Switzerland now requires all government software to be open source. Sort of.

Posted on by

Several European countries are betting on open-source software. In the United States, eh, not so much. In the latest news from across the Atlantic, Switzerland has taken a major step forward with its “Federal Law on the Use of Electronic Means for the Fulfillment of Government Tasks” (EMBAG). This groundbreaking legislation mandates using open-source software (OSS) in the public sector.

This new law requires all public bodies to disclose the source code of software developed by or for them unless third-party rights or security concerns prevent it. This “public money, public code” approach aims to enhance government operations’ transparency, security, and efficiency.

[…]

Source: Switzerland now requires all government software to be open source | ZDNET

The Netherlands has a similar law, but you would be amazed how flimsy the accepted excuses are that claim that software should be delivered under a closed-source exception.

Google’s reCAPTCHAv2 is just labor exploitation, boffins say

Posted on by

Google promotes its reCAPTCHA service as a security mechanism for websites, but researchers affiliated with the University of California, Irvine, argue it’s harvesting information while extracting human labor worth billions.

The term CAPTCHA stands for “Completely Automated Public Turing test to tell Computers and Humans Apart,” and, as Google explains, it refers to a challenge-response authentication scheme that presents people with a puzzle or question that a computer cannot solve.

[…]

The utility of reCAPTCHA challenges appears to be significantly diminished in an era when AI models can answer CAPTCHA questions almost as well as humans.

Show me the money

UC Irvine academics contend CAPTCHAs should be binned.

In a paper [PDF] titled “Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2,” authors Andrew Searles, Renascence Tarafder Prapty, and Gene Tsudik argue that the service should be abandoned because it’s disliked by users, costly in terms of time and datacenter resources, and vulnerable to bots – contrary to its intended purpose.

“I believe reCAPTCHA’s true purpose is to harvest user information and labor from websites,” asserted Andrew Searles, who just completed his PhD and was the paper’s lead author, in an email to The Register.

“If you believe that reCAPTCHA is securing your website, you have been deceived. Additionally, this false sense of security has come with an immense cost of human time and privacy.”

The paper, released in November 2023, notes that even back in 2016 researchers were able to defeat reCAPTCHA v2 image challenges 70 percent of the time. The reCAPTCHA v2 checkbox challenge is even more vulnerable – the researchers claim it can be defeated 100 percent of the time.

reCAPTCHA v3 has fared no better. In 2019, researchers devised a reinforcement learning attack that breaks reCAPTCHAv3’s behavior-based challenges 97 percent of the time.

[…]

The authors’ research findings are based on a study of users conducted over 13 months in 2022 and 2023. Some 9,141 reCAPTCHAv2 sessions were captured from unwitting participants and analyzed, in conjunction with a survey completed by 108 individuals.

Respondents gave the reCAPTCHA v2 checkbox puzzle 78.51 out of 100 on the System Usability Scale, while the image puzzle rated only 58.90. “Results demonstrate that 40 percent of participants found the image version to be annoying (or very annoying), while <10 percent found the checkbox version annoying,” the paper explains.

But when examined in aggregate, reCAPTCHA interactions impose a significant cost – some of which Google captures.

“In terms of cost, we estimate that – during over 13 years of its deployment – 819 million hours of human time has been spent on reCAPTCHA, which corresponds to at least $6.1 billion USD in wages,” the authors state in their paper.

“Traffic resulting from reCAPTCHA consumed 134 petabytes of bandwidth, which translates into about 7.5 million kWhs of energy, corresponding to 7.5 million pounds of CO2. In addition, Google has potentially profited $888 billion from cookies [created by reCAPTCHA sessions] and $8.75–32.3 billion per each sale of their total labeled data set.”

Asked whether the costs Google shifts to reCAPTCHA users in the form of time and effort are unreasonable or exploitive, Searles pointed to the original white paper on CAPTCHAs by Luis von Ahn, Manuel Blum, and John Langford – which includes a section titled “Stealing cycles from humans.”

[…]

As the paper points out, image-labeling challenges have been around since 2004 and by 2010 there were attacks that could beat them 100 percent of the time. Despite this, Google introduced reCAPTCHA v2 with a fall-back image recognition security challenge that had been proven to be insecure four years earlier.

This makes no sense, the authors argue, from a security perspective. But it does make sense if the goal is obtaining image labeling data – the results of users identifying CAPTCHA images – which Google happens to sell as a cloud service.

“The conclusion can be extended that the true purpose of reCAPTCHA v2 is a free image-labeling labor and tracking cookie farm for advertising and data profit masquerading as a security service,” the paper declares.

[…]

Source: Google’s reCAPTCHAv2 is just labor exploitation, boffins say • The Register

UN Cybercrime Treaty does not define cybercrime, allows any definition and forces all signatories to secretly surveil their own population on request by any other signatory (think totalitarian states spying on people in democracies with no recourse)

Posted on by

[…] EFF colleague, Katitza Rodriguez, about the Cybercrime Treaty, which is about to pass, and which is, to put it mildly, terrifying:

https://www.eff.org/deeplinks/2024/07/un-cybercrime-draft-convention-dangerously-expands-state-surveillance-powers

Look, cybercrime is a real thing, from pig butchering to ransomware, and there’s real, global harms that can be attributed to it. Cybercrime is transnational, making it hard for cops in any one jurisdiction to handle it. So there’s a reason to think about formal international standards for fighting cybercrime.

But that’s not what’s in the Cybercrime Treaty.

Here’s a quick sketch of the significant defects in the Cybercrime Treaty.

The treaty has an extremely loose definition of cybercrime, and that looseness is deliberate. In authoritarian states like China and Russia (whose delegations are the driving force behind this treaty), “cybercrime” has come to mean “anything the government disfavors, if you do it with a computer.” “Cybercrime” can mean online criticism of the government, or professions of religious belief, or material supporting LGBTQ rights.

Nations that sign up to the Cybercrime Treaty will be obliged to help other nations fight “cybercrime” – however those nations define it. They’ll be required to provide surveillance data – for example, by forcing online services within their borders to cough up their users’ private data, or even to pressure employees to install back-doors in their systems for ongoing monitoring.

