Google Chrome’s Privacy Sandbox: any site can now query all your habits

Posted on by

[…]

Specifically, the web giant’s Privacy Sandbox APIs, a set of ad delivery and analysis technologies, now function in the latest version of the Chrome browser. Website developers can thus write code that calls those APIs to deliver and measure ads to visitors with compatible browsers.

That is to say, sites can ask Chrome directly what kinds of topics you’re interested in – topics automatically selected by Chrome from your browsing history – so that ads personalized to your activities can be served. This is supposed to be better than being tracked via third-party cookies, support for which is being phased out. There are other aspects to the sandbox that we’ll get to.

While Chrome is the main vehicle for Privacy Sandbox code, Microsoft Edge, based on the open source Chromium project, has also shown signs of supporting the technology. Apple and Mozilla have rejected at least the Topics API for interest-based ads on privacy grounds.

[…]

“The Privacy Sandbox technologies will offer sites and apps alternative ways to show you personalized ads while keeping your personal information more private and minimizing how much data is collected about you.”

These APIs include:

  • Topics: Locally track browsing history to generate ads based on demonstrated user interests without third-party cookies or identifiers that can track across websites.
  • Protected Audience (FLEDGE): Serve ads for remarketing (e.g. you visited a shoe website so we’ll show you a shoe ad elsewhere) while mitigating third-party tracking across websites.
  • Attribution Reporting: Data to link ad clicks or ad views to conversion events (e.g. sales).
  • Private Aggregation: Generate aggregate data reports using data from Protected Audience and cross-site data from Shared Storage.
  • Shared Storage: Allow unlimited, cross-site storage write access with privacy-preserving read access. In other words, you graciously provide local storage via Chrome for ad-related data or anti-abuse code.
  • Fenced Frames: Securely embed content onto a page without sharing cross-site data. Or iframes without the security and privacy risks.

These technologies, Google and industry allies believe, will allow the super-corporation to drop support for third-party cookies in Chrome next year without seeing a drop in targeted advertising revenue.

[…]

“Privacy Sandbox removes the ability of website owners, agencies and marketers to target and measure their campaigns using their own combination of technologies in favor of a Google-provided solution,” James Rosewell, co-founder of MOW, told The Register at the time.

[…]

Controversially, in the US, where lack of coherent privacy rules suit ad companies just fine, the popup merely informs the user that these APIs are now present and active in the browser but requires visiting Chrome’s Settings page to actually manage them – you have to opt-out, if you haven’t already. In the EU, as required by law, the notification is an invitation to opt-in to interest-based ads via Topics.

Source: How Google Chrome’s Privacy Sandbox works and what it means • The Register

Clever Camera Trick Allows view of Sun’s Corona

Posted on by

[…]

Using Solar Orbiter’s Extreme Ultraviolet Imager (EUI), the team of scientists behind the mission was able to record part of the Sun’s atmosphere at extreme ultraviolet wavelengths. The last-minute modification to the instrument involved adding a small, protruding “thumb” to block the bright light coming from the Sun such that the fainter light of its atmosphere could be made visible.

“It was really a hack,” Frédéric Auchère, an astrophysicist at the Institute of Astrophysics of the Université Paris-Sud in France, and a member of the EUI team, said in a statement. “I had the idea to just do it and see if it would work. It is actually a very simple modification to the instrument.”

EUI produces high-resolution images of the structures in the Sun’s atmosphere. The team behind the instrument added a thumb to a safety door on EUI, which slides out of the way to let light into the camera so it can capture images of the Sun. If the door stops halfway, however, the thumb ends up shielding the bright light coming from the Sun’s disc in the center so that the fainter ultraviolet light coming from the corona (the outermost part of the atmosphere) can be visible.

A new way to view the Sun

The result is an ultraviolet image of the Sun’s corona. An ultraviolet image of the Sun’s disc has been superimposed in the middle, in the area left blank by the thumb hack, according to ESA.

The corona is usually hidden by the bright light of the Sun’s surface, and can mostly be seen during a total solar eclipse. The camera hack sort of mimics that same effect of the eclipse by blocking out the Sun’s light. The Sun’s corona has long baffled scientists as it is much hotter than the surface of the Sun with temperatures reaching 1.8 million degrees Fahrenheit (1 million degrees Celsius), one of the greatest mysteries surrounding our host star.

“We’ve shown that this works so well that you can now consider a new type of instrument that can do both imaging of the Sun and the corona around it,” Daniel Müller, ESA’s Project Scientist for Solar Orbiter, said in a statement.

[…]

Source: Clever Camera Trick Unlocks Hidden Secrets of Sun’s Atmosphere

China Breached Microsoft Engineer Account Compromised the Email Accounts of US Officials – By finding key in crash dumps

Posted on by

An anonymous reader shared this report from Bloomberg: China-linked hackers breached the corporate account of a Microsoft engineer and are suspected of using that access to steal a valuable key that enabled the hack of senior U.S. officials’ email accounts, the company said in a blog post. The hackers used the key to forge authentication tokens to access email accounts on Microsoft’s cloud servers, including those belonging to Commerce Secretary Gina Raimondo, Representative Don Bacon and State Department officials earlier this year.

The U.S. Cybersecurity and Infrastructure Security Agency and Microsoft disclosed the breach in June, but it was still unclear at the time exactly how hackers were able to steal the key that allowed them to access the email accounts. Microsoft said the key had been improperly stored within a “crash dump,” which is data stored after a computer or application unexpectedly crashes…

The incident has brought fresh scrutiny to Microsoft’s cybersecurity practices.
Microsoft’s blog post says they corrected two conditions which allowed this to occur. First, “a race condition allowed the key to be present in the crash dump,” and second, “the key material’s presence in the crash dump was not detected by our systems.” We found that this crash dump, believed at the time not to contain key material, was subsequently moved from the isolated production network into our debugging environment on the internet connected corporate network. This is consistent with our standard debugging processes. Our credential scanning methods did not detect its presence (this issue has been corrected).

After April 2021, when the key was leaked to the corporate environment in the crash dump, the Storm-0558 actor was able to successfully compromise a Microsoft engineer’s corporate account. This account had access to the debugging environment containing the crash dump which incorrectly contained the key. Due to log retention policies, we don’t have logs with specific evidence of this exfiltration by this actor, but this was the most probable mechanism by which the actor acquired the key.

Source: How a Breached Microsoft Engineer Account Compromised the Email Accounts of US Officials – Slashdot

MGM Resorts Hit By Cyberattack; Hotels and Casinos Impacted

Posted on by

[…]

On Monday, local news outlets in Las Vegas caught wind of various complaints from patrons of MGM businesses; some said ATMs at associated hotels and casinos didn’t appear to be working; others said their hotel room keys had stopped functioning; still others noted that bars and restaurants located within MGM complexes had suddenly been shuttered. If you head to MGM’s website, meanwhile, you’ll note it’s definitely not working the way that it’s supposed to.

MGM put out a short statement Monday saying that it had been the victim of an undisclosed “cybersecurity issue.” The Associated Press notes that computer outages connected to said issue appear to be impacting MGM venues across the U.S.—in Vegas but also in places as far flung as Mississippi, Ohio, Michigan, and large parts of the northeast.

[…]

Source: MGM Resorts Hit By Cyberattack; Hotels and Casinos Impacted

Google taken to court in NL for large scale privacy breaches

Posted on by

The Foundation for the Protection of Privacy Interests and the Consumers’ Association are taking the next step in their fight against Google. The tech company is being taken to court today for ‘large-scale privacy violations’.

The proceedings demand, among other things, that Google stop its constant surveillance and sharing of personal data through online advertising auctions and also pay damages to consumers. Since the announcement of this action on May 23, 2023, more than 82,000 Dutch people have already joined the mass claim.

According to the organizations, Google is acting in violation of Dutch and European privacy legislation. The tech giant collects users’ online behavior and location data on an immense scale through its services and products. Without providing enough information or having obtained permission. Google then shares that data, including highly sensitive personal data about health, ethnicity and political preference, for example, with hundreds of parties via its online advertising platform.

