Disabling Intel and AMD’s Backdoors On Modern computers

Despite some companies making strides with ARM, for the most part, the desktop and laptop space is still dominated by x86 machines. For all their advantages, they have a glaring flaw for anyone concerned with privacy or security in the form of a hardware backdoor that can access virtually any part of the computer even with the power off. AMD calls their system the Platform Security Processor (PSP) and Intel’s is known as the Intel Management Engine (IME).

To fully disable these co-processors a computer from before 2008 is required, but if you need more modern hardware than that which still respects your privacy and security concerns you’ll need to either buy an ARM device, or disable the IME like NovaCustom has managed to do with their NS51 series laptop.

NovaCustom specializes in building custom laptops with customizations for various components and specifications to fit their needs, including options for the CPU, GPU, RAM, storage, keyboard layout, and other considerations. They favor Coreboot as a bootloader which already goes a long way to eliminating proprietary closed-source software at a fundamental level, but not all Coreboot machines have the IME completely disabled. There are two ways to do this, the HECI method which is better than nothing but not fully trusted, and the HAP bit, which completely disables the IME. NovaCustom is using the HAP bit approach to disable the IME, meaning that although it’s not completely eliminated from the computer, it is turned off in a way that’s at least good enough for computers that the NSA uses.

There are a lot of new computer manufacturers building conscientious hardware nowadays, but (with the notable exception of System76) the IME and PSP seem to be largely ignored by most computing companies we’d otherwise expect to care about an option like this. It’s certainly still an area of concern considering how much power the IME and PSP are given over their host computers, and we have seen even mainline manufacturers sometimes offer systems with the IME disabled. The only other options to solve this problem are based around specific motherboards for 8th and 9th generation Intel desktops, or you can go way back to hardware from 2008 and install libreboot to eliminate, rather than disable, the IME.

Source: Disabling Intel’s Backdoors On Modern Laptops | Hackaday

Italy finds decently good out to really stupid ban: Demands OpenAI Allow ChatGPT User Corrections After Ban

In a news announcement on Wednesday, the Italian Data Protection Authority, known as the Garante, stressed that OpenAI needed to be more transparent about its data collection processes and inform users about their data rights with regards to the generative AI. These rights include allowing users and non-users of ChatGPT to object to having their data processed by OpenAI and letting them correct false or inaccurate information about them generated by ChatGPT, similar to rights related to other technologies guaranteed by Europe’s General Data Protection Regulation, or GDPR, laws.

Other measures required by the Garante include a public notice on OpenAI’s website “describing the arrangements and logic of the data processing required for the operation of ChatGPT along with the rights afforded to data subjects.” The regulator will also require OpenAI to immediately implement an age gating system for ChatGPT and submit a plan to implement an age verification system by May 31.

The Italian regulator said OpenAI had until April 30 to implement the measures it’s asking for.

[…]

Source: Italy Demands OpenAI Allow ChatGPT User Corrections After Ban

Allowing users to correct is in principle a Good Idea, but then you get Wikipedia types of battles on who is the arbiter of truth. Of course, no one system will ever be 100% truthful or accurate, so banning it for this is just stupid. No age gate keeper works either and neither did the ban – people can circumvent these very very easily. So Italy needs some sort of concession to get out of the hole it’s dug itself and this is at least a promising start.

Scientists unveil new and improved ‘skinny donut’ black hole image using ML algorithm

The 2019 release of the first image of a black hole was hailed as a significant scientific achievement. But truth be told, it was a bit blurry – or, as one astrophysicist involved in the effort called it, a “fuzzy orange donut.”

Scientists on Thursday unveiled a new and improved image of this black hole – a behemoth at the center of a nearby galaxy – mining the same data used for the earlier one but improving its resolution by employing image reconstruction algorithms to fill in gaps in the original telescope observations.

[…]

The ring of light – that is, the material being sucked into the voracious object – seen in the new image is about half the width of how it looked in the previous picture. There is also a larger “brightness depression” at the center – basically the donut hole – caused by light and other matter disappearing into the black hole.

The image remains somewhat blurry due to the limitations of the data underpinning it – not quite ready for a Hollywood sci-fi blockbuster, but an advance from the 2019 version.