These obligations to aid in surveillance are mandatory, but much of the Cybercrime Treaty is optional. What’s optional? The human rights safeguards. Member states “should” or “may” create standards for legality, necessity, proportionality, non-discrimination, and legitimate purpose. But even if they do, the treaty can oblige them to assist in surveillance orders that originate with other states that decided not to create these standards.

When that happens, the citizens of the affected states may never find out about it. There are eight articles in the treaty that establish obligations for indefinite secrecy regarding surveillance undertaken on behalf of other signatories. That means that your government may be asked to spy on you and the people you love, they may order employees of tech companies to backdoor your account and devices, and that fact will remain secret forever. Forget challenging these sneak-and-peek orders in court – you won’t even know about them:

https://www.eff.org/deeplinks/2024/06/un-cybercrime-draft-convention-blank-check-unchecked-surveillance-abuses

Now here’s the kicker: while this treaty creates broad powers to fight things governments dislike, simply by branding them “cybercrime,” it actually undermines the fight against cybercrime itself. Most cybercrime involves exploiting security defects in devices and services – think of ransomware attacks – and the Cybercrime Treaty endangers the security researchers who point out these defects, creating grave criminal liability for the people we rely on to warn us when the tech vendors we rely upon have put us at risk.

[…]

When it comes to warnings about the defects in their own products, corporations have an irreconcilable conflict of interest. Time and again, we’ve seen corporations rationalize their way into suppressing or ignoring bug reports. Sometimes, they simply delay the warning until they’ve concluded a merger or secured a board vote on executive compensation.

Sometimes, they decide that a bug is really a feature

Note: Responsible disclosure is something people should really “get” by now.

[…]

The idea that users are safer when bugs are kept secret is called “security through obscurity” and no one believes in it – except corporate executives

[…]

The spy agencies have an official doctrine defending this reckless practice: they call it “NOBUS,” which stands for “No One But Us.” As in: “No one but us is smart enough to find these bugs, so we can keep them secret and use them attack our adversaries, without worrying about those adversaries using them to attack the people we are sworn to protect.”

NOBUS is empirically wrong.

[…]

The leak of these cyberweapons didn’t just provide raw material for the world’s cybercriminals, it also provided data for researchers. A study of CIA and NSA NOBUS defects found that there was a one-in-five chance of a bug that had been hoarded by a spy agency being independently discovered by a criminal, weaponized, and released into the wild.

[…]

A Cybercrime Treaty is a good idea, and even this Cybercrime Treaty could be salvaged. The member-states have it in their power to accept proposed revisions that would protect human rights and security researchers, narrow the definition of “cybercrime,” and mandate transparency. They could establish member states’ powers to refuse illegitimate requests from other countries:

https://www.eff.org/press/releases/media-briefing-eff-partners-warn-un-member-states-are-poised-approve-dangerou

 

Source: Pluralistic: Holy CRAP the UN Cybercrime Treaty is a nightmare (23 Jul 2024) – Pluralistic: Daily links from Cory Doctorow

Dual action antibiotic could make bacterial resistance nearly impossible

Posted on by

A new antibiotic that works by disrupting two different cellular targets would make it 100 million times more difficult for bacteria to evolve resistance, according to new research from the University of Illinois Chicago.

For a new paper in Nature Chemical Biology, researchers probed how a class of synthetic drugs called macrolones disrupt bacterial cell function to fight infectious diseases. Their experiments demonstrate that macrolones can work two different ways—either by interfering with protein production or corrupting DNA structure.

Because would need to implement defenses to both attacks simultaneously, the researchers calculated that is nearly impossible.

“The beauty of this antibiotic is that it kills through two different targets in bacteria,” said Alexander Mankin, distinguished professor of pharmaceutical sciences at UIC. “If the antibiotic hits both targets at the same concentration, then the bacteria lose their ability to become resistant via acquisition of random mutations in any of the two targets.”

[…]

More information: Elena V. Aleksandrova et al, Macrolones target bacterial ribosomes and DNA gyrase and can evade resistance mechanisms, Nature Chemical Biology (2024). DOI: 10.1038/s41589-024-01685-3

Source: Dual action antibiotic could make bacterial resistance nearly impossible

Google isn’t killing third-party cookies in Chrome after all in move that surprises absolutely no-one.

Posted on by

Google won’t kill third-party cookies in Chrome after all, the company said on Monday. Instead, it will introduce a new experience in the browser that will allow users to make informed choices about their web browsing preferences, Google announced in a blog post. Killing cookies, Google said, would adversely impact online publishers and advertisers. This announcement marks a significant shift from Google’s previous plans to phase out third-party cookies by early 2025.

[…]

Google will now focus on giving users more control over their browsing data, Chavez wrote. This includes additional privacy controls like IP Protection in Chrome’s Incognito mode and ongoing improvements to Privacy Sandbox APIs.

Google’s decision provides a reprieve for advertisers and publishers who rely on cookies to target ads and measure performance. Over the past few years, the company’s plans to eliminate third-party cookies have been riding on a rollercoaster of delays and regulatory hurdles. Initially, Google aimed to phase out these cookies by the end of 2022, but the deadline was pushed to late 2024 and then to early 2025 due to various challenges and feedback from stakeholders, including advertisers, publishers, and regulatory bodies like the UK’s Competition and Markets Authority (CMA).

In January 2024, Google began rolling out a new feature called Tracking Protection, which restricts third-party cookies by default for 1% of Chrome users globally. This move was perceived as the first step towards killing cookies completely. However, concerns and criticism about the readiness and effectiveness of Google’s Privacy Sandbox, a collection of APIs designed to replace third-party cookies, prompted further delays.

The CMA and other regulatory bodies have expressed concerns about Google’s Privacy Sandbox, fearing it might limit competition and give Google an unfair advantage in the digital advertising market. These concerns have led to extended review periods and additional scrutiny, complicating Google’s timeline for phasing out third-party cookies. Shortly after Google’s Monday announcement, the CMA said that it was “considering the impact” of Google’s change of direction.