Google is constantly monitoring everyone. Even when using third-party cookies – which are invisible – Google continues to collect data through other people’s websites and apps, even when someone is not using its products or services. This enables Google to monitor almost the entire internet behavior of its users.

All these matters have been discussed with Google, to no avail.

The Foundation for the Protection of Privacy Interests represents the interests of users of Google’s products and services living in the Netherlands who have been harmed by privacy violations. The foundation is working together with the Consumers’ Association in the case against Google. Consumers’ Association Claimservice, a partnership between the Consumers’ Association and ConsumersClaim, processes the registrations of affiliated victims.

More than 82,000 consumers have already registered for the Google claim. They demand compensation of 750 euros per participant.

A lawsuit by the American government against Google starts today in the US . Ten weeks have been set aside for this. This mainly revolves around the power of Google’s search engine.

Essentially, Google is accused of entering into exclusive agreements to guarantee the use of its search engine. These are agreements that prevent alternative search engines from being pre-installed, or from Google’s search app being removed.

Source: Google voor de rechter gedaagd wegens ‘grootschalige privacyschendingen’ – Emerce (NL)

BMW Ends Heated Seat Subscriptions Because People Hated It

Posted on by

Last year, BMW underwent media and customer hellfire over its decision to offer a monthly subscription for heated seats. While seat heating wasn’t the only option available for subscription, it was the one that seemed to infuriate everyone the most, since it concerned hardware already present in the car from the factory. After months of customers continuously expressing their displeasure with the plan, BMW has finally decided to abandon recurring charges for hardware-based functions.

“What we don’t do any more—and that is a very well-known example—is offer seat heating by [monthly subscriptions]” BMW marketing boss Pieter Nota said to Autocar. “It’s either in or out. We offer it by the factory and you either have it or you don’t have it.”

BMW’s move wasn’t solely about charging customers monthly for heated seats. Rather, the luxury automaker wanted to streamline production and reduce costs there by physically installing heated seats in every single car, since 90% of all BMWs are bought with seat heaters anyway. Then, owners who didn’t spec heated seats from the factory could digitally unlock them later with either a monthly subscription or a one-time perma-buy option. Nota still believes it was a good idea.

[…]

BMW was absolutely double dipping with heated seat subscriptions. The company started down that route to reduce production costs, making each car cheaper to build by streamlining the process. Fair enough. However, those reduced costs weren’t then passed down to buyers via lower MSRPs. Customers were technically paying for those heated seats anyway, no matter whether they wanted them. Then, BMW was not only charging extra to use a feature already installed in the car, but also subjecting it to subscription billing, even though seat heating is static hardware not designed to change or improve over time.

Customers weren’t happy, and rightfully made their grievance known. While it’s good that BMW ultimately buckled to the public’s wishes here, it doesn’t seem like the automaker’s board members truly understand why the outrage happened in the first place.

[…]

Source: BMW Ends Heated Seat Subscriptions Because People Hated It

Kokoon / Philips Sleep Headphones (Designed for Ultimate Comfort)

Posted on by

Philips and sleep specialists Kokoon have partnered to create an unparalleled sleep headphone.

The Philips Sleep Headphones, powered by Kokoon, blends sleep science and ergonomic know-how with Philips’ century-long reputation for crafting top-notch products.

[…]

Experience a comfort revolution. After numerous nights of testing, our team has crafted an earbud that flawlessly conforms to the shape of your ear for maximum comfort during side sleeping.

[…]

Sleep soundly with advanced biosensors that detect when you drift off and adjust sound levels accordingly, ensuring a peaceful and uninterrupted night.

[…]

Our biosensors introduce white noise during the night to assist with blocking out disruptive sounds such as snoring or external noise. Discover a more peaceful sleeping environment.

[…]

Get a better night’s sleep with sounds backed by science. Select from a variety of options including meditations, soundscapes, binaural beats, and more to ease into slumber.

[…]

Source: Kokoon Sleep Headphones (Designed for Ultimate Comfort) | Kokoon

The Grammys will consider that viral song with Drake and The Weeknd AI vocals for awards after all

Posted on by

The person behind an AI-generated song that went viral earlier this year has submitted the track for Grammy Awards consideration. The Recording Academy has stated that such works aren’t eligible for certain gongs. However, Ghostwriter, the pseudonymous person behind “Heart on My Sleeve,” has submitted the track in the best rap song and song of the year categories, according to Variety. Both of those are songwriting honors. The Academy has suggested it’s open to rewarding tracks that are mostly written by a human, even if the actual recording is largely AI-generated.

Ghostwriter composed the song’s lyrics rather than leaving them up to, say, ChatGPT. But rather than sing or rap those words, they employed a generative AI model to mimic the vocals of Drake and The Weeknd, which helped the song to pick up buzz. The artists’ label Universal Music Group wasn’t happy about that and it filed copyright claims to remove “Heart on My Sleeve” from streaming services. Before that, though, the track racked up hundreds of thousands of listens on Spotify and more than 15 million on TikTok.

[…]

It seems there’s one major roadblock as things stand, though. For a song to be eligible for a Grammy, it needs to have “general distribution” across the US through the likes of brick-and-mortar stores, online retailers and streaming services. Ghostwriter is reportedly aware of this restriction, but it’s unclear how they plan to address that.

In any case, this may well be a canary in the coal mine for rewarding the use of generative AI in art.

[…]

Source: The Grammys will consider that viral song with Drake and The Weeknd AI vocals for awards after all

This is like saying that any song with a guitar or any song with a synthesizer won’t be considered for a Grammy

A US senator has a grip on the Confirmation Process for Military Officers and is using it to blackmail the government

Posted on by

Senator Tuberville’s blanket hold on general officer nominations reaches its six-month anniversary this week. This all seems to have started with a reckless idea dreamed up by a staffer with no experience in the Senate who then left the Senator’s employment after taking credit for it in a Washington Post exposé. From its shaky foundations, the hold strategy has now morphed into a take-no-prisoners stand against federal funding of abortion and “wokeness” in the military. Tuberville appears to have no concept of an end game except total victory. Barring capitulation by the Senator, which doesn’t seem to be in the cards, the rest of the Senate needs to come up with a Plan B.

There are now 301 general and flag officer positions, including five spots on the Joint Chiefs of Staff, which are impacted by these holds. By year’s end, that number may rise to 650. Tuberville argues that there is no readiness impact for having acting officers in place. He may eventually be right in the sense that the military is a mission-driven organization and will adjust whether or not the Senate acts. Since military rotations are on a two-year cycle, fairly soon every general and admiral in the military will be in an acting position. This may be the likeliest future outcome.

[…]

Regular order and unscripted debates on amendments died long ago and as a result, the Senate can’t pass annual authorization bills except for the defense policy bill. The civilian nominations process is broken with over 180 confirmed positions still unfilled two and a half years into the current administration, and now the military nominations process has come unglued.

Trying to convince Senator Tuberville to withdraw his holds has been an exercise in futility. There is equally no appetite to modify the rules for holds and bundle these confirmations as that might set undesirable precedents. That leaves the option of doing nothing or altering what positions the Senate is required to confirm. The latter should be considered.

Until the Tuberville holds, the Senate routinely considered 50,000 military nominees a year primarily by unanimous consent. The biggest question one must ask is why? All military officers above the O-4 level (a major or lieutenant commander) must go through Senate confirmation for each promotion. This is referred to as a constitutional responsibility and yet an O-4 is the equivalent to a GS-13 in the civil service, while general officers are the equivalent of the Senior Executive Service (SES). The Senate does not confirm the nearly 490,000 federal employees at the GS-13 level or above nor the over 8,000 members of the SES even though they are all technically officers of the federal government as defined by the Constitution.