This supermassive black hole resides in a galaxy called Messier 87, or M87, about 54 million light-years from Earth. A light year is the distance light travels in a year, 5.9 trillion miles (9.5 trillion km). This galaxy, with a mass 6.5 billion times that of our sun, is larger and more luminous than our Milky Way.

[…]

Lia Medeiros of the Institute for Advanced Study in Princeton, New Jersey, lead author of the research published in the Astrophysical Journal Letters.

The study’s four authors are members of the Event Horizon Telescope (EHT) project, the international collaboration begun in 2012 with the goal of directly observing a black hole’s immediate environment. A black hole’s event horizon is the point beyond which anything – stars, planets, gas, dust and all forms of electromagnetic radiation – gets swallowed into oblivion.

Medeiros said she and her colleagues plan to use the same technique to improve upon the image of the only other black hole ever pictured – released last year showing the one inhabiting the Milky Way’s center, called Sagittarius A*, or Sgr A*.

The M87 black hole image stems from data collected by seven radio telescopes at five locations on Earth that essentially create a planet-sized observational dish.

“The EHT is a very sparse array of telescopes. This is something we cannot do anything about because we need to put our telescopes on the tops of mountains and these mountains are few and far apart from each other. Most of the Earth is covered by oceans,” said Georgia Tech astrophysicist and study co-author Dimitrios Psaltis.

“As a result, our telescope array has a lot of ‘holes’ and we need to rely on algorithms that allow us to fill in the missing data,” Psaltis added. “The image we report in the new paper is the most accurate representation of the black hole image that we can obtain with our globe-wide telescope.”

The machine-learning technique they used is called PRIMO, short for “principal-component interferometric modeling.”

“This is the first time we have used machine learning to fill in the gaps where we don’t have data,” Medeiros said. “We use a large data set of high-fidelity simulations as a training set, and find an image that is consistent with the data and also is broadly consistent with our theoretical expectations. The fact that the previous EHT results robustly demonstrated that the image is a ring allows us to assume so in our analysis.”

Source: Scientists unveil new and improved ‘skinny donut’ black hole image | Reuters

Scientists create structural paint that stays cool underneath, doesn’t fade, extremely light and no toxins

[…]

Debashis Chanda, a nanoscience researcher with the University of Central Florida, and his team have created a way to mimic nature’s ability to reflect light and create beautifully vivid color without absorbing any heat like traditional pigments do.

Chanda’s research, published in the journal Science Advances, explains and explores structural color and how people could use it to live cooler in a rapidly warming world.

Structural colors are created not from traditional pigmentation but from the arrangement of colorless materials to reflect light in certain ways. This process is how rainbows are made after it rains and how suncatchers bend light to create dazzling displays of color.

[…]

One driver for the researchers: A desire to avoid toxic materials

To create these colors, synthetic materials like heavy metals are used to create vivid paints.

“We use a lot of artificially synthesized organic molecules, lots of metal,” Chanda told NPR. “Think about your deep blues, you need cobalt, a deep red needs cadmium. They are toxic. We are polluting our nature and our whole habitat by using this kind of paint. So one of the major motivations for us was to create a color based on non-toxic material.”

So why can’t we simply use ground-up peacock feathers to recreate its vivid greens, blues and golds? It’s because they have no pigment. Some of the brightest colors in nature aren’t pigmented at all, peacock feathers included.

These bright, beautiful colors are achieved by the bending and reflection of light. The way the structure of a wing, a feather or other material reflects light back at the viewer. It doesn’t absorb any light, it beams it back out in the form of a visible color, and this is where things get interesting.

Chanda’s research began here, with his fascination with natural colors and how they are achieved in nature.

Beyond just the beautiful arrays of color that structure can create, Chanda also found that unlike pigments, structural paint does not absorb any infrared light.

Infrared light is the reason black cars get hot on sunny days and asphalt is hot to the touch in summer. Infrared light is absorbed as heat energy into these surfaces — the darker the color, the more the surface colored with it can absorb. That’s why people are advised to wear lighter colors in hotter climates and why many buildings are painted bright whites and beiges.