Source: Google isn’t killing third-party cookies in Chrome after all

Intel has finally figured out its long-standing desktop CPU instability issues, hopefully patches in August

Posted on by

The first reports of instability issues with the 13th-gen Intel desktop CPUs started popping up in late 2022, mere months after the models came out. Those issues persisted, and over time, users reported dealing with unexpected and sudden crashes on PCs equipped with the company’s 14th-gen CPUs, as well. Now, Intel has announced that it finally found the reason why its 13th and 14th-gen desktop processors have been causing crashes and giving out on users, and it promises to roll out a fix by next month.

In its announcement, Intel said that based on extensive analysis of the processors that had been returned to the company, it has determined that elevated operating voltage was causing the instability issues. Apparently, it’s because a microcode algorithm — microcodes, or machine codes, are sets of hardware-level instructions — has been sending incorrect voltage requests to the processor.

Intel has now promised to release a microcode patch to address the “root cause of exposure to elevated voltages.” The patch is still being validated to ensure that it can address all “scenarios of instability reported to Intel,” but the company is aiming to roll it out by mid-August.

As wccftech notes, while Intel’s CPUs have been causing issues with users for at least a year and a half, a post on X by Sebastian Castellanos in February put the problem in the spotlight. Castellanos wrote that there was a “worrying trend” of 13th and 14th-gen Intel CPUs having stability issues with Unreal Engine 4 and 5 games, such as Fortnite and Hogwarts Legacy. He also noticed that the issue seems to affect mostly higher-end models and linked to a discussion on Steam Community. The user that wrote the post on Steam wanted to issue a warning to those experiencing “out of video memory trying to allocate a rendering resource” errors that it was their CPU that was faulty. They also linked to several Reddit threads with people experiencing the same problem and who had determined that their issue lied with their Intel CPUs.

More recently, the indie studio Alderon Games published a post about “encountering significant problems with Intel CPU stability” while developing its multiplayer dinosaur survival game Path of Titans. Its founder, Matthew Cassells, said the studio found that the issue affected end customers, dedicated game servers, developers’ computers, game server providers and even benchmarking tools that use Intel’s 13th and 14th-gen CPUs. Cassells added that even the CPUs that initially work well deteriorate and eventually fail, based on the company’s observations. “The failure rate we have observed from our own testing is nearly 100 percent,” the studio’s post reads, “indicating it’s only a matter of time before affected CPUs fail.”

Source: Intel has finally figured out its long-standing desktop CPU instability issues

Nvidia’s third-party RTX 40-series GPUs are losing performance over time thanks to rubbish factory-installed thermal paste

Posted on by

Modern graphics cards use lots of power and all of it is turned into heat. So if you’re paying many hundreds of dollars for a powerful GPU, you’d expect no expense to be spared on the cooling system. It turns out that for many Nvidia RTX 40-series vendors, the expense is being spared and cheap, poorly applied thermal paste is leading to scorching high hotspot temperatures and performance degradation over time.

That’s the conclusion hardware tester Igor’s Lab has come to after testing multiple GeForce RTX cards, analysing temperatures and performance, and discovering that the thermal paste used by many graphics card vendors is not only sub-standard for the job but is also poorly applied.

I have four RTX 40-series cards in my office (RTX 4080 Super, 4070 Ti, and two 4070s) and all of them have quite high hotspots—the highest temperature recorded by an individual thermal sensor in the die. In the case of the 4080 Super, it’s around 11 °C higher than the average temperature of the chip. I took it apart to apply some decent quality thermal paste and discovered a similar situation to that found by Igor’s Lab.

In the space of a few months, the factory-applied paste had separated and spread out, leaving just an oily film behind, and a few patches of the thermal compound itself. I checked the other cards and found that they were all in a similar state.

[…]

Removing the factory-installed paste from another RTX 4080 graphics card, Igor’s Lab applied a more appropriate amount of a high-quality paste and discovered that it lowered the hotspot temperature by nearly 30 °C.

But it’s not just about the hotspots. Cheap, poorly applied thermal paste will cause the performance of a graphics card to degrade over time because GPUs lower clock speeds when they reach their thermal limits. PC enthusiasts are probably very comfortable with replacing a CPU’s thermal paste regularly but it’s not a simple process with graphics cards.

[…]

While Nvidia enjoys huge margins on its GPUs, graphics card vendors aren’t quite so lucky, but they’re not so small that spending a few more dollars on better thermal paste isn’t going to bankrupt the company.

Mind you, if they all started using PTM7950, then none of this would be an issue—the cards would run cooler and would stay that way for much longer. The only problem then is that you’d hear the coil whine over the reduced fan noise.

Source: Nvidia’s third-party RTX 40-series GPUs are losing performance over time thanks to rubbish factory-installed thermal paste | PC Gamer

“Smart soil” grows 138% bigger crops using 40% less water

Posted on by

[…]

in areas where water is more scarce it can be hard to grow crops and feed populations, so scientists are investigating ways to boost efficiency.

Building on earlier work, the new study marks a good step in that direction. The soil gets its “smart” moniker thanks to the addition of a specially formulated hydrogel, which works to absorb more water vapor from the air overnight, then releasing it to the plants’ roots during the day. Incorporating calcium chloride into the hydrogel also provides a slow release of this vital nutrient.

A diagram of how the hydrogel works to improve the growth of crops
A diagram of how the hydrogel works to improve the growth of crops
University of Texas at Austin

The team tested the new smart soil in lab experiments, growing plants in 10 grams of soil, with some including 0.1 g of hydrogel. A day/night cycle was simulated, with 12 hours of darkness at 25 °C (77 °F) and either 60% or 90% relative humidity, followed by 12 hours of simulated sunlight at 35 °C (95 °F) and 30% humidity.

Sure enough, plants growing in the hydrogel soil showed a 138% boost to their stem length, compared to the control group. Importantly, the hydrogel-grown plants achieved this even while requiring 40% less direct watering.

[…]

The research was published in the journal ACS Materials Letters.

Source: University of Texas at Austin

Source: “Smart soil” grows 138% bigger crops using 40% less water

Space Force tests small satellite jammer to protect against a ‘space-enabled attack’

Posted on by

The U.S. Space Force is testing a new ground-based satellite jamming weapon to help keep U.S. military personnel safe from potential “space-enabled” attacks.