[…]

What would parity look like? Currently, 61 civilians at the Department of Defense (DoD) require Senate confirmation. That is a good starting point to consider for military generals, but just focusing on the 41 four-star generals in service according to the latest DoD data is probably enough. Confirming just these officers could take over four months of floor time if holds were placed on them. Still, the Senate now needs to structure its rules and plan its calendar around standing holds on all nominations—civilian or military. That means limiting the number of individuals that require confirmation.

Source: The Senate Can No Longer Have Nice Things: Ending the Confirmation Process for Military Officers | American Enterprise Institute – AEI

Grasping entropy: Teachers and students investigate thermodynamics through a hands-on model

Posted on by

Though a cornerstone of thermodynamics, entropy remains one of the most vexing concepts to teach budding physicists in the classroom. As a result, many people oversimplify the concept as the amount of disorder in the universe, neglecting its underlying quantitative nature.

 

In The Physics Teacher, researcher T. Ryan Rogers designed a hand-held model to demonstrate the concept of for students. Using everyday materials, Rogers’ approach allows students to confront the topic with new intuition—one that takes specific aim at the confusion between entropy and disorder.

“It’s a huge conceptual roadblock,” Rogers said. “The good news is that we’ve found that it’s something you can correct relatively easily early on. The bad news is that this misunderstanding gets taught so early on.”

While many classes opt for the imperfect, qualitative shorthand of calling entropy “disorder,” it’s defined mathematically as the number of ways energy can be distributed in a system. Such a definition merely requires students to understand how particles store energy, formally known as “degrees of freedom.”

To tackle the problem, Rogers developed a model in which small objects such as dice and buttons are poured into a box, replicating a simple thermodynamic system. Some particles in the densely filled box are packed in place, meaning they have fewer degrees of freedom, leading to an overall low-entropy system.

As students shake the box, they introduce energy into the system, which loosens up locked-in particles. This increases the overall number of ways energy can be distributed within the box.

“You essentially zoom in on entropy so students can say, ‘Aha! There is where I saw the entropy increase,'” Rogers said.

As students shake further, the particles settle into a configuration that more evenly portions out the energy among them. The catch: at this point of high entropy, the particles fall into an orderly alignment.

“Even though it looks more orientationally ordered, there’s actually higher entropy,” Rogers said.

All the who participated in the lesson were able to reason to the correct definition of entropy after the experiment.

Next, Rogers plans to extend the reach of the model by starting a conversation about entropy with other educators and creating a broader activity guide for ways to use the kits for kindergarten through college. He hopes his work inspires others to clarify the distinction in their classrooms, even if by DIY means.

“Grapes and Cheez-It crackers are very effective, as well,” Rogers said.

The article, “Hands-on Model for Investigating Entropy and Disorder in the Classroom,” is authored by T. Ryan Rogers and is published in The Physics Teacher.

More information: T. Ryan Rogers, Hands-on Model for Investigating Entropy and Disorder in the Classroom, The Physics Teacher (2023). DOI: 10.1119/5.0089761

Source: Grasping entropy: Teachers and students investigate thermodynamics through a hands-on model

Microsoft to stop forcing Windows 11 users into Edge in EU countries

Posted on by

Microsoft will finally stop forcing Windows 11 users in Europe into Edge if they click a link from the Windows Widgets panel or from search results. The software giant has started testing the changes to Windows 11 in recent test builds of the operating system, but the changes are restricted to countries within the European Economic Area (EEA).

“In the European Economic Area (EEA), Windows system components use the default browser to open links,” reads a change note from a Windows 11 test build released to Dev Channel testers last month. I asked Microsoft to comment on the changes and, in particular, why they’re only being applied to EU countries. Microsoft refused to comment.

Microsoft has been ignoring default browser choices in its search experience in Windows 10 and the taskbar widget that forces users into Edge if they click a link instead of their default browser. Windows 11 continued this trend, with search still forcing users into Edge and a new dedicated widgets area that also ignores the default browser setting.

[…]

Source: Microsoft to stop forcing Windows 11 users into Edge in EU countries – The Verge

Big Tech failed to police Russian disinformation: EU study

Posted on by

[…]

The independent study of the DSA’s risk management framework published by the EU’s executive arm, the European Commission, concluded that commitments by social media platforms to mitigate the reach and influence of global online disinformation campaigns have been generally unsuccessful.

The reach of Kremlin-sponsored disinformation has only increased since the major platforms all signed a voluntary Code of Practice on Disinformation in mid-2022.

“In theory, the requirements of this voluntary Code were applied during the second half of 2022 – during our period of study,” the researchers said. We’re sure you’re just as shocked as we are that social media companies failed to uphold a voluntary commitment.

Between January and May of 2023, “average engagement [of pro-Kremlin accounts rose] by 22 percent across all online platforms,” the study said. By absolute numbers, the report found, Meta led the pack on engagement with Russian misinformation. However, the increase was “largely driven by Twitter, where engagement grew by 36 percent after CEO Elon Musk decided to lift mitigation measures on Kremlin-backed accounts,” researchers concluded. Twitter, now known as X, pulled out of the disinformation Code in May.

Across the platforms studied – Facebook, Instagram, Telegram, TikTok, Twitter and YouTube – Kremlin-backed accounts have amassed some 165 million followers and have had their content viewed at least 16 billion times “in less than a year.” None of the platforms we contacted responded to questions.

[…]

The EU’s Digital Services Act and its requirements that VLOPs (defined by the Act as companies large enough to reach 10 percent of the EU, or roughly 45 million people) police illegal content and disinformation became enforceable late last month.

Under the DSA, VLOPs are also required “to tackle the spread of illegal content, online disinformation and other societal risks,” such as, say, the massive disinformation campaign being waged by the Kremlin since Putin decided to invade Ukraine last year.

[…]

Now that VLOPs are bound by the DSA, will anything change? We asked the European Commission if it can take any enforcement actions, or whether it’ll make changes to the DSA to make disinformation rules tougher, but have yet to hear back.

Two VLOPs are fighting their designation: Amazon and German fashion retailer Zalando. The two orgs claim that as retailers, they shouldn’t be considered in the same category as Facebook, Pinterest, and Wikipedia.

[…]

Source: Big Tech failed to police Russian disinformation: EU study • The Register

TV Museum Will Die in 48 Hours Unless Sony Retracts YouTube Copyright Strikes on 40 – 60 year old TV shows

Posted on by

Rick Klein and his team have been preserving TV adverts, forgotten tapes, and decades-old TV programming for years. Now operating as a 501(c)(3) non-profit, the Museum of Classic Chicago Television has called YouTube home since 2007. However, copyright notices sent on behalf of Sony, protecting TV shows between 40 and 60 years old, could shut down the project in 48 hours.

[…]

After being reborn on YouTube as The Museum of Classic Chicago Television (MCCTv), the last sixteen years have been quite a ride. Over 80 million views later, MCCTv is a much-loved 501(c)(3) non-profit Illinois corporation but in just 48 hours, may simply cease to exist.

In a series of emails starting Friday and continuing over the weekend, Klein began by explaining his team’s predicament, one that TorrentFreak has heard time and again over the past few years. Acting on behalf of a copyright owner, in this case Sony, India-based anti-piracy company Markscan hit the MCCTv channel with a flurry of copyright claims. If these cannot be resolved, the entire project may disappear.

[…]

No matter whether takedowns are justified, unjustified (Markscan hit Sony’s own website with a DMCA takedown recently), or simply disputed, getting Markscan’s attention is a lottery at best, impossible at worst. In MCCTv’s short experience, nothing has changed.

“Our YouTube channel with 150k subscribers is in danger of being terminated by September 6th if I don’t find a way to resolve these copyright claims that Markscan made,” Klein told TorrentFreak on Friday.

“At this point, I don’t even care if they were issued under authorization by Sony or not – I just need to reach a live human being to try to resolve this without copyright strikes. I am willing to remove the material manually to get the strikes reversed.”

[…]

Complaints Targeted TV Shows 40 to 60 years old

[…]

Two episodes of the TV series Bewitched dated 1964 aired on ABC Network and almost sixty years later, archive copies of those transmissions were removed from YouTube for violating Sony copyrights, with MCCTv receiving a strike.