Chanda found that structural color paint does not absorb any heat. It reflects all infrared light back out. This means that in a rapidly warming climate, this paint could help communities keep cool.

Chanda and his team tested the impact this paint had on the temperature of buildings covered in structural paint versus commercial paints and they found that structural paint kept surfaces 20 to 30 degrees cooler.

This, Chanda said, is a massive new tool that could be used to fight rising temperatures caused by global warming while still allowing us to have a bright and colorful world.

Unlike white and black cars, structural paint’s ability to reflect heat isn’t determined by how dark the color is. Blue, black or purple structural paints reflect just as much heat as bright whites or beige. This opens the door for more colorful, cooler architecture and design without having to worry about the heat.

A little paint goes a long way

It’s not just cleaner, Chanda said. Structural paint weighs much less than pigmented paint and doesn’t fade over time like traditional pigments.

“A raisin’s worth of structural paint is enough to cover the front and back of a door,” he said.

Unlike pigments which rely on layers of pigment to achieve depth of color, structural paint only requires one thin layer of particles to fully cover a surface in color. This means that structural paint could be a boon for aerospace engineers who rely on the lowest weight possible to achieve higher fuel efficiency.

[…]

Source: Scientists create an eco-friendly paint : NPR

Google debuts deps.dev API to check security status of dependencies

[…]

On Tuesday, Google – which has answered the government’s call to secure the software supply chain with initiatives like the Open Source Vulnerabilities (OSV) database and Software Bills of Materials (SBOMs) – announced an open source software vetting service, its deps.dev API.

The API, accessible in a more limited form via the web, aims to provide software developers with access to security metadata on millions of code libraries, packages, modules, and crates.

By security metadata, Google means things like: how well maintained a library is, who maintains it, what vulnerabilities are known to be present in it and whether they have been fixed, whether it’s had a code review, whether it’s using old or new versions of other dependencies, what license covers it, and so on. For example, see the info on the Go package cmdr and the Rust Cargo crate crossbeam-utils.

The API also provides at least two capabilities not available through the web interface: the ability to query the hash of a file’s contents (to find all package versions with the file) and dependency graphs based on actual installation rather than just declarations.

“Software supply chain attacks are increasingly common and harmful, with high profile incidents such as Log4Shell, Codecov, and the recent 3CX hack,” said Jesper Sarnesjo and Nicky Ringland, with Google’s open source security team, in a blog post. “The overwhelming complexity of the software ecosystem causes trouble for even the most diligent and well-resourced developers.”

[…]

The deps.dev API indexes data from various software package registries, including Rust’s Cargo, Go, Maven, JavaScript’s npm, and Python’s PyPI, and combines that with data gathered from GitHub, GitLab, and Bitbucket, as well as security advisories from OSV. The idea is to make metadata about software packages more accessible, to promote more informed security decisions.

Developers can query the API to look up a dependency’s records, with the returned data available programmatically to CI/CD systems, IDE plugins that present the information, build tools and policy engines, and other development tools.

Sarnesjo and Ringland say they hope the API helps developers understand dependency data better so that they can respond to – or prevent – attacks that try to compromise the software supply chain.

There are already hundreds of software supply chain tools and projects, but the more the merrier. Judging by the average life expectancy of Google services, the deps.dev API should be available for at least four years.

Along similar lines, Google Cloud on Wednesday nudged its Assured Open Source Software (Assured OSS) service for Java and Python into general availability.

[…]

Source: Google debuts API to check security status of dependencies • The Register

Mitsubishi 3000GT Car Phone Modded To Work Like an iPhone, link to full 3 year journey included

Software engineer Jeff Lau, posting under the username UselessPickles, showed off the restored car phone in a video uploaded to YouTube. The Mitsubishi came from the factory with an optional “DiamondTel” handset and hands-free system, which was rendered inoperable by the discontinuation of analog “AMPS” cell service in the U.S. in 2008. (The 3G shutdown bricked a ton of newer cars’ connectivity features, too.)

After three years of work, Lau restored the device’s functionality using a custom Bluetooth adapter. Lau engineered the adapter to piggyback between the stock phone transceiver and hands-free control unit located under the trunk carpet. That let Lau tap into modern cell networks with his 1993 car phone—but he didn’t stop there.