The tests were conducted by Space Training and Readiness Command, or STARCOM, which is responsible for educating and training U.S. Space Force personnel. The satellite jammer is known as the Remote Modular Terminal (RMT) and, like other jammers, is designed to deny, degrade, or disrupt communications with satellites overhead, typically through overloading specific portions of the electromagnetic spectrum with interference.

The RMT is “small form-factor system designed to be fielded in large numbers at low-cost and operated remotely” according to Space Force statement. Specifically, the RMT will “unlock the scale to provide counterspace electronic warfare capability to all of the new Space Force components globally,” Lt. Col. Gerrit Dalman said in the statement, meaning it can be used from virtually anywhere to deny adversaries the use of satellites orbiting overhead.

Related: US needs new space tech or it ‘will lose,’ Space Force chief says

Details about the test are scarce, but Space Force’s statement explains that two RMT units were installed at separate locations and controlled by a third. The jammer was evaluated according to metrics such as “system latency” and “target engagement accuracy,” as well as for how secure its communications were.

Guardians and an Airman during a test of the Space Force’s Remote Modular Terminal (RMT) in Colorado Springs, Colo., April 4, 2024.  (Image credit: U.S. Air Force photo by Capt. Charles Rivezzo)

The need for new space-based and counterspace technologies has been stressed by Space Force leadership in recent months.

[…]

According to a slide deck the Space Rapid Capabilities Office presented to industry in October 2023, these jammers are “small transportable systems that can be emplaced in both garrison and austere environments,” meaning they can be used whether infrastructure is present or not.

[…]

Source: Space Force tests small satellite jammer to protect against a ‘space-enabled attack’ | Space

MS tries to blame EU for Crowdstrike Fail

Posted on by

Did the EU force Microsoft to let third parties like CrowdStrike run riot in the Windows kernel as a result of a 2009 undertaking? This is the implication being peddled by the Redmond-based cloud and software titan.

As the tech industry deals with the fallout from the CrowdStrike incident, Microsoft is facing questions. Why is software like CrowdStrike permitted to run at such a low level, where a failure could spell disaster for the operating system?

To be clear, Microsoft is not to blame for the now-pulled update that continues to cause chaos. However, the underlying architecture that allows third parties to run deeply integrated software merits closer examination.

According to a report in the Wall Street Journal, a Microsoft spokesperson pointed to a 2009 undertaking by the company with the European Commission as a reason why the Windows kernel was not as protected as that of the current Apple Mac operating system, for example.

The agreement [DOC] is about interoperability and came as Microsoft was subject to European scrutiny. The undertaking seeks a level playing field and includes the following clause:

Microsoft shall ensure on an ongoing basis and in a Timely Manner that the APIs in the Windows Client PC Operating System and the Windows Server Operating System that are called on by Microsoft Security Software Products are documented and available for use by third-party security software products that run on the Windows Client PC Operating System and/or the Windows Server Operating System.

In other words, third-party security vendors must get the same access as Microsoft’s own products. Which, on the face of it, is fair enough.

However, nothing in that undertaking would have prevented Microsoft from creating an out-of-kernel API for it and other security vendors to use. Instead, CrowdStrike and its ilk run at a low enough level in the kernel to maximize visibility for anti-malware purposes. The flip side is this can cause mayhem should something go wrong.

The Register asked Microsoft if the position reported by the Wall Street Journal was still the company’s stance on why a CrowdStrike update for Windows could cause the chaos it did. The company has yet to respond.

Windows is far from the only operating system that permits software to run at a level low enough to crash a kernel. However, failures of third-party software running at a low level in Windows can be embarrassingly public, even if Microsoft is not directly to blame. ®

Source: EU gave CrowdStrike keys to Windows kernel, Microsoft claims • The Register

And indeed it did happen to Linux as well, where Crowdstrike caused kernel panics at startup. Being open has a good and a bad side, but overall the good side is a whole lot better than the bad sides.

First trial on British Army vehicle for high-powered laser weapon

Posted on by

For the first time scientists and engineers have successfully fired a high powered laser energy weapon from a British Army combat vehicle.

This ground-breaking test, conducted at Dstl’s range in Porton Down, saw the laser weapon neutralise targets at distances in excess of 1km.

The high-energy laser weapon mounted on to a British Army Wolfhound armoured vehicle, represents a major leap forward in the UK Ministry of Defence’s Land Laser Directed Energy Weapon (LDEW) Demonstrator programme, providing increased operational advantage on the battlefield.

The lightweight portable high energy laser system is the first laser weapon integrated on a land vehicle to be fired in the UK.

[…]

Matt Cork, Dstl Programme Lead, said:

The joint working between Dstl, DE&S and industry has enabled rapid evolution of this laser demonstrator. The successful testing of this high-powered laser weapon marks a pivotal moment in our ongoing efforts to enhance the future operational capabilities of the British Army. This technology offers a precise, powerful and cost effective means to defeat aerial threats, ensuring greater protection for our forces.

[…]

The system operates with a command and control system and can be integrated with wider battle management radar and surveillance systems. The weapon can be mounted on various platforms to meet different operational needs.

First trial on British Army vehicle for high-powered laser system

The British supply chain includes: Raytheon UK, Frazer-Nash, NP Aerospace, LumOptica, Blighter Surveillance Systems, and Cambridge Pixel.

[…]

Source: First trial on British Army vehicle for high-powered laser weapon – GOV.UK

So that Global Microsoft IT outage – turns out a Crowdstrike update borked your PC. Here’s some memes to make you feel better.

Posted on by

Businesses worldwide grappled with an ongoing major IT outage Friday, as financial services and doctors’ offices were disrupted, while some TV broadcasters went offline. Air travel has been hit particularly hard, with planes grounded, services delayed and airports issuing advice to passengers.

The outage came as cybersecurity giant CrowdStrike experienced a major disruption early Friday following an issue with a recent tech update.