[…]

Given that copyright law locks content down for decades, Klein understands that can sometimes cause issues, although 16 years on YouTube suggests that the overwhelming majority of rightsholders don’t consider his channel a threat. If they did, the option to monetize the recordings can be an option.

No Competition For Commercial Offers

Why most rightsholders have left MCCTv alone is hard to say; perhaps some see the historical value of the channel, maybe others don’t know it exists. At least in part, Klein believes the low quality of the videos could be significant.

“These were relatively low picture quality broadcast examples from various channels from various years at least 30-40 years ago, with the original commercial breaks intact. Also mixed in with these were examples of ’16mm network prints’ which are surviving original film prints that were sent out to TV stations back in the day from when the show originally aired. In many cases they include original sponsorship notices, original network commercials, ‘In Color’ notices, etc.,” he explains.

[…]

Klein says the team is happy to comply with Sony’s wishes and they hope that given a little leeway, the project won’t be consigned to history. Perhaps Sony will recall the importance of time-shifting while understanding that time itself is running out for The Museum of Classic Chicago Television.

Source: TV Museum Will Die in 48 Hours Unless Sony Retracts YouTube Copyright Strikes * TorrentFreak

Mozilla investigates 25 major car brands and finds privacy is shocking

Posted on by

[…]

The foundation, the Firefox browser maker’s netizen-rights org, assessed the privacy policies and practices of 25 automakers and found all failed its consumer privacy tests and thereby earned its Privacy Not Included (PNI) warning label.

If you care even a little about privacy, stay as far away from Nissan’s cars as you possibly can

In research published Tuesday, the org warned that manufacturers may collect and commercially exploit much more than location history, driving habits, in-car browser histories, and music preferences from today’s internet-connected vehicles. Instead, some makers may handle deeply personal data, such as – depending on the privacy policy – sexual activity, immigration status, race, facial expressions, weight, health, and even genetic information, the Mozilla team found.

Cars may collect at least some of that info about drivers and passengers using sensors, microphones, cameras, phones, and other devices people connect to their network-connected cars, according to Mozilla. And they collect even more info from car apps – such as Sirius XM or Google Maps – plus dealerships, and vehicle telematics.

Some car brands may then share or sell this information to third parties. Mozilla found 21 of the 25 automakers it considered say they may share customer info with service providers, data brokers, and the like, and 19 of the 25 say they can sell personal data.

More than half (56 percent) also say they share customer information with the government or law enforcement in response to a “request.” This isn’t necessarily a court-ordered warrant, and can also be a more informal request.

And some – like Nissan – may also use this private data to develop customer profiles that describe drivers’ “preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.”

Yes, you read that correctly. According to Mozilla’s privacy researchers, Nissan says it can infer how smart you are, then sell that assessment to third parties.

[…]

Nissan isn’t the only brand to collect information that seems completely irrelevant to the vehicle itself or the driver’s transportation habits.

“Kia mentions sex life,” Caltrider said. “General Motors and Ford both mentioned race and sexual orientation. Hyundai said that they could share data with government and law enforcement based on formal or informal requests. Car companies can collect even more information than reproductive health apps in a lot of ways.”

[…]

the Privacy Not Included team contacted Nissan and all of the other brands listed in the research: that’s Lincoln, Mercedes-Benz, Acura, Buick, GMC, Cadillac, Fiat, Jeep, Chrysler, BMW, Subaru, Dacia, Hyundai, Dodge, Lexus, Chevrolet, Tesla, Ford, Honda, Kia, Audi, Volkswagen, Toyota and Renault.

Only three – Mercedes-Benz, Honda, and Ford – responded, we’re told.

“Mercedes-Benz did answer a few of our questions, which we appreciate,” Caltrider said. “Honda pointed us continually to their public privacy documentation to answer your questions, but they didn’t clarify anything. And Ford said they discussed our request internally and made the decision not to participate.”

This makes Mercedes’ response to The Register a little puzzling. “We are committed to using data responsibly,” a spokesperson told us. “We have not received or reviewed the study you are referring to yet and therefore decline to comment to this specifically.”

A spokesperson for the four Fiat-Chrysler-owned brands (Fiat, Chrysler, Jeep, and Dodge) told us: “We are reviewing accordingly. Data privacy is a key consideration as we continually seek to serve our customers better.”

[…]

The Mozilla Foundation also called out consent as an issue some automakers have placed in a blind spot.

“I call this out in the Subaru review, but it’s not limited to Subaru: it’s the idea that anybody that is a user of the services of a connected car, anybody that’s in a car that uses services is considered a user, and any user is considered to have consented to the privacy policy,” Caltrider said.

Opting out of data collection is another concern.

Tesla, for example, appears to give users the choice between protecting their data or protecting their car. Its privacy policy does allow users to opt out of data collection but, as Mozilla points out, Tesla warns customers: “If you choose to opt out of vehicle data collection (with the exception of in-car Data Sharing preferences), we will not be able to know or notify you of issues applicable to your vehicle in real time. This may result in your vehicle suffering from reduced functionality, serious damage, or inoperability.”

While technically this does give users a choice, it also essentially says if you opt out, “your car might become inoperable and not work,” Caltrider said. “Well, that’s not much of a choice.”

[…]

Source: Mozilla flunks 25 major car brands for data privacy fails • The Register

Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach

Posted on by

In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech industry has led some security experts to conclude that crooks likely have succeeded at cracking open some of the stolen LastPass vaults.

[…]

Since late December 2022, Monahan and other researchers have identified a highly reliable set of clues that they say connect recent thefts targeting more than 150 people, Collectively, these individuals have been robbed of more than $35 million worth of crypto.

Monahan said virtually all of the victims she has assisted were longtime cryptocurrency investors, and security-minded individuals. Importantly, none appeared to have suffered the sorts of attacks that typically preface a high-dollar crypto heist, such as the compromise of one’s email and/or mobile phone accounts.

[…]

Monahan has been documenting the crypto thefts via Twitter/X since March 2023, frequently expressing frustration in the search for a common cause among the victims. Then on Aug. 28, Monahan said she’d concluded that the common thread among nearly every victim was that they’d previously used LastPass to store their “seed phrase,” the private key needed to unlock access to their cryptocurrency investments.

[…]

Bax, Monahan and others interviewed for this story say they’ve identified a unique signature that links the theft of more than $35 million in crypto from more than 150 confirmed victims, with roughly two to five high-dollar heists happening each month since December 2022.

[…]

But the researchers have published findings about the dramatic similarities in the ways that victim funds were stolen and laundered through specific cryptocurrency exchanges. They also learned the attackers frequently grouped together victims by sending their cryptocurrencies to the same destination crypto wallet.

A graphic published by @tayvano_ on Twitter depicting the movement of stolen cryptocurrencies from victims who used LastPass to store their crypto seed phrases.

By identifying points of overlap in these destination addresses, the researchers were then able to track down and interview new victims. For example, the researchers said their methodology identified a recent multi-million dollar crypto heist victim as an employee at Chainalysis, a blockchain analysis firm that works closely with law enforcement agencies to help track down cybercriminals and money launderers.

Chainalysis confirmed that the employee had suffered a high-dollar cryptocurrency heist late last month, but otherwise declined to comment for this story.

[…]

I’ve been urging my friends and family who use LastPass to change all of their passwords and migrate any crypto that may have been exposed, despite knowing full well how tedious that is.”

[…]

Source: Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach – Krebs on Security

Paper Cups Are Bad for the Environment Too, Study Finds

Posted on by

[…]

A study published last month in the journal Environmental Pollution outlines how paper cups can leach toxic materials into the surrounding environment. This is because paper cups are often coated in a layer of polylactic acid, otherwise known as PLA. It’s a bioplastic and is touted as a biodegradable alternative to traditional plastic. However, researchers found that it caused adverse health effects in aquatic midge larvae.

