran and is linked to the Iranian government,” Microsoft’s vice president of customer security and trust Tom Burt said in a blog post on Friday.

Redmond’s bit wranglers observed more than 2,700 attempts to hack into 241 different accounts, according to the software giant. It noted that those accounts “are associated with a US presidential campaign, current and former US government officials, journalists covering global politics and prominent Iranians living outside Iran.”

Microsoft says that only four of the 241 accounts were compromised and none of them were connected to government officials or presidential campaigns. It says the accounts are now secure the owners are aware of the activity.

Notably, Microsoft says the hacking efforts were “not technically sophisticated” but used personal information gathered elsewhere to try to prompt password reset or account recovery in an effort to get into the accounts.

“For example, they would seek access to a secondary email account linked to a user’s Microsoft account, then attempt to gain access to a user’s Microsoft account through verification sent to the secondary account,” Microsoft explained.

It also appears that the hackers attempted to bypass two-factor authentication. “In some instances, they gathered phone numbers belonging to their targets and used them to assist in authenticating password resets,” the company said. It described the attackers as “highly motivated and willing to invest significant time and resources.”

Instead Microsoft proposes that people used its Authenticator app, which provides a login code that changes every 30 seconds in order to access their accounts.

How come Iran?

The company did not go into any detail over why it believes the Iranian government is behind the hacks beyond noting that those targeted included “prominent Iranians living outside Iran.” Presumably, it was able to identify the same pattern of hacking efforts with other accounts not directly connected with Iran and extrapolated from that.

Source: Iran tried to hack hundreds of politicians, journalists email accounts last month, warns Microsoft • The Register

Attackers exploit 0-day vulnerability that gives full control of Android phones

Posted on by

Attackers are exploiting a zero-day vulnerability in Google’s Android mobile operating system that can give them full control of at least 18 different phone models, including four different Pixel models, a member of Google’s Project Zero research group said on Thursday night.

There’s evidence the vulnerability is being actively exploited, either by exploit developer NSO Group or one of its customers, Project Zero member Maddie Stone said in a post. NSO representatives, meanwhile, said the “exploit has nothing to do with NSO.” Exploits require little or no customization to fully root vulnerable phones. The vulnerability can be exploited two ways: (1) when a target installs an untrusted app or (2) for online attacks, by combining the exploit with a second exploit targeting a vulnerability in code the Chrome browser uses to render content.

“The bug is a local privilege escalation vulnerability that allows for a full compromise of a vulnerable device,” Stone wrote. “If the exploit is delivered via the Web, it only needs to be paired with a renderer exploit, as this vulnerability is accessible through the sandbox.”

[…]

The use-after-free vulnerability originally appeared in the Linux kernel and was patched in early 2018 in version 4.14, without the benefit of a tracking CVE. That fix was incorporated into versions 3.18, 4.4, and 4.9 of the Android kernel. For reasons that weren’t explained in the post, the patches never made their way into Android security updates. That would explain why earlier Pixel models are vulnerable and later ones are not. The flaw is now tracked as CVE-2019-2215.

[…]

Project Zero gives developers 90 days to issue a fix before publishing vulnerability reports except in cases of active exploits. The Android vulnerability in this case was published seven days after it was privately reported to the Android team.

Source: Attackers exploit 0-day vulnerability that gives full control of Android phones | Ars Technica

The exploit has been seen being used in the wild, which is why it was disclosed after 7 days.

TensorFlow 2.0 is now available!

Posted on by

TensorFlow 2.0 is driven by the community telling us they want an easy-to-use platform that is both flexible and powerful, and which supports deployment to any platform. TensorFlow 2.0 provides a comprehensive ecosystem of tools for developers, enterprises, and researchers who want to push the state-of-the-art in machine learning and build scalable ML-powered applications.

Coding with TensorFlow 2.0

TensorFlow 2.0 makes development of ML applications much easier. With tight integration of Keras into TensorFlow, eager execution by default, and Pythonic function execution, TensorFlow 2.0 makes the experience of developing applications as familiar as possible for Python developers. For researchers pushing the boundaries of ML, we have invested heavily in TensorFlow’s low-level API: We now export all ops that are used internally, and we provide inheritable interfaces for crucial concepts such as variables and checkpoints. This allows you to build onto the internals of TensorFlow without having to rebuild TensorFlow.