CrowdStrike CEO George Kurtz has since said that the company is “actively working with customers impacted by a defect found in a single content update for Windows hosts,” stressing that Mac and Linux hosts are not affected.

“This is not a security incident or cyberattack. The issue has been identified, isolated and a fix has been deployed,” he said on social media.

One expert suggested it may be the “largest IT outage in history.”

Separately, Microsoft

cloud services were restored after an outage, the company said on Friday, even as many users continued to report issues.

Source: Global IT outage live updates: Microsoft-CrowdStrike blackout

Yesterday I talked about the Azure and Office 365 outage: Major IT outage hits Microsoft Azure and Office365 users worldwide leading to cancelled flights, stock exchange outages and more chaos. What a great idea cloud is for critical infrastructure!

Meta and Apple are Keeping their Next Big AI things Out of the EU – that’s a good thing

Posted on by

[…]

In a statement to The Verge, Meta spokesperson Kate McLaughlin said that the company’s next-gen Llama AI model is skipping Europe, placing the blame squarely on regulations. “We will release a multimodal Llama model over the coming months,” Mclaughlin said, “but not in the EU due to the unpredictable nature of the European regulatory environment.”

A multimodal model is one that can incorporate data between multiple mediums, like video and text, and use them together while calculating. It makes AI more powerful, but also gives it more access to your device.

The move actually follows a similar decision from Apple, which said in June that it would be holding back Apple Intelligence in the EU due to the Digital Markets Act, or DMA, which puts heavy scrutiny on certain big tech “gatekeepers,” Apple and Meta both among them.

Meta’s concerns here could be less related to the DMA and more to the new AI Act, which recently finalized compliance deadlines and will force companies to make allowances for copyright and transparency starting August 2, 2026. Certain AI use cases, like those that try to read the emotions of schoolchildren, will also be banned. As the company tries to get a hold of AI on its social media platforms, increasing pressure is the last thing it needs.

How this will affect AI-forward Meta products like Ray-Ban smart glasses remains to be seen. Meta told The Verge that future multimodal AI releases will continue to be excluded from Europe, but that text-only model updates will still come to the region.

While the EU has yet to respond to Meta’s decision, EU competition regulator Margrethe Vestager previously called Apple’s plan to keep Apple Intelligence out of the EU a “stunning open declaration” of anticompetitive behavior.

Source: Meta Is Keeping Its Next Big AI Update Out of the EU | Lifehacker

Why is this good? Because the regulatory environment is predictable and run by rules that enforce openness, security, privacy and fair competition. The fact that Apple and Meta don’t want to run this in the EU shows that they are either incapable or unwilling to comply with points that are good for the people. You should not want to do business with shady dealers like that.

Indian WazirX halts withdrawals after losing $230M worth crypto assets – still cowboy country there

Posted on by

[…] The Mumbai-based firm said one of its multisig wallets had suffered a security breach. A multisig wallet requires two or more private keys for authentication. WazirX said its wallet had six signatories, five of whom were with WazirX team. Liminal, which operates a wallet infrastructure firm, said in a statement to TechCrunch that its preliminary investigation had found that a wallet created outside its ecosystem had been compromised.

“The cyber attack stemmed from a discrepancy between the data displayed on Liminal’s interface and the transaction’s actual contents,” said WazirX in a statement on Thursday. “During the cyber attack, there was a mismatch between the information displayed on Liminal’s interface and what was actually signed. We suspect the payload was replaced to transfer wallet control to an attacker.”

Lookchain, a third-party blockchain explorer, reported that more than 200 cryptocurrencies, including 5.43 billion SHIB tokens, over 15,200 Ethereum tokens, 20.5 million Matic tokens, 640 billion Pepe tokens, 5.79 million USDT and 135 million Gala tokens were “stolen” from the platform.

Blockchain data suggests the attackers are trying to offload the assets using the decentralized exchange Uniswap. Risk-management platform Elliptic reported that the hackers have affiliation with North Korea.

About $230 million in missing assets is significant for WazirX, which reported holdings of about $500 million in its June proof-of-reserves disclosure.

[…]

This is the latest setback for WazirX, which separated from Binance in early 2023 after the two crypto exchanges had a public and high-profile fallout in 2022. Two years after Binance announced it had acquired WazirX, the two companies started a dispute over the ownership of the Indian firm. Binance founder Changpeng Zhao eventually said that the two firms hadn’t been able to conclude the deal and moved to terminate Binance’s businesses with the Indian firm.

Source: WazirX halts withdrawals after losing $230M worth crypto assets in security breach | TechCrunch

Critical Cisco bug allows anyone to change all (including admin) passwords

Posted on by

Cisco just dropped a patch for a maximum-severity vulnerability that allows attackers to change the password of any user, including admins.

Tracked as CVE-2024-20419, the bug carries a maximum 10/10 CVSS 3.1 rating and affects the authentication system of Cisco Smart Software Manager (SSM) On-Prem.

Cisco hasn’t disclosed too many details about this, which is more than understandable given the nature of the vulnerability. However we know that an unauthenticated remote attacker can exploit this to change passwords. It’s hardly ideal, and should be patched as soon as possible.

Digging into the severity assessment, the attack complexity was deemed “low”: no privileges or user interaction would be required to pull it off, and the impact on the product’s integrity, availability, and confidentiality is all designated “high.”

“This vulnerability is due to improper implementation of the password-change process,” Cisco’s advisory reads, providing the last few details about the vulnerability.

“An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.”

There are no workarounds for this vulnerability, so get those patches applied if you’re in the business of keeping your passwords safe and secure. Fortunately, there are no signs of this being exploited in the wild yet, but now the cat’s out of the bag it likely won’t be long before that changes.

CVE-2024-20419 affects both SSM On-Prem and SSM Satellite. They’re different names for the same product, only the latter refers to versions before release 7.0.

[…]

Source: Critical Cisco bug allows crims to change admin passwords • The Register

How to unsnarl a tangle of threads, according to physics

Posted on by

Physicists may have found a solution for the rage-inducing tangles that crop up in everything from electronics cords to necklaces: to free a single thread from a tangle of many, you must shake it not too fast and not too slow but with just the right frequency.