Researchers at the University of Gothenburg tested the effects of both plastic cups and paper cups on the midge larvae. Both types of cups were put in water or sediments for up to four weeks. The larvae were then put into aquariums that contained the sediment and water that once held the plastic and paper cups. The contaminated sediment and water were tested separately.

“We observed a significant growth inhibition with all the materials tested when the larvae were exposed in contaminated sediment,” the researchers wrote in the study. “Developmental delays were also observed for all materials, both in contaminated water and sediment.”

They found that growth challenges and developmental delays were observed in environments where the cups leached into them for only one week. The negative effects of the exposure increased in the water and sediment that held the paper and plastic cups for longer periods of time. This challenges the belief that bioplastics are safer. PLA does break down faster than traditional fossil fuel-based plastic material, but the study results show that they aren’t much safer.

“Bioplastics does not break down effectively when they end up in the environment, in water,” Bethanie Carney Almroth, a professor at the University of Gothenburg and study author, said in a press release. “There may be a risk that the plastic remains in nature and resulting microplastics can be ingested by animals and humans, just as other plastics do. Bioplastics contain at least as many chemicals as conventional plastic.”

Other previous studies have found that the plastic coating in paper cups can also create microplastics that enter the liquid in the cup. In 2019, a research group based out of India filled paper cups with hot water and found that there were an alarming amount of microplastic particles in a paper cup after filling the cups with hot liquids, Wired reported. The researchers found that there were about 25,000 particles per 100 ml cup after 15 minutes.

[…]

Source: Paper Cups Are Bad for the Environment Too, Study Finds

Watch Oscilloscope Kickstarter rewards sent – 10 years after backing

Posted on by

It may have taken ten years to come through on this particular Kickstarter, but a promise is a promise. In late August 2023, backers who had since likely forgotten all about the project started receiving their oscilloscope watches from creator [Gabriel Anzziani]. Whatever the reason(s) for the delay, the watch looks great, and is miles ahead of the prototype pictures.

As you may have guessed, it functions as both a watch and an oscilloscope. The watch has 12- and 24-hour modes as well as an alarm and calendar, and the ‘scope has all the features of the Xprotolab dev board, which [Gabriel] also created: ‘scope, waveform generator, logic analyzer, protocol sniffer, and frequency counter.

Internally, it has an 8-bit Xmega microcontroller which features an internal PDI, and the display is a 1.28″ e-ink display. When we covered this ten years ago, the screen was the type of Sharp LCD featured in the Pebble watch. [Gabriel]’s ‘scope watch features eight buttons around the edge which are user-programmable. One of [Gabriel]’s goals was for people to make their own apps.

Of course, the Kickstarter rewards are no longer available, but if you want to build your own small, digital ‘scope, check out this DIY STM32 project.

Source: The ‘Scope Of This Kickstarter? Ten Years. | Hackaday

Some Galaxies Contain Double Supermassive Black Holes

Posted on by

Blazars occupy an intriguing spot in the cosmic zoo. They’re bright active galactic nuclei (AGN) that blast out cosmic rays, are bright in radio emission, and sport huge jets of material traveling in our direction at nearly the speed of light. For some blazars, their jets look curvy and snaky and astronomers have questions.

[…]

“We present evidence and discuss the possibility that it is in fact the precession of the jet source, either caused by a supermassive binary black hole at the footpoint of the jet or – less likely – by a warped accretion disk around a single black hole, that is responsible for the observed variability,” said Britzen from the Max Planck Institute for Radio Astronomy in Bonn, Germany.

[…]

Britzen and the team investigated an object called OJ 287 to see if it could give some clues. It appears to have two black holes—essentially a black hole binary—at its core. Studies of this galaxy and 12 other AGNS led to the conclusion that jet curvature may provide a smoking gun clue to the existence of binary black holes in galaxy cores.

[…]

One black hole is emitting the jet and the other one’s gravitational influence affects the appearance and behavior of the jet. According to Michal Zajacek, who is a co-author of the study with Britzen, it helps explain the jet’s appearance. “Physics of accretion disks and jets is rather complex but their bulk kinematics can be compared to simple gyroscopes,” he said. “If you exert an external torque on an accretion disk, for instance by an orbiting secondary black hole, it will precess and nutate, and along with it the jet as well, similar to the Earth’s rotation axis that is affected by the Moon and the Sun.”

 A magnetized radio jet (yellow), precessing due to a pair of supermassive black holes. The larger one is shown in black at the center of the accretion disk. It contains warmer (blue) and cooler (red) gas. The white arrow indicates the spin of the larger black hole. The second black hole orbits (orange) around the central supermassive black hole and the orange arrow shows the orientation of its orbital angular momentum. Due to misalignment, torque from the secondary drives the precession of the accretion disk as well as the launched jet (green circle and arrows).  Radio emission is indicated with white curved lines. These show how the jet swirls around and produces variations in radio emission. Courtesy: Michal Zaja?ek/UTFA MUNI
 A magnetized radio jet (yellow), precessing due to a pair of supermassive black holes. The larger one is (black) at the center of the accretion disk. It contains warmer (blue) and cooler (red) gas. The white arrow indicates the spin of the larger black hole. The second black hole orbits (orange) around the central supermassive black hole and the orange arrow shows the orientation of its orbital angular momentum. Due to misalignment, torque from the secondary drives the precession of the accretion disk as well as the launched jet (green circle and arrows).  White curved lines indicate radio emission. Courtesy: Michal Zaja?ek/UTFA MUNI

Searching for the Black Hole Binaries

If this is the case for other blazars, the meandering jet and brightness variability may well be the clue astronomers need to probe for other binary black holes. It’s not an easy task to find the black holes, even though the AGNS themselves are bright, according to Britzen. “We still lack the sufficient resolution to probe the existence of supermassive binary black holes directly,” she said. “But jet precession seems to provide the best signature of these objects, whose existence is expected not only by the black hole / AGN community but also from the gravitational wave/pulsar community who recently published evidence for the existence of a cosmic gravitational background due to the gravitational waves emitted by the mergers of massive black holes through cosmic history.”

[…]

Source: Some Galaxies Contain Double Supermassive Black Holes – Universe Today

antiX 23: Ultralightweight minimal Debian 12 desktop

Posted on by

The latest release of antiX is Linux how it used to be, in the good way. It’s not the friendliest, but it does everything – and, wow, it’s fast.

The “proudly antifascist” antiX project has released its latest edition, based on Debian 12. This release is codenamed Arditi del Popolo – “the People’s Daring Ones” – after a 1920s Italian antifascist group formed to oppose Mussolini’s regime. antiX is not, as the name might imply, opposed to the X window system: its main editions are graphical, with a choice of environments (although there is a super-minimal, text-only edition if that’s what you want).

Instead, antiX seems to be opposed to pretty much all of the modern trends in desktop Linux, the sorts of technologies that old-timers often consider bloated or inefficient. It doesn’t use systemd or elogind. It doesn’t have Wayland, or heavyweight cross-distro packaging tools such as Flatpak or Snap. It doesn’t even have any of the standard desktop environments. By antiX standards, we suspect that a “desktop environment” would count as bloat.

(If you prefer a familiar desktop, then antiX 23 is one of the parent distros of MX Linux 23, which offers both Xfce and KDE variants.)

Instead of an integrated desktop, antiX provides a broad selection of tools that provide all the functionality of a desktop: app launchers, status monitors, wireless networking, file managers, whatever you need. Not only is it present, but you get a selection of alternatives, and in many cases there are both graphical and shell-based tools available. Despite all this, the 64-bit edition with kernel 6.1 still idles at under 200MB of memory in use, which is startlingly good for a 2023 distro. The Reg standard recommendation for a lightweight desktop Linux is the Raspberry Pi Desktop, which is based on Debian 11 and LXDE. antiX is built from newer components, but even so it uses less memory and it’s faster too.