Source: TensorFlow 2.0 is now available! – TensorFlow – Medium

TikTok Kicks Political Ads Off Its Platform Because Screw That Noise

Posted on by

The popular short-form video app will no longer run ads from politicians or candidates at any level of government because “the nature of paid political ads is not something we believe fits the TikTok platform experience,” TikTok’s VP of global business solutions, Blake Chandlee, announced in a blog post Thursday. This ban also covers “election-related ads, advocacy ads, or issue ads.”

And it’s true, TikTok didn’t become the fourth-largest social media platform in record time by facilitating debate and political discussions; we can already yell at each other on Facebook and Twitter for that. No, most users log on to TikTok to post silly lip-sync videos or their take on the newest trending hashtag, and if politics are mentioned it’s usually in reference to whatever’s the latest viral meme.

While TikTok has only begun experimenting with paid ad formats, Chandlee wrote that, throughout the process, the company is committed to preserving “the app’s light-hearted and irreverent feeling” that makes users want to spend their time there in the first place. Political ads often loaded with barbs aimed at tearing down opposing candidates just don’t vibe with that.

Source: TikTok Kicks Political Ads Off Its Platform Because Screw That Noise

Someone Created A Funny Guide On How To Recognize Famous Painters And It’s Surprisingly Accurate (19 Pics

Posted on by

If you’re not a big fan of classical art, you’d probably have a hard time pointing out what artist painted a certain painting. Well, your days of guessing are finally over – someone created a handy, albeit pretty hilarious, guide on how to recognize famous painters by their paintings and it’s surprisingly accurate.

The helpful guide, created by Reddit user DontTacoBoutIt, will help you recognize famous painters by pointing out the distinctive style elements in their paintings – in a hilarious way. From the Putin-like characters of Van Eyck to the chubby cupids of Boucher, check out this funny art guide in the gallery below!

#1 If Everyone – Including The Women – Looks Like Putin, Then It’s Van Eyck

Image source: flickerdart

Jan van Eyck

#2 If Everyone Looks Like Hobos Illuminated Only By A Dim Streetlamp, It’s Rembrandt

Image source: flickerdart

Rembrandt Harmenszoon van Rijn

#3 If It’s Something You Saw On Your Acid Trip Last Night, It’s Dali

Image source: flickerdart

Salvador Dalí

#4 If The Paintings Have Lots Of Little People In Them But Also Have A Ton Of Crazy Bulls#%t, It’s Bosch

Image source: flickerdart

Hieronymus Bosch

#5 If Everybody Has Some Sort Of Body Malfunction, Then It’s Picasso

Image source: flickerdart

Pablo Ruiz Picasso

#6 Lord Of The Rings Landscapes With Weird Blue Mist And The Same Wavy-Haired Aristocratic-Nose Madonna, It’s Da Vinci

Image source: flickerdart

Leonardo da Vinci

#7 Dappled Light And Unhappy Party-Time People, Then It’s Manet

Image source: flickerdart

Édouard Manet

#8 If You See A Ballerina, It’s Degas

Image source: flickerdart

Edgar Degas

#9 Dappled Light But No Figures, It’s Monet

Image source: flickerdart

Claude Monet

#10 If Everyone Is Beautiful, Naked, And Stacked, It’s Michelangelo

Image source: flickerdart

Michelangelo di Lodovico Buonarroti Simoni

#11 Dappled Light And Happy Party-Time People, It’s Renoir

Image source: flickerdart

Pierre-Auguste Renoir

#12 If The Images Have A Dark Background And Everyone Has Tortured Expressions On Their Faces, It’s Titian

Image source: flickerdart

Tiziano Vecelli

#13 Excel Sheet With Coloured Squares, It’s Mondrian

Image source: flickerdart

Piet Mondrian

#14 If All The Men Look Like Cow-Eyed Curly-Haired Women, It’s Caravaggio

Image source: flickerdart

Michelangelo Merisi da Caravaggio

#15 If The Paintings Have Tons Of Little People In Them But Otherwise Seem Normal, It’s Bruegel

Image source: flickerdart

Pieter Bruegel the Elder

#16 If Everyone In The Paintings Has Enormous Asses, Then It’s Rubens

Image source: flickerdart

Sir Peter Paul Rubens

#17 If Every Painting Is The Face Of A Uni-Browed Woman, It’s Frida

Image source: flickerdart

Frida Kahlo

#18 If Everything Is Highly-Contrasted And Sharp, Sort Of Bluish, And Everyone Has Gaunt Bearded Faces, It’s El Greco

Image source: flickerdart

Doménikos Theotokópoulos – El Greco (“The Greek”)

#19 If The Painting Could Easily Have A Few Chubby Cupids Or Sheep Added (Or Already Has Them), It’s Boucher

Image source: flickerdart

François Boucher

Source: Someone Created A Funny Guide On How To Recognize Famous Painters And It’s Surprisingly Accurate (19 Pics) | DeMilked

Posted in Art

Scientists Uncover New Organic Molecules Coming Off Saturn’s Moon Enceladus

Posted on by

Scientists have discovered nitrogen- and oxygen- containing organic molecules in ice grains blown out by Saturn’s moon Enceladus, according to a new study.