Paired with a smartphone, the stock handset displays the name of the paired device and the signal strength of the smartphone’s network. It gets better: The car’s hands-free microphone feeds the smartphone voice commands (to Apple’s Siri in this case). It’s pretty much all the functionality of a 2023 hands-free system but without the distraction of a touchscreen.

Obviously, that isn’t about to become a widespread resto-mod trend soon. The lengthy dev time, low take rate of car phones in their day, and uniqueness of individual cars’ systems mean we’re probably not about to see off-the-shelf car phone restoration kits soon. But the fact that bringing car phones back is possible will hopefully inspire someone else out there to resuscitate theirs—maybe even one of those retro Chrysler VisorPhones will ride one day again. Or ring, I should say.

Source: Clever Collector Mods Mitsubishi 3000GT Car Phone To Work Like an iPhone

The whole process is laid out in this forum thread, starting on 23/12/21: Making a Bluetooth adapter for a Car Phone from the 90’s

Streaming Services Urged To Clamp Down on AI-Generated Music by Record Labels

Universal Music Group has told streaming platforms, including Spotify and Apple, to block artificial intelligence services from scraping melodies and lyrics from their copyrighted songs, according to emails viewed by the Financial Times. From the report: UMG, which controls about a third of the global music market, has become increasingly concerned about AI bots using their songs to train themselves to churn out music that sounds like popular artists. AI-generated songs have been popping up on streaming services and UMG has been sending takedown requests “left and right,” said a person familiar with the matter. The company is asking streaming companies to cut off access to their music catalogue for developers using it to train AI technology. “We will not hesitate to take steps to protect our rights and those of our artists,” UMG wrote to online platforms in March, in emails viewed by the FT. “This next generation of technology poses significant issues,” said a person close to the situation. “Much of [generative AI] is trained on popular music. You could say: compose a song that has the lyrics to be like Taylor Swift, but the vocals to be in the style of Bruno Mars, but I want the theme to be more Harry Styles. The output you get is due to the fact the AI has been trained on those artists’ intellectual property.”

Source: Streaming Services Urged To Clamp Down on AI-Generated Music – Slashdot

Basically they don’t want AI’s listening to their music as an inspiration for them to make music. Which is exactly what humans do. So I’m very curious what legal basis would accept their takedowns.

New Map of Dark Matter Supports Einstein’s Theory of Gravity

Scientists using data from the Atacama Cosmology Telescope in Chile have made a detailed map of dark matter’s distribution across a quarter of the sky.

The map shows regions the distribution of mass extending essentially as far we can see back in time; it uses the cosmic microwave background as a backdrop for the dark matter portrait. The team’s research will be presented at the Future Science with CMB x LSS conference in Kyoto, Japan.

“We have mapped the invisible dark matter across the sky to the largest distances, and clearly see features of this invisible world that are hundreds of millions of light-years across,” said Blake Sherwin, a cosmologist at the University of Cambridge, in a Princeton University release. “It looks just as our theories predict.”

[…]

the only way dark matter is observed is indirectly, in the way its gravitational effects are observed at large scales. Enter the Atacama Cosmology Telescope, which more precisely dated the universe in 2021. The telescope’s map builds on a map of the universe’s matter released earlier this year, which was produced using data from the Dark Energy Survey and the South Pole Telescope. That map upheld previous estimations of the ratio of ordinary matter to dark matter and found that the distribution of the matter was less clumpy than previously thought.

The new map homes in on a lingering concern of Einstein’s general relativity: how the most massive objects in the universe, like supermassive black holes, bend light from more distant sources. One such source is the cosmic microwave background, the most ancient detectable light, which radiates from the aftermath of the Big Bang.

The researchers effectively used the background as a backlight, to illuminate regions of greater density in the universe.

“It’s a bit like silhouetting, but instead of just having black in the silhouette, you have texture and lumps of dark matter, as if the light were streaming through a fabric curtain that had lots of knots and bumps in it,” said Suzanne Staggs, director of the Atacama Cosmology Telescope and a physicist at Princeton, in the university release.