So in a way, it reminds The Reg FOSS Desk of the good aspects of Linux the way it was in the 20th century. The full edition comes with lots of applications, including a few of the standard big names, such as Firefox ESR and LibreOffice. Aside from them, though, most are less well-known alternatives, ones that are smaller, faster, and take less memory.

antiX 23 with IceWM and a couple of ROX Filer windows open. Looks like a desktop, works like a desktop – but faster

antiX 23 with IceWM and a couple of ROX Filer windows open. Looks like a desktop, works like a desktop – but faster

What’s missing are the bad parts. From modern Linux, the multiple huge, lumbering tools, all too often written in relatively sluggish interpreted programming languages, each of which pulls in a gigabyte of dependencies; and worse still, allegedly “local applications” which are actually web applets implemented in Javascript, so each tool drags an entire embedded web browser around with it. And from 1990s Linux, the rough edges: this is a modern distro, with modern hardware support, and the standard installation gives you a complete graphical environment with sound, networking and so on all pre-configured and working.

It stands in contrast to most other contemporary minimal distros such as Alpine Linux, Arch Linux or Void Linux, to pick some random examples. While these are all very capable distros, you must do a substantial amount of manual installation and configuration post-installation if you want a graphical desktop and the usual assortment of text editors, media players, communications tools, and so on. They also have their own idiosyncratic packaging tools etc. so to get started with customizing your new distro, you’ll probably have to spend some time on Google finding the commands and their syntax.

antiX is based on Debian, which, as we said when celebrating its 30th birthday recently, is the most widely used family of Linux distros there is – so it uses the familiar apt commands for managing software.

antiX 23 with JWM and the zzz file manager. It's different, but not very. We're not convinced it really needs both

antiX 23 with JWM and the zzz file manager. It’s different, but not very. We’re not convinced it really needs both

So it’s a cut-down Debian “Bookworm”, with some of the controversial bits – such as systemd and the fancy desktop environments – taken out. You get a choice of two init systems: the default sysvinit or the more modern runit. These aren’t installation options, as they are in Devuan, say: you must choose and download the appropriate installation image. There are both 32-bit and 64-bit x86 editions.

The full edition offers four window managers: IceWM, JWM, Fluxbox, and Herbsluftwm. IceWM offers a fairly rich Windows-like setup, with a taskbar, start menu, and some preconfigured system monitors and applets. JWM offers a more basic, no-frills version of the same layout. Fluxbox drops all that stuff for an even more minimalistic overlapping window manager. All include the Conky desktop status display. Finally, Herbsluftwm is an extremely minimal tiling window manager.

But the choices don’t end there. antiX also includes two different file managers, ROX Filer and zzz, both of which provide desktop icons and multi-folder-window style navigation. Optionally, ROX Filer has its own desktop panel too for an approximate simulation of RISC OS desktop, which means you get two different desktop panels.

There are also “minimal” login options, which don’t load a file manager. This means the (extremely basic) slimski login screen offers no less than 13 desktop options.

This is emblematic of the main issue with antiX: if anything, it offers too much choice. There are full, light, and minimal editions; sysvinit and runit editions; and i686 and x86-64 editions. There are over a dozen different combinations of window manager and file managers. The top-level app menu has 14 entries, with both a “Control Centre” and a “Settings” submenu. One of the menu entries is called “Applications” and contains the usual hierarchical list of apps, but some are also on the top level, and there’s a “Personal” menu where you can pin your favourites. This is accessible from the Start button analog in the two window managers which have one, and by right-clicking the desktop in all three which have a desktop. For all the main app categories – text editors, and web browsers, media players, and so on – there are multiple options, sometimes three or four of them.

Considering that this is one of the most lightweight Linux distros, it’s an embarrassment of riches. There are so many options, choices, themes, and settings, most of them with multiple ways to get at them, that even for an experienced user, it’s bewildering. There are even 16 different downloads on offer: Full, Base, Core, and Net, two init systems, and two CPU architectures.

The Fluxbox window manager, with its virtual desktop switcher control at the bottom, and ROX Session's panel at the top. With some tweaking, it could be very like RISC OS

The Fluxbox window manager, with its virtual desktop switcher control at the bottom, and ROX Session’s panel at the top. With some tweaking, it could be very like RISC OS

While with Alpine or Void, you can achieve an extremely lightweight, fully graphical desktop system, you must do this by installing and configuring most of it yourself. With antiX, to get to a setup you are happy with, you will still have to do quite a lot of custom configuration, but it will be removing tools that you don’t want. Of course, there are package management tools to help you do that: there’s Package Installer, and Program Remover, and Synaptic, and a menu-driven shell-based package manager, and of course apt – and apt-get and aptitude.

When you download, install, and boot antiX, it feels amazingly tiny and fast by modern standards. We have the older release 21 on our elderly Atom-based Sony Vaio P, and it makes that geriatric sub-netbook feel sprightly. Then you log in, start to browse the application menu, and find a Swiss army knife, where there’s a tool for everything. The trouble is, each blade unfolds to reveal another Swiss army knife. It’s almost fractal.

Back when Ubuntu first launched in 2004, it scored over Debian because someone had done the curation of programs for you. You got what was arguably the best completely FOSS desktop at the time, GNOME 2, and one best-of-breed app in each category of essential program – one web browser, one email client, one media player, and so on, all nicely set up and integrated into a harmonious whole. And when it started out, it was relatively slim and lightweight and fast. With Debian, you had to choose all this for yourself, which gives you great freedom, but requires considerable expertise, and the result might not feel very coherent and require quite some fine tuning. Now, both are pretty big, and these days Ubuntu offers a choice of 10 different desktop flavors, plus Server and Core and container images and more.

This is where MX Linux scores over this, its much smaller parent distro. The MX team does that curation for you. With antiX, you get the freedom to pick and choose from a profusion of tools, many of which you’ve probably never heard of and so wouldn’t know to install. But you will probably want to break out the hammer and chisel, and sculpt it down into something you find pleasing.

It’s a very interesting distro, if you know a bit of what you’re doing and want to learn and experiment and customize it. It’s also very lightweight in resource usage, and will run well on some ancient hardware that most modern distros won’t even attempt to boot on.

But we can’t help but feel that, as its name hints, it’s a bit anarchic. It feels designed by committee, where everyone got their choices included. Some judicious pruning and selection would really help buff it to a shine.

Source: antiX 23: Ultralightweight minimal Debian 12 • The Register

Australian Government, Of All Places, Says Age Verification Is A Privacy & Security Nightmare

Posted on by

In the past I’ve sometimes described Australia as the land where internet policy is completely upside down. Rather than having a system that protects intermediaries from liability for third party content, Australia went the opposite direction. Rather than recognizing that a search engine merely links to content and isn’t responsible for the content at those links, Australia has said that search engines can be held liable for what they link to. Rather than protect the free expression of people on the internet who criticize the rich and powerful, Australia has extremely problematic defamation laws that result in regular SLAPP suits and suppression of speech. Rather than embrace encryption that protects everyone’s privacy and security, Australia requires companies to break encryption, insisting only criminals use it.

It’s basically been “bad internet policy central,” or the place where good internet policy goes to die.

And, yet, there are some lines that even Australia won’t cross. Specifically, the Australian eSafety commission says that it will not require adult websites to use age verification tools, because it would put the privacy and security of Australians’ data at risk. (For unclear reasons, the Guardian does not provide the underlying documents, so we’re fixing that and providing both the original roadmap and the Australian government’s response

[…]

Of course, in France, the Data Protection authority released a paper similarly noting that age verification was a privacy and security nightmare… and the French government just went right on mandating the use of the technology. In Australia, the eSafety Commission pointed to the French concerns as a reason not to rush into the tech, meaning that Australia took the lessons from French data protection experts more seriously than the French government did.

And, of course, here in the US, the Congressional Research Service similarly found serious problems with age verification technology, but it hasn’t stopped Congress from releasing a whole bunch of “save the children” bills that are built on a foundation of age verification.