Gas giants Saturn and Jupiter are orbited by some moons that almost seem more like planets themselves. One such moon is Saturn’s Enceladus, an icy orb thought to contain a very deep subsurface water ocean beneath a thick icy crust. Finding organic molecules on Enceladus is exciting, since water plus energy plus organic molecules might be the ingredients for life.

Enceladus blasted the material out in plumes from cracks in its south polar crust. The plumes carry a mixture of material from the moon’s rocky core and subsurface ocean. The Cassini mission flew through these plumes in 2004 and 2008, gathering data on the material with two of its instruments, the Ion and Neutral Mass Spectrometer (INMS) and the Cosmic Dust Analyser (CDA). For the new study, researchers based in Germany and the United States took a deeper look at the CDA’s data and found new organic compounds, according to the paper published in the Monthly Notices of the Royal Astronomical Society.

The molecules included amines, which are nitrogen- and oxygen-containing organic molecules similar to those on Earth that turn into amino acids. As a reminder, “organic” in this case simply means “containing carbon,” though these are the kind of compounds that can produce the complex molecules found in life on Earth.

[…]

Scientists have previously reported finding large organic molecules in Cassini data. This paper presents a new kind of molecule, one of interest to those hunting for life.

Source: Scientists Uncover New Organic Molecules Coming Off Saturn’s Moon Enceladus

silk is proven to thrive in outer space temperatures

Posted on by

Their initial discovery had seemed like a contradiction because most other polymer fibres embrittle in the cold. But after many years of working on the problem, the group of researchers have discovered that silk’s cryogenic toughness is based on its nano-scale fibrills. Sub-microscopic order and hierarchy allows a silk to withstand temperatures of down to -200 C. And possibly even lower, which would make these classic natural luxury fibres ideal for applications in the depths of chilly outer-space.

The interdisciplinary team examined the behaviour and function of several animal silks cooled down to liquid nitrogen temperature of -196 C. The fibres included spider silks but the study focused on the thicker and much more commercial fibres of the wild silkworm Antheraea pernyi.

In an article published today in Materials Chemistry Frontiers, the team was able to show not only ‘that’ but also ‘how’ silk increases its toughness under conditions where most materials would become very brittle. Indeed, silk seems to contradict the fundamental understanding of polymer science by not losing but gaining quality under really cold conditions by becoming both stronger and more stretchable. This study examines the ‘how’ and explains the ‘why’. It turns out that the underlying processes rely on the many nano-sized fibrils that make up the core of a silk fibre.

[…]

It would appear that this study has far-reaching implications by suggesting a broad spectrum of novel applications for silks ranging from new materials for use in Earth’s polar regions to novel composites for light-weight aeroplanes and kites flying in the strato- and meso-sphere to, perhaps, even giant webs spun by robot spiders to catch astro-junk in space.

Source: A filament fit for space—silk is proven to thrive in outer space temperatures

U.S. Plans to Test DNA of Immigrants in Detention Centers

Posted on by

The Trump administration is moving to start testing the DNA of people detained by U.S. immigration officers, according to reports of call on Wednesday between senior Department of Homeland Security (DHS) officials and reporters.

Justice Department officials are reportedly developing a new rule that would allow immigration officers to begin collecting the private genetic information of those being held in the more than 200 prison-like facilities spread across the U.S.

The New York Times reported that Homeland Security officials said the testing is part of a plan to root out “fraudulent family units.” Children and people applying for asylum at legal ports of entry may be tested under the proposed rule, which is likely to elicit strong concerns from privacy and immigration advocates in coming days.

The officials also said the DNA of U.S. citizens mistakenly booked in the facilities could be collected, according to the Times.

DHS did not respond to a request for comment.