The cosmic microwave background as seen by the European Space Agency's Planck observatory.
The cosmic microwave background as seen by the European Space Agency’s Planck observatory.
Image: ESA

“The famous blue and yellow CMB image is a snapshot of what the universe was like in a single epoch, about 13 billion years ago, and now this is giving us the information about all the epochs since,” Staggs added.

The recent analysis suggests that the dark matter was lumpy enough to fit with the standard model of cosmology, which relies on Einstein’s theory of gravity.

Eric Baxter, an astronomer at the University of Hawai’i and a co-author of the research that resulted in the February dark matter map, told Gizmodo in an email that his team’s map was sensitive to low-redshifts (meaning close by, in the more recent universe). On the other hand, the newer map focuses exclusively on the lensing of the cosmic microwave background, meaning higher redshifts and a more sweeping scale.

“Said another way, our measurements and the new ACT measurements are probing somewhat different (and complementary) aspects of the matter distribution,” Baxter said. “Thus, rather than contradicting our previous results, the new results may be providing an important new piece of the puzzle about possible discrepancies with our standard cosmological model.”

“Perhaps the Universe is less lumpy than expected on small scales and at recent times (i.e. the regime probed by our analysis), but is consistent with expectations at earlier times and at larger scales,” Baxter added.

New instruments should help tease out the matter distribution of the universe. An upcoming telescope at the Simons Observatory in the Atacama is set to begin operations in 2024 and will map the sky nearly 10 times faster than the Atacama Cosmology Telescope, according to the Princeton release.

[…]

Source: New Map of Dark Matter Validates Einstein’s Theory of Gravity

Physicists Discover that Gravity Can Create Light

Researchers have discovered that in the exotic conditions of the early universe, waves of gravity may have shaken space-time so hard that they spontaneously created radiation.

[…]

a team of researchers have discovered that an exotic form of parametric resonance may have even occurred in the extremely early universe.

Perhaps the most dramatic event to occur in the entire history of the universe was inflation. This is a hypothetical event that took place when our universe was less than a second old. During inflation our cosmos swelled to dramatic proportions, becoming many orders of magnitude larger than it was before. The end of inflation was a very messy business, as gravitational waves sloshed back and forth throughout the cosmos.

Normally gravitational waves are exceedingly weak. We have to build detectors that are capable of measuring distances less than the width of an atomic nucleus to find gravitational waves passing through the Earth. But researchers have pointed out that in the extremely early universe these gravitational waves may have become very strong.

And they may have even created standing wave patterns where the gravitational waves weren’t traveling but the waves stood still, almost frozen in place throughout the cosmos. Since gravitational waves are literally waves of gravity, the places where the waves are the strongest represent an exceptional amount of gravitational energy.

The researchers found that this could have major consequences for the electromagnetic field existing in the early universe at that time. The regions of intense gravity may have excited the electromagnetic field enough to release some of its energy in the form of radiation, creating light.

This result gives rise to an entirely new phenomenon: the production of light from gravity alone. There’s no situation in the present-day universe that could allow this process to happen, but the researchers have shown that the early universe was a far stranger place than we could possibly imagine.

Source: Physicists Discover that Gravity Can Create Light – Universe Today

EVE Online player uses CEO vote to pull off the biggest heist in the game’s history

Back in 2017, we learned about the biggest heist in EVE Online history (opens in new tab): A year-long inside job that ultimately made off with an estimated 1.5 triillion ISK, worth around $10,000 in real money. But now another EVE player claims to have pulled off a heist worth significantly more than that—and with significantly less work involved.

The 2017 heist, like so many of EVE’s most interesting stories, relied primarily on social engineering: Investing months or years of time into grooming a target before pulling the rug out from beneath them. But redditor Flam_Hill (opens in new tab) said this job was less bloody: Instead of betrayal, this theft was dependent upon learning and exploiting the “shares mechanic” in EVE Online in order to leverage a takeover of Event Horizon Expeditionaries, a 299-member corporation that was part of the Pandemic Horde alliance.

Using a “clean account with a character with a little history,” Flan_Hill and an unnamed partner applied for membership in the EHEXP corporation. After the account was accepted, Flan_Hill transferred enough of his shares in the corporation to the infiltrator to enable a call for a vote for a new CEO. The conspirators both voted yes, while nobody else in the corporation voted at all.