[…]

Source: Australian Government, Of All Places, Says Age Verification Is A Privacy & Security Nightmare | Techdirt

Don’t update Baldur’s Gate 3: Companions Hornyness and sex is being cancelled

Posted on by

Sorry, it turns out it wasn’t that there was just something irresistible about you. Instead it seems that Baldur’s Gate 3 shipped with a bug that meant all the companions were way hornier than intended.

I thought something felt odd. Having played enough BioWare games over the years to know that all my companions would inevitably find me impossibly alluring at some point, I kind of shrugged when they began throwing themselves at me almost from the off. I figured Baldur’s Gate 3 developers Larian just wanted to get it out of the way, have Gale and Karlach and try to get in my pants sooner rather than later, but it certainly seemed hasty.

It turns out, as discovered by TheGamer, that this wasn’t meant to be the case. A bug slipped through that meant the requirements for companions to be unable to resist your illithid charms were set way too low.

Speaking to the game’s director and Larian boss-guy, Swen Vincke, TheGamer learned that “approval thresholds” were set too low, meaning the buddies you gather into your gang were ready to have special cuddles far sooner than planned. “That’s why they were so horny in the beginning,” explained Vincke.

This has already been fixed for a bunch of the game’s companions, but some still have their libido set to 11, awaiting cold showers in forthcoming patches. Gale was the most affected, as you probably noticed if you played the game, the thirsty wizard ready to make magic happen from the moment he meets you. Vincke told the site that he “wasn’t supposed to be, like, instantly there.”

Read More: 7 Horny Fantasy Games To Play After Baldur’s Gate 3

It’s interesting that Larian has stuck to this being a bug, not a feature, given that being ready to go isn’t exactly abnormal human/tiefling/drow behavior. “It was supposed to simulate how real relationships are,” Vincke told TheGamer, adding that behaving like this would be “problematic” in real life. Well…to some, certainly. But, you know.

It also seems less immediately untoward given Baldur’s Gate 3‘s laudable conversation options to make it clear to your NPC chums that sex isn’t something you’re interested in, even if you do want to roleplay being in love with them.

Even to my old fuddy-duddy British ways, it seems rather quaint, seeing sexual relationships as something only feasible after enough time and approval, as if an instant attraction is so unlikely or impossible. Of course, that’d be kind of weird if it were every companion, as was the case at launch. But this more conservative approach is already going to be in place for many companions for those starting the game today. Sorry, PS5 players.

Source: Baldur’s Gate 3 Companions Are So Horny Because Of A Bug

It must be Americans having complained or something. Boo.

Posted in Sex

The AI Act needs a practical definition of ‘subliminal techniques’ (because those used in Advertising aren’t enough)

Posted on by

While the draft EU AI Act prohibits harmful ‘subliminal techniques’, it doesn’t define the term – we suggest a broader definition that captures problematic manipulation cases without overburdening regulators or companies, write Juan Pablo Bermúdez, Rune Nyrup, Sebastian Deterding and Rafael A. Calvo.

Juan Pablo Bermúdez is a Research Associate at Imperial College London; Rune Nyrup is an Associate Professor at Aarhus University; Sebastian Deterding is a Chair in Design Engineering at Imperial College London; Rafael A. Calvo is a Chair in Engineering Design at Imperial College London.

If you ever worried that organisations use AI systems to manipulate you, you are not alone. Many fear that social media feeds, search, recommendation systems, or chatbots can unconsciously affect our emotions, beliefs, or behaviours.

The EU’s draft AI Act articulates this concern mentioning “subliminal techniques” that impair autonomous choice “in ways that people are not consciously aware of, or even if aware not able to control or resist” (Recital 16, EU Council version). Article 5 prohibits systems using subliminal techniques that modify people’s decisions or actions in ways likely to cause significant harm.

This prohibition could helpfully safeguard users. But as written, it also runs the risk of being inoperable. It all depends on how we define ‘subliminal techniques’ – which the draft Act does not do yet.

Why narrow definitions are bound to fail

The term ‘subliminal’ traditionally refers to sensory stimuli that are weak enough to escape conscious perception but strong enough to influence behaviour; for example, showing an image for less than 50 milliseconds.

Defining ‘subliminal techniques’ in this narrow sense presents problems. First, experts agree that subliminal stimuli have very short-lived effects at best, and only move people to do things they are already motivated to do.

Further, this would not cover most problematic cases motivating the prohibition: when an online ad influences us, we are aware of the sensory stimulus (the visible ad).

Furthermore, such legal prohibitions have been ineffective because subliminal stimuli are, by definition, not plainly visible. As Neuwirth’s historical analysis shows, Europe prohibited subliminal advertising more than three decades ago, but regulators have hardly ever pursued cases.

Thus, narrowly defining ‘subliminal techniques’ as subliminal stimulus presentation is likely to miss most manipulation cases of concern and end up as dead letter.

A broader definition can align manipulation and practical concerns

We agree with the AI Act’s starting point: AI-driven influence is often problematic due to lack of awareness.

However, unawareness of sensory stimuli is not the key issue. Rather, as we argue in a recent paper, manipulative techniques are problematic if they hide any of the following:

  • The influence attempt. Many internet users are not aware that websites adapt based on personal information to optimize “customer engagement”, sales, or other business concerns. Web content is often tailored to nudge us towards certain behaviours, while we remain unaware that such tailoring occurs.
  • The influence methods. Even when we know that some online content seeks to influence, we frequently don’t know why we are presented with a particular image or message – was it chosen through psychographic profiling, nudges, something else? Thus, we can remain unaware of how we are influenced.
  • The influence’s effects. Recommender systems are meant to learn our preferences and suggest content that aligns with them, but they can end up changing our preferences. Even if we know how we are influenced, we may still ignore how the influence changed our decisions and behaviours.

To see why this matters, ask yourself: as a user of digital services, would you rather not be informed about these influence techniques?

Or would you prefer knowing when you are targeted for influence; how influence tricks push your psychological buttons (that ‘Only 1 left!’ sign targets your aversion to loss); and what consequences influence is likely to have (the sign makes you more likely to purchase impulsively)?

We thus propose the following definition:

Subliminal techniques aim at influencing a person’s behaviour in ways in which the person is likely to remain unaware of (1) the influence attempt, (2) how the influence works, or (3) the influence attempt’s effects on decision-making or value- and belief-formation processes.

This definition is broad enough to capture most cases of problematic AI-driven influence; but not so broad as to become meaningless, nor excessively hard to put into practice. Our definition specifically targets techniques: procedures that predictably produce certain outcomes.

Such techniques are already being classified, for example, in lists of nudges and dark patterns, so companies can check those lists and ensure that they either don’t use them or disclose their usage.

Moreover, the AI Act prohibits, not subliminal techniques per se, but only those that may cause significant harm. Thus, the real (self-)regulatory burden lies with testing whether a system increases risks of significant harm—arguably already part of standard user protection diligence.

Conclusion

The default interpretation of ‘subliminal techniques’ would render the AI Act’s prohibition irrelevant for most forms of problematic manipulative influence, and toothless in practice.

Therefore, ensuring the AI Act is legally practicable and reduces regulatory uncertainty requires a different, explicit definition – one that addresses the underlying societal concerns over manipulation while not over-burdening service providers.

We believe our definition achieves just this balance.

(The EU Parliament draft added prohibitions of “manipulative or deceptive techniques”, which present challenges worth discussing separately. Here we claim that subliminal techniques prohibitions, properly defined, could tackle manipulation concerns.)

Source: The AI Act needs a practical definition of ‘subliminal techniques’ – EURACTIV.com

Lenovo Yoga Book 9i: a dual-screen laptop

Posted on by

Photo by Sam Rutherford/Engadget

Photo by Sam Rutherford/Engadget

Photo by Sam Rutherford/Engadget

Photo by Sam Rutherford/Engadget

Every now and then, a device comes along and challenges you to consider the viability of an entirely new product category. That’s precisely what Lenovo is doing with the Yoga Book 9i. By replacing the traditional physical keyboard with a second display, the company is rethinking what a laptop can do. In tight confines, you can rely on a virtual keyboard or an included magnetic alternative.