Source: U.S. Plans to Test DNA of Immigrants in Detention Centers

Zimbabwe shuts down mobile money because cash is being sold at a premium of 50%: basically two competing currencies with the same label

Posted on by

Mobile money is fast blossoming in Africa, boosted by rising mobile adoption across the continent, but in Zimbabwe—which is battling a severe financial crunch—the most common cash-in and cash-out functionalities have just been killed off as the government battles to contain the country’s economic crisis.

Cash-out is process of converting mobile wallet balances into hard cash while cash-in refers to the process of depositing cash into a mobile wallet. Mobile money agents facilitate these processes and normally, the agents have to get the cash from banks against their mobile money balances which are referred to as “float”. These agents then act as mini banks, basically facilitating deposit or withdrawal of cash (cash-in and cash out respectively) by account holders from mobile wallets.

These functionalities, in addition to sending and receiving money as well as payments at supermarkets and other merchants and cross transfers from and into bank accounts constitute the most impactful financial inclusion use cases that mobile money is hinged on across Africa. Success cases also include Kenya and Tanzania while MTN is ready to roll out mobile money in Nigeria.

Yet in Zimbabwe, cash-in and cash-out has just been killed off by the government, because authorities have concluded the functions are being abused. Zimbabwean mobile money agents, mostly with the dominant EcoCash platform, have been capitalizing on cash shortages in Zimbabwe to buy cash for re-sale to mobile wallet holders at a premium of up to 50%. This means that when trying to access funds in your mobile wallet through the agents, one would only get about 50% of their balance.

[…]

This has given rise to the high premiums on cash and also occasioned heavy discounts for cash purchases in retail outlets. However, the Reserve Bank of Zimbabwe justified the freeze on mobile money cash-in and cash-out functionalities, saying on Monday “some economic agents are engaging in illegal activities abusing the cash-in and cash-out facilities” which was compromising national payment systems.

[…]

Large chunks of the country’s economy runs through electronic systems and mobile money, which is dominated by Econet’s Ecocash with 95% market share. It’s estimated around 5 million transactions a day moving more than $200 million.

Most recently Ecocash has struggled to maintain the mobile money system working round the clock as the country has been hit with electricity shortages which have forced it to consider options including Tesla Powerwall storage batteries.

Source: Zimbabwe shuts down mobile money cash options with ecocash — Quartz Africa

​Docker has a business plan headache, another showcase for FOSS money making failure

Posted on by

We love containers. And, for most of us, containers means Docker. As RightScale observed in its RightScale 2018 State of the Cloud report, Docker’s adoption by the industry has increased to 49 percent from 35 percent in 2017.

All’s not well in Docker-land

There’s only one problem with this: While Docker, the technology, is going great guns, Docker, the business, isn’t doing half as well.

[…]

What’s the business plan?

Docker’s problem is simple: It doesn’t have a viable business plan.

It’s not the market. According to 451 Research, “the application container market will explode over the next five years. Annual revenue is expected to increase by 4x, growing from $749 million in 2016 to more than $3.4 billon by 2021, representing a compound annual growth rate (CAGR) of 35 percent.”

But to make that revenue, you need a business that can exploit containers. So, Google, Microsoft, Amazon Web Services (AWS), and all the rest of the big public cloud companies, earn their dollars from customers eager to make the most of their server resources. Others, like Red Hat/CoreOS, Canonical, and Mirantis, provide easy-to-use container approaches for private clouds.

Docker? It provides the open-source framework for the most popular container format. That’s great, but it’s not a business plan.

[…]

Docker’s plan had been, according to former CEO Ben Golub, to build up a subscription business model. The driver behind its Enterprise Edition, with its three levels of service and functionality, was container orchestration using Docker Engine’s swarm mode. Docker, the company, also rebranded Docker, the open-source software, to Moby while continuing to use Docker as the name for its commercial software products.

This led to more than a little confusion. Quick! How many of you knew Moby was now the “official” name for Docker the program? Confusion is not what you want in sales.

Mere weeks later, Golub was out, and Steve Singh, from SAP, was in.

[…]

As Dave Bartoletti, a Forrester analyst, told The Register at the time: “The poor guy has to figure out how to make money at Docker. That’s not easy when a lot of people in the community just bristle at anyone trying to make money.”

The rise of Kubernetes

Making matters much harder for Docker’s business plans is that Docker swarm and all other orchestration programs have found themselves overwhelmed by the rise of Kubernetes.

Today, Kubernetes — whether it’s a grand Google plan to create a Google cloud stack or not — dominates cloud orchestration. Even Docker adopted Kubernetes because of customer demand in October 2017.

When your main value-add is container orchestration and everyone and their uncle has adopted another container orchestration program, what can you offer customers? Good question.