Ishant Tiwari at the Georgia Institute of Technology in Atlanta and his colleagues created a vibrating robot to determine how to best jiggle a single thread from such a tangle.

 

Read more

Human cells have a resonant frequency – and it’s just barely audible

 

The researchers gathered cotton fibres into balls by rolling them around in a box. This ensured that all the tangles they tested would be similar. The tangles were each attached to a piston on a robot by a single thread.

Tiwari and his colleagues set the robot to jerk up and down at various frequencies and vibrate the tangle, which revealed that there is a sweet spot for the perfect untangling frequency.

 

New Scientist. Science news and long reads from expert journalists, covering developments in science, technology, health and the environment on the website and the magazine.

The robot identified an ideal shaking frequency of 17 hertz (shown in the middle)

Ishant Tiwari, Bhamla Lab

 

When the shaking frequency was low – just a few shakes each second, or a few hertz – the thread that was attached to the piston moved together with the tangle and it stayed stuck. At the high end, greater than around 37 shakes per second, the tangle also remained jumbled. The energy of the shaking was diverted into damped oscillations across the whole tangle, so it tugged less on the specific thread they were trying to release from the ball.

But at about 17 shakes per second, the tangle jumped and jerked more chaotically, and each twitch contributed a small pull on the thread. When the effect of these pulls accumulated, the thread came loose from the tangle.

The researchers have presented results on only one type of thread so far, but their work may help unravel a more general property of the fibre tangles that pervade our daily lives – and how to deal with them.

 

Journal reference:

Physical Review E DOI: 10.1103/PhysRevE.110.010001

Source: How to unsnarl a tangle of threads, according to physics | New Scientist

Major IT outage hits Microsoft Azure and Office365 users worldwide leading to cancelled flights, stock exchange outages and more chaos. What a great idea cloud is for critical infrastructure!

Posted on by

Companies and banks worldwide have been reportedly hit by a mass IT outage, leading to grounded flights.

A major IT outage has reportedly hit banks, media outlets, and airlines on Friday, causing chaos at airport check-in and cancelled flights.

The outage is believed to be caused by an outage of Microsoft’s Azure and Office365 services.

Airlines such as Qantas in Australia and at least two low-cost carriers in the US – Frontier and Sun Country Airlines – have been forced to ground flights.

In Europe, users of Ryanair’s app and website also complained and not being able to check in on Friday morning, with a surge of reports noted on the outage tracking website Downdetector.com.

Source: Major IT outage hits Microsoft users worldwide leading to cancelled flights and chaos | Euronews

The tinyPod transforms your old Apple Watch into an iPod-like minimalist phone

Posted on by

The tinyPod is a case for your Apple Watch, which probably doesn’t sound too exciting on its own. However, its unique angle — a click wheel that controls the watch’s Digital Crown — makes Apple’s wearable look and feel (at least in its marketing) like the company’s first breakthrough product of the 21st century: the iPod. Although you can use it as a music player, it also works with everything else in watchOS, transforming Apple’s smartwatch into a minimalist, distraction-free “phone.”

The $80 tinyPod works with Apple Watch models in Series 4 through 9, along with the Apple Watch SE. (The 41/40mm and 45/44mm Apple Watches have separate tinyPods.) Meanwhile, another 49mm version for the Apple Watch Ultra — because who wouldn’t want to turn their $800 wearable into a minimalist phone? — costs $90. There’s also tinyPod lite, a $30 case sans click wheel.

That click wheel is its core gimmick, and its creator apparently believes it will be safe from Apple’s lawyers. (The fact that it relies on an Apple product probably doesn’t hurt.) The case’s wheel syncs its movement with the Apple Watch’s Digital Crown via “carefully mechanized components inside” that make “direct rotation contact with your Apple Watch crown.” In other words, anywhere on watchOS that lets you scroll with the crown will be scrollable with the tinyPod click wheel. In theory, anyway.

Marketing screenshot for the tinyPod. The iPod-like device sits next to icons for Phone, Music, Messaging and Mail, demonstrating its capabilities. White background.
Newar / tinyPod

The tinyPod website says it can support multi-day battery life by turning off the watch’s wrist detection (which you don’t need here). But living up to that may be a tall order, given how short the battery life of cellular Apple Watches tends to be when used without a phone in Bluetooth range. Of course, you could use a GPS-only model (or turn off cellular) and stick to locally stored music, but that would also limit what it can do.

tinyPod is the product of Newar, a former Snap designer and one-time jailbreak guru. In May, the creator posted that it began as a side project before being transformed into “a real, shipping product for one reason: Whenever I left the house with it, I loved how I felt.”

Whether the tinyPod lives up to its billing as a minimalist, distraction-free and nostalgia-laden “phone” or not, its creator appears to have put significant thought into aesthetics, clarity of purpose and consistency in marketing. Its website demonstrates an eye for detail that relishes in its iPod inspiration, including era-appropriate Apple fonts and a teaser video in a classic 4:3 aspect ratio. (Cue silhouettes dancing to Gorillaz.)

The tinyPod is available for pre-order ahead of shipments “this summer.” You can reserve one today at the product website.

Source: The tinyPod transforms your old Apple Watch into an iPod-like minimalist phone

Apparently the idiots who pay for pre-order are now paying for ‘early access’ in games

Posted on by

While it didn’t technically start last year, in 2023 we saw an increase in the number of games offering “early access” for a price. Mortal Kombat 1, The Crew: Motorfest, Starfield, Diablo 4, and a few others all offered players an option: Pay the standard price to play the game at launch or pay extra to play a few days “early,” assuming the servers are working properly.

To me, it all seemed like an obvious ploy by publishers to milk gamers for even more money than they already do via in-app purchases, cosmetics, battle passes, and XP boosters. I hoped that people would realize that all these publishers were doing was holding back a game’s release for a few days just to make some extra money. I hoped that gamers would see this was a scam and that these early access perks were worthless.

I was apparently wrong. Looking ahead at the rest of 2024, it’s clear that publishers big and small have seen other games making lots of money via early access launches and are following their lead.

[…]

keep in mind that all of the games listed above aren’t actually being released early. I can’t stress that enough. That’s not what’s happening here. Not at all.