[…]

The dual 13.3-inch displays (2,880 x 1,800) look great too, boasting OLED panels with rich colors and a tested brightness just shy of 400 nits.

[…]

Around the outside, the Yoga Book features a polished metal frame with three Thunderbolt 4 ports, which is nice to see on a system this size. Unfortunately for fans of wired audio, you don’t get a 3.5mm audio jack. Thankfully, Lenovo’s 5-megapixel IR webcam is sharper than what you get on most competing devices, and holding everything together is the company’s signature speaker bar hinge, which is impressively loud and punchy. All told, despite being slightly heavier than a typical 13-inch ultraportable due to that second layer of glass, it’s still very easy to carry around.

[…]

The remaining pieces of the Yoga Book 9i’s kit are its accessories, which include a stylus, a detached magnetic physical keyboard, a folding kickstand cover and even a sleek travel mouse. The keyboard communicates via Bluetooth and has its own USB-C port for charging. Despite its size, it doesn’t feel cramped and offers more key travel than you might expect. During transport, the cover wraps around the keyboard to keep it protected, while Lenovo’s Digital Pen 3 can be stashed in the attached loop.

[…]

you just tap eight fingers on the bottom panel and instantly you get virtual stand-ins. And for times when you only need to mouse around, you can use a three-finger tap instead, which summons a floating touchpad that leaves room for Lenovo’s widgets (weather, news, etc.) or anything else you’d like to put down there.

Surprisingly, typing on a touchscreen isn’t as bad as you might think. Don’t get me wrong, it’s still not nearly as fast or accurate as using a physical keyboard. But it’s serviceable, as long as you’re willing to make some adjustments.

[…]

What’s most impressive about the Yoga Book 9i’s is its ability to transform into a portable all-in-one PC when it’s propped up on its kickstand cover. In this mode, there are two options for its displays: a stacked setup with one screen on top of the other and a side-by-side arrangement. Both configurations have their uses.

[…]

Packing an Intel Core i7-155U chip, 16GB of RAM and 512GB of storage, the Yoga Book 9i can handle most productivity needs. Even when multitasking across both displays, performance felt relatively snappy. However, if you’re planning on regularly doing more demanding things like video editing, you’ll probably want a beefier machine.

[…]

Even with a relatively large 80Wh battery, for a system with two screens, the Yoga Book 9i fared better than expected on our standard video rundown test. It posted a time of eight hours and 12 minutes

[…]

he Yoga Book 9i is a rather divisive machine. Starting at $2,000, not only is it really expensive, its performance is also slower than more traditional competitors in this price range. However, for people like me who constantly yearn for more screen real estate when I’m away from home, Lenovo has created something that is more than the sum of its parts. When space is limited, the Yoga Book 9i’s clamshell mode feels right at home on an airplane tray table. But when it’s not, it can expand into a portable dual-screen workstation–complete with all the fixings of your desktop at home. And when you need to pack up, everything collapses into a neat, semi-self-contained bundle that fits in the smallest of laptop bags.

The Yoga Book 9i is a nifty little transformer that’s more engaging than anything Michael Bay has directed in the last two decades. With how little laptops have changed recently, it feels like the Yoga Book has even more room to grow in the years to come. Sure, it’s still a bit awkward, but as the starting point for a new type of notebook, Lenovo’s debut dual-screen convertible has me convinced.

Source: Lenovo Yoga Book 9i review: The world isn’t ready for dual-screen laptops, but Lenovo is | Engadget

Sourcegraph published admin token, someone creates API endpoint with free access

Posted on by

An unknown hacker gained administrative control of Sourcegraph, an AI-driven service used by developers at Uber, Reddit, Dropbox, and other companies, and used it to provide free access to resources that normally would have required payment.

In the process, the hacker(s) may have accessed personal information belonging to Sourcegraph users, Diego Comas, Sourcegraph’s head of security, said in a post on Wednesday. For paid users, the information exposed included license keys and the names and email addresses of license key holders. For non-paying users, it was limited to email addresses associated with their accounts. Private code, emails, passwords, usernames, or other personal information were inaccessible.

Free-for-all

The hacker gained administrative access by obtaining an authentication key a Sourcegraph developer accidentally included in a code published to a public Sourcegraph instance hosted on Sourcegraph.com. After creating a normal user Sourcegraph account, the hacker used the token to elevate the account privileges to those of an administrator. The access token appeared in a pull request posted on July 14, the user account was created on August 28, and the elevation to admin occurred on August 30.

“The malicious user, or someone connected to them, created a proxy app allowing users to directly call Sourcegraph’s APIs and leverage the underlying LLM [large language model],” Comas wrote. “Users were instructed to create free Sourcegraph.com accounts, generate access tokens, and then request the malicious user to greatly increase their rate limit. On August 30 (2023-08-30 13:25:54 UTC), the Sourcegraph security team identified the malicious site-admin user, revoked their access, and kicked off an internal investigation for both mitigation and next steps.”

The resource free-for-all generated a spike in calls to Sourcegraph programming interfaces, which are normally rate-limited for free accounts.

A graph showing API usage from July 31 to August 29 with a major spike at the end.
Enlarge / A graph showing API usage from July 31 to August 29 with a major spike at the end.
Sourcegraph

“The promise of free access to Sourcegraph API prompted many to create accounts and start using the proxy app,” Comas wrote. “The app and instructions on how to use it quickly made its way across the web, generating close to 2 million views. As more users discovered the proxy app, they created free Sourcegraph.com accounts, adding their access tokens, and accessing Sourcegraph APIs illegitimately.”

[…]

Source: Hacker gains admin control of Sourcegraph and gives free access to the masses | Ars Technica

Lenovo’s new 27-inch, 4K monitor offers glasses-free 3D

Posted on by

Lenovo’s next 27-inch 4K monitor is unlike any display it has released before. Featuring a lenticular lens and real-time eye-tracking, it’s a 3D monitor that doesn’t require any glasses. Other companies are already pushing stereoscopic products, but Lenovo’s ThinkVision 27 3D Monitor, announced at the IFA conference today, takes the glasses-free experience to a bigger screen.

[…]

Like other glasses-less 3D screens, the ThinkVision works by projecting two different images to each of your eyes, resulting in a 3D effect where, […] it appears that the images are popping out of the screen. Lenovo says the monitor’s 3D resolution is 1920×2160. The lenticular lens in the monitor is switchable, allowing for normal, 2D viewing at 3840×2160, too.

[…]

The ThinkVision’s 27-inch display gives workers a bigger palette. It also means the monitor can be a regular 2D monitor when needed.

PCMag had a “brief demo” with Lenovo’s upcoming monitor, viewing a red race car model “suspended in 3D,” representing a potential use case for creators. The publication said the 3D was impressive and the monitor “would no doubt be useful to those who spend lots of time building 3D objects in software.”

[…]

As a regular 2D monitor, the ThinkVision’s specs are pretty standard. It’s a 4K IPS screen claiming a 60 Hz refresh rate, 310 nits, a 1,000:1 contrast ratio, and 99 percent DCI-P3 and Adobe RGB color coverage with a Delta E under 2.

Like a proper workplace monitor, there’s also a strong port selection: two HDMI 2.1, one DisplayPort 1.4, four USB-A (3.1 Gen 1) ports, one USB-C port (3.2 Gen 1) with up to 15 W power delivery, RJ45, a 3.5mm jack, plus an upstream USB-C port with up to 100 W power delivery.

Glasses-free 3D is having a bit of a moment, with Lenovo being the latest major PC OEM to release a screen with stereoscopic views. It’s a niche product category, of course, but some publications, like PCWorld and CNET, that have tried newer releases have said that they are much better than the 3D TVs that required glasses, which you don’t see anymore.

[…]

Source: Lenovo’s new 27-inch, 4K monitor offers glasses-free 3D | Ars Technica