[…]

In the last few months, Docker raised another $75 million in venture capital. This brings the total capitalization of Docker to a rather amazing $250 million from ME Cloud Ventures, Benchmark, Coatue Management, Goldman Sachs, and Greylock Partners. That’s a lot of money, but I still don’t see how Docker will pay out.

Cash from investors is great, but what Docker really needs is cash from customers.

For most enterprise users, there are no real worries here. Docker or Moby, the container standard is both open source and an open standard. For Docker investors, well, that’s another story.

Source: ​Docker has a business plan headache | ZDNet

This article suggests that if Docker the company goes bust, it won’t be a problem for Docker users because it’s open source and the community will pick it up and continue development. Unfortunately it’s often the case that the “community” are just the people reporting the bugs and it’s the original handful of developers that are all the people writing the bugfixes and carrying the project forward. In this case it’s a great team of people, who – if they are out of a job – will probably disband and the project will be forked by an internet giant who will repurpose for their own needs and wants.

What is more important is that this is yet another showcase for a hugely popular FOSS project showcasing how ridiculously impossible it is to make money. FOSS needs to change.

ETSI launches specification group on Securing Artificial Intelligence

Posted on by

ETSI is pleased to announce the creation of a new Industry Specification Group on Securing Artificial Intelligence (ISG SAI). The group will develop technical specifications to mitigate threats arising from the deployment of AI throughout multiple ICT-related industries. This includes threats to artificial intelligence systems from both conventional sources and other AIs.

The ETSI Securing Artificial Intelligence group was initiated to anticipate that autonomous mechanical and computing entities may make decisions that act against the relying parties either by design or as a result of malicious intent. The conventional cycle of networks risk analysis and countermeasure deployment represented by the Identify-Protect-Detect-Respond cycle needs to be re-assessed when an autonomous machine is involved.

The intent of the ISG SAI is therefore to address 3 aspects of artificial intelligence in the standards domain:

  • Securing AI from attack e.g. where AI is a component in the system that needs defending
  • Mitigating against AI e.g. where AI is the ‘problem’ or is used to improve and enhance other more conventional attack vectors
  • Using AI to enhance security measures against attack from other things e.g. AI is part of the ‘solution’ or is used to improve and enhance more conventional countermeasures.

The purpose of the ETSI ISG SAI is to develop the technical knowledge that acts as a baseline in ensuring that artificial intelligence is secure. Stakeholders impacted by the activity of ETSI’s group include end users, manufacturers, operators and governments.

Source: ETSI – ETSI launches specification group on Securing Artificial Intelligence

EU court of justice rules opt in is not on if the tickbox is pre ticked

Posted on by

In a court case vs Planet 49 the EU has ruled that you can’t start collecting data just by showing a warning that you are doing so or by having a preselected tickbox stating it’s OK to collect data. The user has to actually go and click the tickbox or OK before any data collection is allowed.

the consent referred to in those provisions is not validly constituted if, in the form of cookies, the storage of information or access to information already stored in a website user’s terminal equipment is permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent.

Source: CURIA – Documents

This is a good thing which fights off dark patterning – forcing users into things  they don’t consent to or understand, of which there is more than enough of thank you very much.

EC rules make household appliances more sustainable by forcing right to repair

Posted on by

In a continued effort to reduce Europe’s carbon footprint and to make energy bills cheaper for European consumers, the Commission today adopted new eco-design measures for products such as refrigerators, washing machines, dishwashers and televisions.Improving the ecodesign of products contributes to implementing the ‘Energy efficiency first’ principle of the EU’s Energy Union priority. For the first time the measures include requirements for repairability and recyclability, contributing to circular economy objectives by improving the life span, maintenance, re-use, upgrade, recyclability and waste handling of appliances.

[…]

After a consultation process, the Commission has adopted 10 ecodesign implementing Regulations, setting out energy efficiency and other requirements for the following product groups: refrigerators; washing machines; dishwashers; electronic displays (including televisions); light sources and separate control gears; external power supplies; electric motors; refrigerators with a direct sales function (e.g. fridges in supermarkets, vending machines for cold drinks); power transformers; and welding equipment.

Source: European Commission – PRESS RELEASES – Press release – New rules make household appliances more sustainable

Thousands of ships fitted with ‘cheat devices’ to divert poisonous pollution into sea

Posted on by

Global shipping companies have spent billions rigging vessels with “cheat devices” that circumvent new environmental legislation by dumping pollution into the sea instead of the air, The Independent can reveal.