If a company can release a game like Madden NFL 25 on August 12 for some, they can release it for everyone, instead of making players wait three days because they didn’t spend an extra $20 on some special edition. A game launched on July 10 for some players still had to go through all the same certifications and testing that any other game released on a console is forced to complete. So the only thing holding the game back for three days is greedy publishers.

Basically, publishers are delaying games by three days for no reason, and then charging you more to play early. They have created a fake problem and are selling you a silly solution.

[…]

In multiplayer games this can lead to people arriving well after others have hit the max level and mastered maps and weapons. And for single-player games, it means folks with less money might have stories spoiled days before they can play. It’s just a real mess of garbage and none of it is necessary at all.

[…]

I also want to give a special shout-out to Test Drive Unlimited: Solar Crown, which seems to be the first game to take this paid early access shenanigans to the next level with two separate tiers depending on which special edition you pre-order. The silver editions of the game include two days of early access while the even pricier gold edition bumps that up to seven days.

[…]

next year, we might see a game with a 15-day early access period and a separate 18-day super early access window. Are you all excited for that future, because I’m not.

Source: Paying To Play Games Early Is Normal Now And That Sucks

Pre-order is enough of a scam. If you are going to pay beforehand, then you should receive equity. You are taking a risk. But to pay extra for a few days? Really?

Firefox’s New ‘Privacy’ Feature Actually Gives Your Data to Advertisers – How and Why to Disable Firefox’s ‘Privacy-Preserving’ Ad Measurements

Posted on by

Firefox finds itself in a tricky position at times, because it wants to be a privacy friendly browser, but most of its funding comes from Google, whose entire business is advertising. With Firefox 128, the browser has introduced ‘privacy-preserving ad measurement,’ which is enabled by default. Despite the name, the actual implications of the feature has users upset.

What ‘privacy-preserving ad measurement’ means

In a blog post, Firefox’s parent company Mozilla has explained that this new feature is an experiment designed to shape a web standard for advertisers, one that relies less on cookies but still tracks you in some way. Mozilla says privacy-preserving ad measurement is only being used by a handful of sites at the moment, in order to tell if their ads were successful or not.

[…]

ith privacy-preserving ad measurement, sites will be able to ask Firefox if people clicked on an ad, and if they ended up doing something the ad wanted them to (such as buying a product). Firefox doesn’t give this data directly to advertisers, but encrypts it, aggregates it, and submits it anonymously. This means that your browsing activity and other data about you is hidden from the advertiser, but they can see if their campaign delivered results or not. It’s a similar feature to those in Chrome’s Privacy Sandbox, although Google itself has run into regulatory issues implementing them.

Why you should disable this feature

Even though Mozilla’s intentions appear to be genuine, this feature should never have been enabled by default, as no matter its label, it still does technically give advertisers your data. When advertisers started tracking people online, there were no privacy protections, laws, or standards to follow, and the industry chose to track all the data that it could lay its hands on. No one ever asked users if they wanted to be tracked, or if they wanted to give advertisers access to their location, browser data, or personal preferences. If I’ve learned one thing from the way the online ad industry evolved, it’s that people should have a choice in whether their data is being tracked. Even if it seeks to replace even more invasive systems, Firefox should have offered people a choice to opt into ad measurement, instead of enabling it silently

[…]

To disable privacy-preserving ad measurement in Firefox 128, click the three-lines icon in the top-right corner in the browser. Then, go to Settings > Privacy & Security and scroll down to the Website Advertising Preferences section. There, disable Allow websites to perform privacy-preserving ad measurement.

Source: How and Why to Disable Firefox’s ‘Privacy-Preserving’ Ad Measurements | Lifehacker

Only 5 years too late: British regulators to examine Big Tech’s digital wallets – and where is the EU?

Posted on by
British regulators said on Monday they were looking into the soaring use of digital wallets offered by Big Tech firms, including whether there are any competition, consumer protection or market integrity concerns.
The Financial Conduct Authority and Payments Systems Regulator is seeking views on the benefits and risks, and will assess the impact digital wallets, such as Apple Pay, Google Pay and PayPal, have on competition and choice of payment options at checkout, among other things.
Digital wallets are now likely used by more than half of UK adults and have become “an increasingly important touchpoint” between Big Tech companies and UK consumers, they said in a statement.
“Digital wallets are steadily becoming a go-to payment type and while this presents exciting opportunities, there might be risks too,” said David Geale, the PSR’s managing director.
Nikhil Rathi, the FCA’s chief executive, said the growth of digital wallets represented a “seismic shift” in how people pay and regulators wanted to maximise the opportunities while “protecting against any risks this technology may present.”
Regulators and lawmakers in Europe and the United States have been examining the growing role of Big Tech in financial services.
The U.S. consumer watchdog last year proposed regulating payments and smartphone wallets, prompting criticism from the industry.
The British regulators said their review of digital wallets built on their previous work on contactless mobile payments and on the role of Big Tech firms in financial services.
After considering all feedback, the regulators provide an update on Big Tech and digital wallets by the first quarter of 2025.

Source: British regulators to examine Big Tech’s digital wallets | Reuters

Considering that people using the services generally don’t understand that they are giving their payment history to the big tech company that runs it – and is not a bank – this is way way way too late.

Linksys Velop Routers Caught Sending WiFi Creds In The Clear – alerted in November 2023 still not fixed

Posted on by

A troubling report from the Belgian consumer protection group Testaankoop: several models of Velop Pro routers from Linksys were found to be sending WiFi configuration data out to a remote server during the setup process. That would be bad enough, but not only are these routers reporting private information to the mothership, they are doing it in clear text for anyone to listen in on.

Testaankoop says that while testing out the Pro WiFi 6E and Pro 7 versions of Velop routers, they discovered that unencrypted packets were being sent to a server hosted by Amazon Web Services (AWS). In these packets, they discovered not only the SSID of the user’s wireless network, but the encryption key necessary to join it. There were also various tokens included that could be used to identify network and user.