More than $12bn (£9.7bn) has been spent on the devices, known as open-loop scrubbers, which extract sulphur from the exhaust fumes of ships that run on heavy fuel oil.

This means the vessels meet standards demanded by the International Maritime Organisation (IMO) that kick in on 1 January.

However, the sulphur emitted by the ships is simply re-routed from the exhaust and expelled into the water around the ships, which not only greatly increases the volume of pollutants being pumped into the sea, but also increases carbon dioxide emissions.

The change could have a devastating effect on wildlife in British waters and around the world, experts have warned.

Source: Thousands of ships fitted with ‘cheat devices’ to divert poisonous pollution into sea | The Independent

MS really really wants to know who is using Windows, make it very hard for Win 10 users to create local accounts.

Posted on by

Microsoft has annoyed some of its 900 million Windows 10 device users after apparently removing the ‘Use offline account’ as part of its effort to herd users towards its cloud-based Microsoft Account.

The offline local account is specific to one device, while the Microsoft Account can be used to log in to multiple devices and comes with the benefit of Microsoft’s recent work on passwordless authentication with Windows Hello.

The local account doesn’t require an internet connection or an email address – just a username and password that are stored on the PC

[…]

A user on a popular Reddit thread notes that the local account option is now invisible if the device is connected to the internet.

“Either run the setup without being connected to the internet, or type in a fake phone number a few times and it will give you the prompt to create a local account,” Froggyowns suggested as a solution.

So there is a way around the obstacle but as Reddit user Old_Traveller noted: “It’s such a dick move. I’ll never tie my main OS with an online account.”

[…]

as a user on Hacker News wrote, Microsoft has changed the name of the local account option to ‘Domain join instead’, which then allows admins to create an offline account.

Windows 10 users are accusing Microsoft of employing ‘dark-pattern’ techniques to usher them off local accounts, referring to tricks on websites that software makers use to choose an option that benefits the seller.

Source: Windows 10 users fume: Microsoft, where’s our ‘local account’ option gone? | ZDNet

My PC is at home. Microsoft, who sell the OS, have no right to know who I am or what I am doing with MY PC.

House Antitrust Investigators Now Scrutinizing Google’s Plans to Add DNS Encryption to Chrome

Posted on by

Antitrust investigators with the House Judiciary Committee are looking into Google’s plans to add Domain Name System over Transport Layer Security (DNS over TLS) to its Chrome browser, the Wall Street Journal reported on Sunday, in the latest escalation of scrutiny over the company’s business practices. The Department of Justice has also heard complaints, a source told the paper.

DNS translates a domain name (such as Gizmodo.com) into an IP address. It’s essentially an internet phonebook. While encryption tech like HTTPS is already in place across much of the web, DNS is currently largely unencrypted by default, meaning it’s possible for service providers to ascertain which web sites a user is visiting and thus monetize traffic records.

Google has reportedly been integrating TLS, an additional layer of encryption, into DNS in Chrome—which the Journal notes could protect users against spoofing attacks or unauthorized snooping into their web traffic, but could also prevent the many “service providers who don’t support the new standard from observing user behavior in gathering data.” Opponents have also raised concerns that as Google controls 64 percent of the worldwide browser market and operates its own DNS system, Google Public DNS, the company could flip a switch transferring Chrome users away from service provider-operated DNS. That, the critics say, could allow Google to gain an unfair advantage over user behavior data invaluable for advertising purposes.

In a Sept. 13 letter to the company, investigators with the House committee asked Google for more information on why it is promoting DNS over TLS and whether any of the data collected or processed will be used for profit, the Journal wrote.

“Because the majority of world-wide internet traffic…runs through the Chrome browser or the Android operating system, Google could become the overwhelmingly predominant DNS lookup provider,” a coalition of service providers wrote in a letter to lawmakers this month, per the Journal. “Google would acquire greater control over user data across networks and devices around the world. This could inhibit competitors and possibly foreclose competition in advertising and other industries.”

“Right now, each internet service provider has insight into the traffic of their users, and that’s going to shift,” chief security officer Andy Ellis of Akamai, which does not support the new standard, told the Journal.

Google is planning on starting tests with the new protocol involving one percent of its user base, a less “aggressive strategy” than Mozilla’s Firefox, which the Journal wrote plans to switch users “to the new standard automatically, even if the change involves switching their DNS service providers.” Google denied that it has any plans to become “the centralized DNS provider,” while Mozilla has characterized the issue as griping by service providers who fear it will make it harder to track users for ad purposes,

[…]

Source: House Antitrust Investigators Now Scrutinizing Google’s Plans to Add DNS Encryption to Chrome

There are many problems and advantages with DNS over TLS – basically you make the browser the resolver instead of the (many) DNS providers. This means that you cannot add a private, secret, DNS provider or ISP and not let Google (or Mozilla) know. Countries where censorship exists only have to call these guys up for information on where their websurfing netizens are going. On the other hand, ISPs now have no idea where they are heading.

This happened when SSL/TLS was enforced and suddenly none of the other website statistics providers had any idea how the traffic on the site got there, with the result that almost all of them have died out. There is no real choice but Google Analytics any more for referral traffic, because such a large amount is referred from Google.

Flying Replacement Batteries Could Massively Boost a Drone’s Flight Time

Posted on by

Borrowing a trick from the Air Force, whose planes can complete long-range missions thanks to in-flight refueling from tanker aircraft, researchers at UC Berkeley showed off a novel way to keep small drones in the air almost indefinitely: flying replacement batteries that can be swapped without landing.

The use of four propellers not only helps improve the stability of quadcopter drones while hovering in position, it also makes them incredibly maneuverable and fast. Drone racing has become a dizzying spectacle, but races rarely last longer than a few minutes because four propellers also require four electric motors which can quickly drain a battery. Adding more batteries adds weight, which requires stronger motors, and eventually you reach the point where the length of drone flights reaches a limit and fresh batteries are needed.

For drone racers, swapping in a new power pack between races isn’t a problem. But for other drone applications, like long-range reconnaissance missions or delivering parcels across a large city, having to land to recharge or grab a new battery can add unwanted complications and time delays. Seeking a different solution, researchers at UC Berkeley’s HiPeR Lab (High Performance Robotics Lab) came up with replacement batteries that can not only fly, but also connect to larger drones mid-flight.

To streamline the battery swapping process, which usually requires a cable to be unplugged and plugged back in, the researchers created a quadcopter with a landing pad featuring electrical contact pads on top. The replacement batteries have their own sets of propellers and motors and are designed to fly up and meet the larger drone and then touch down on the landing pad after the craft has stabilized itself. Power is then transferred through the battery’s landing legs, which feature electrical contacts.

Source: Flying Replacement Batteries Could Massively Boost a Drone’s Flight Time

Facebook, WhatsApp Will Have to Share Messages With U.K. Police, breaking encryption. Don’t they realises this gives criminals access too?

Posted on by

Social media platforms based in the U.S. including Facebook and WhatsApp will be forced to share users’ encrypted messages with British police under a new treaty between the two countries, according to a person familiar with the matter.

The accord, which is set to be signed by next month, will compel social media firms to share information to support investigations into individuals suspected of serious criminal offenses including terrorism and pedophilia, the person said.

Priti Patel, the U.K.’s home secretary, has previously warned that Facebook’s plan to enable users to send end-to-end encrypted messages would benefit criminals, and called on social media firms to develop “back doors” to give intelligence agencies access to their messaging platforms.

The U.K. and the U.S. have agreed not to investigate each other’s citizens as part of the deal, while the U.S. won’t be able to use information obtained from British firms in any cases carrying the death penalty.

Source: Facebook, WhatsApp Will Have to Share Messages With U.K. Police – BNN Bloomberg

Not being able to encrypt stuff ends up benifitting criminals just as much as it does the police, because they will also be able to access the poorly secured information.

Massive wave of account hijacks hits YouTube car community creators, bypassing 2FA

Posted on by

Over the past few days, a massive wave of account hijacks has hit YouTube users, and especially creators in the auto-tuning and car review community, a ZDNet investigation discovered following a tip from one of our readers.

Several high-profile accounts from the YouTube creators car community have fallen victim to these attacks already. The list includes channels such as Built [Instagram post, YouTube channel], Troy Sowers [Instagram post, YouTube channel], MaxtChekVids [YouTube channel], PURE Function [Instagram post, YouTube Support post, YouTube channel], and Musafir [Instagram post, YouTube channel].

But the YouTube car community wasn’t the only one targeted. Other YouTube creatorss also reported having their accounts hijacked last week, and especially over the weekend, with tens of complaints flooding Twitter [1, 2, 3, 4, 5, 6, 7, 8, 9, and many more] and the YouTube support forum [1, 2, 3, 4, 5, 6, 7, 8, 9, and many more].