While the report doesn’t go into too much detail, it seems this information is being sent as part of the configuration process when using the official Linksys mobile application. If you want to avoid having your information bounced around the Internet, you can still use the router’s built-in web configuration menus from a browser on the local network — just like in the good old days.

The real kicker here is the response from Linksys, or more accurately, the lack thereof. Testaankoop says they notified them of their discovery back in November of 2023, and got no response. There’s even been firmware updates for the affected routers since then, but the issue is still unresolved.

Testaankoop ends the review by strongly recommending users avoid these particular models of Linksys Velop routers, which given the facts, sounds like solid advice to us. They also express their disappointment in how the brand, a fixture in the consumer router space for decades, has handled the situation. If you ask us, things started going downhill once they stopped running Linux on their hardware.

Source: Linksys Velop Routers Caught Sending WiFi Creds In The Clear | Hackaday

Dutch DPA gets off its’ ass, Fine of 600,000 euros for tracking cookies on Kruidvat.nl – detected in 2020

Posted on by

The Dutch Data Protection Authority (AP) has imposed a fine of 600,000 euros on the company behind the Kruidvat drugstore. Kruidvat.nl followed consumers with tracking cookies, without their knowledge or permission. AS Watson collected and used sensitive personal data from millions of website visitors against the rules.

The company behind Kruidvat collected data from website visitors and was able to create personal profiles. In addition to visitors’ location data, this included which pages they visited, which products they added to the shopping cart and purchased and which recommendations they clicked on.

That is very sensitive information, AP points out, due to the specific nature of drugstore products. Such as pregnancy tests, contraceptives or medication for all kinds of ailments. That sensitive information, linked to the location (which may be traceable via the IP address) of the unique visitor, can sketch a very specific and invasive profile of the people who visit Kruidvat.nl.

Kruidvat.nl should have asked permission to place tracking cookies on visitors’ computers. The GDPR privacy law sets a number of requirements for valid consent. These requirements are that consent must be given freely, for specific processing of personal data, on the basis of sufficient information and that there must be no doubt that consent has been given.

In the cookie banner on Kruidvat.nl, the boxes to agree to the installation of tracking software were checked by default. That’s not allowed. Visitors who still wanted to refuse the cookies had to go through many steps to achieve this. The AP has found that personal data of website visitors to Kruidvat.nl have been processed unlawfully.

At the end of 2019, the AP started an investigation into various websites, including Kruidvat.nl. The AP tested whether these websites met the requirements for placing (tracking) cookies. The AP checked whether permission for tracking cookies was asked from website visitors and, if so, how exactly this happened.

Kruidvat.nl was found not to comply in April 2020, after which the AP sent the company a letter. In 2020, the AP found that Kruidvat.nl was still not in order. The AP then started investigating this website further. This violation ended in October 2020.

There is increasing social irritation about cookies and cookie notifications, ranging from annoying and misleading banners to concerns about the secret tracking of internet users. In 2024, the AP will check more often whether websites correctly request permission for tracking cookies or other tracking software.

Source: Boete van 600.000 euro voor tracking cookies op Kruidvat.nl – Emerce

Are Intel’s i9-13900k’s and -14900k’s Crashing at a Higher Rate?

Posted on by

“Intel’s problems with unstable 13th-gen and 14th-gen high-end CPUs appear to run deeper than we thought,” writes TechRadar, “and a new YouTube video diving into these gremlins will do little to calm any fears that buyers of Raptor Lake Core i9 processors (and its subsequent refresh) have.” Level1Techs is the YouTuber in question, who has explored several avenues in an effort to make more sense of the crashing issues with these Intel processors that are affecting some PC gamers and making their lives a misery — more so in some cases than others. Data taken from game developer crash logs — from two different games — clearly indicates a high prevalence of crashes with the mentioned more recent Intel Core i9 chips (13900K and 14900K).

In fact, for one particular type of error (decompression, a commonly performed operation in games), there was a total of 1,584 that occurred in the databases Level1Techs sifted through, and an alarming 1,431 of those happened with a 13900K or 14900K. Yes — that’s 90% of those decompression errors hitting just two specific CPUs. As for other processors, the third most prevalent was an old Intel Core i7 9750H (Coffee Lake laptop CPU) — which had a grand total of 11 instances. All AMD processors in total had just 4 occurrences of decompression errors in these game databases.
“In case you were thinking that AMD chips might be really underrepresented here, hence that very low figure, well, they’re not — 30% of the CPUs in the database were from Team Red…”

“The YouTuber also brings up another point here: namely that data centers are noticing these issues with Core i9s.”

More details at Digital Trends… And long-time Slashdot reader UnknowingFool wrote a summary of the video’s claims here.

Intel is not in a good place with these chips: After 3 Faulty CPUs & 2 RMAs, Intel Refuses to Refund a Crashing 13900K, Less than a Month Old

WTFBBQ?! Firefox Starts collecting personal ad preferences

Posted on by

In a world where so much of our lives depend on the use of online services, the web browser used to access those services becomes of crucial importance. It becomes a question of whether we trust the huge corporate interests which control this software with such access to our daily lives, and it is vital that the browser world remains a playing field with many players in the game.

The mantle has traditionally fallen upon Mozilla’s Firefox browser to represent freedom from corporate ownership, but over the last couple of years even they have edged away from their open source ethos and morphed into an advertising company that happens to have a browser. We’re asking you: can we still trust Mozilla’s Firefox, when the latest version turns on ad measurement by default?

Such has been the dominance of Google’s Chromium in the browser world, that it becomes difficult to find alternatives which aren’t based on it. We can see the attraction for developers, instead of pursuing the extremely hard task of developing a new browser engine, just use one off-the-shelf upon which someone else has already done the work. As a result, once you have discounted browsers such as the venerable Netsurf or Dillo which are cool as heck but relatively useless for modern websites, the choices quickly descend into the esoteric. There are Ladybird and Servo which are both promising but still too rough around the edges for everyday use, so what’s left? Probably LibreWolf represents the best option, a version of Firefox with a focus on privacy and security.

[…]

Source: Ask Hackaday: Has Firefox Finally Gone Too Far? | Hackaday

Many comments in the thread in the source. Definitely worth looking at.