Coordinated campaign bypassed 2FA

The account hacks are the result of a coordinated campaign that consisted of messages luring users to phishing sites, where hackers logged account credentials.

According to a channel owner who managed to recover their account before this article’s publication and received additional information from YouTube’s staff, we got some insight into how the full attack chain might have gone down.

  • Hackers use phishing emails to lure victims on fake Google login pages, where they collect users’ account credentials
  • Hackers break into Google accounts
  • Hackers re-assign popular channels to new owners
  • Hackers change the channel’s vanity URL, giving the original account owner and his followers the impression that their account had been deleted.
youtube-hacked.png
mage: ZDNet

Some users reported receiving individual emails, while others said they received email chains that included the addresses of multiple YouTube creators, usually from the same community or niche.

This is what appears to have happened with the phishing attacks that targeted the YouTube creators car community, according to a YouTube video from Life of Palos, uploaded over the weekend — see 01:50 video mark.

The same Life of Palos also reported that hackers were capable of bypassing two-factor authentication on users’ accounts. He suggested that hackers might have used Modlishka, a reverse proxy-based phishing toolkit that can also intercept 2FA SMS codes.

However, this is only hearsay, and there is no actual evidence to confirm that hackers used Modlishka specifically. There are plenty of reverse proxy-based phishing toolkits around that can do the same.

Nevertheless, Ryan Scott, the owner of the PURE Function YouTube channel confirmed he used two-factor authentication on his account, validating that hackers did bypass 2FA on some of the hacked accounts.

Source: Massive wave of account hijacks hits YouTube creators | ZDNet

Both YouTube and Facebook allow politicians to ignore their community standards.

Posted on by

Facebook this week finally put into writing what users—especially politically powerful users—have known for years: its community “standards” do not, in fact, apply across the whole community. Speech from politicians is officially exempt from the platform’s fact checking and decency standards, the company has clarified, with a few exceptions.

Facebook communications VP Nick Clegg, himself a former member of the UK Parliament, outlined the policy in a speech and company blog post Tuesday.

Facebook has had a “newsworthiness exemption” to its content guidelines since 2016. That policy was formalized in late October of that year amid a contentious and chaotic US political season and three weeks before the presidential election that would land Donald Trump the White House.

Facebook at the time was uncertain how to handle posts from the Trump campaign, The Wall Street Journal reported. Sources told the paper that Facebook employees were sharply divided over the candidate’s rhetoric about Muslim immigrants and his stated desire for a Muslim travel ban, which several felt were in violation of the service’s hate speech standards. Eventually, the sources said, CEO Mark Zuckerberg weighed in directly and said it would be inappropriate to intervene. Months later, Facebook finally issued its policy.

“We’re going to begin allowing more items that people find newsworthy, significant, or important to the public interest—even if they might otherwise violate our standards,” Facebook wrote at the time.

Clegg’s update says that Facebook by default “will treat speech from politicians as newsworthy content that should, as a general rule, be seen and heard.” Nor will it be subject to fact-checking, as the company does not believe that it is appropriate for it to “referee political debates” or prevent a polician’s speech from both reaching its intended audience and “being subject to public debate and scrutiny.”

https://arstechnica.com/tech-policy/2019/09/facebook-confirms-its-standards-dont-apply-to-politicians/

YouTube CEO Susan Wojcicki said today that content by politicians would stay up on the video-sharing website even if it violates the company’s standards, echoing a position staked out by Facebook this week.

“When you have a political officer that is making information that is really important for their constituents to see, or for other global leaders to see, that is content that we would leave up because we think it’s important for other people to see,” Wojcicki told an audience at The Atlantic Festival this morning.

Wojcicki said the news media is likely to cover controversial content regardless of whether it’s taken down, giving context to understand it. YouTube is owned by Google.

A YouTube spokesperson later told POLITICO that politicians are not treated differently than other users and must abide by its community guidelines. The company grants exemptions to some political speech if the company considers it to be educational, documentary, scientific, or artistic in nature.Morning Tech

Social media firms have seen their policies for reviewing and removing content come under fire in recent years, particularly when such content endorses hate-filled views or incites real-world violence. The issue is even more prickly when it involves world leaders like President Donald Trump, who has used bullying or violent language in social media posts.

YouTube CEO: Politicians can break our content rules

But what constitutes a politician? Anyone in or running for office? What about public servants? County sherrifs? And who decides which of these groups are exempt? That’s the problem with exceptions, you get to make more and more exceptions until almost everyone is an exception.