This was vital, because after 72 hours the two “yes” votes carried the day. The infiltrating agent was very suddenly made CEO, which was in turn used to make Flan_Hill an Event Horizon Expeditionaries director, at which point they removed all the other corporate directors and set to emptying the coffers.

They stripped 130 billion ISK from the corporate wallet, but that was only a small part of the haul: Counting all stolen assets, including multiple large ships, Flam_Hill estimated the total value of the heist at 2.23 trillion ISK, which works out to more than $22,300 in real money. ISK can’t be legally cashed out of EVE Online, but it can be used to buy Plex (opens in new tab), an in-game currency used to upgrade accounts, purchase virtual goods, and activate other services.

[…]

The one aspect of the story that some redditors took issue with is the origin of the 1,000 shares in Event Horizon Expeditionaries that made this theft possible in the first place.

[…]

It all comes down to EVE’s corporation voting system (opens in new tab): Any member of a corporation holding more than 5% of the total shares can start a vote, and—this is what it really comes down to—”the option that gains more than 50% of cast votes wins the vote.” This is why the inattentiveness of EHEXP membership was so vital: Flam_Hill and his partner were the only ones to vote “yes,” so they had 100% of the cast votes and were thus able to seize power.

[…]

EVE Online developer CCP Games eliminated any doubt by confirming that the heist did in fact take place, although it declined to comment on the value of the theft.

In the end, it turned out that the “former CEO” theory was correct. Speaking to PC Gamer, the mastermind of the heist, known in EVE as Sienna d’Orien—real name Dave—confirmed that he was in fact the founder and former chief of Event Horizon Expeditionaries, which is how he had the shares in the company that enabled the takeover. He quit EVE in 2018, citing burnout and other priorities, but returned in 2022 to find EHEXP “a shell of its former self.”

After forming a new group, Dave reached out to the corporation to inquire about getting some of his old assets back, but was ignored. His partner in the heist, Packratt, then brought up the shares mechanic, and they went to work. They were aided by a third friend and former EHEXP member, Highlander McLeod, who handled some of the research in order to keep d’Orien’s name out of it—although McLeod was kept in the dark about the job until it was over, in order to ensure operational security.

[…]

They managed to pull the job off with virtually complete anonymity, but Dave said he’s stepping out of the shadows because “it will get out eventually” anyway—and it probably doesn’t hurt that he can now bask in the glory of the moment.

[…]

As for Dave, who’s now playing “in a new corp with old mates,” he acknowledged that the heist could complicate his in-game life somewhat: He’ll be an interstellar folk hero to some (people love a good EVE heist) but no doubt a villain—and a target—in the eyes of others.

[…]

Source: EVE Online player uses obscure rule to pull off the biggest heist in the game’s history | PC Gamer

Google’s free Assured Open Source Software service hits GA

About a year ago, Google announced its Assured Open Source Software (Assured OSS) service, a service that helps developers defend against supply chain security attacks by regularly scanning and analyzing for vulnerabilities some of the world’s most popular software libraries. Today, Google is launching Assured OSS into general availability with support for well over a thousand Java and Python packages — and while Google didn’t initially disclose pricing when it first announced the service, the company has now revealed that it will be available for free.

Software development has long depended on third-party libraries (which are often maintained by only a single developer), but it wasn’t until the industry got hit with a number of high-profile exploits that everyone (including the White House) perked up and started taking software supply chain security seriously. Now, you can’t attend an open source conference without hearing about Software Bills of Materials (SBOMs), artifact registries and similar topics

[…]

Google promises that it will constantly keep these libraries up to date (without creating forks) and continuously scan for known vulnerabilities, do fuzz tests to discover new ones and then fix these issues and contribute these fixes back upstream. The company notes that when it first launched the service with around 250 Java libraries, it was responsible for discovering 48% of the new CVEs for these libraries and subsequently addressing them.

[…]

By partnering with a trusted supplier, organizations can mitigate these risks and ensure the integrity of their software supply chain to better protect their business applications.”

Developers and organizations that want to use the new service can sign up here and then integrate Assured OSS into their existing development pipeline.

Source: Google’s free Assured Open Source Software service hits GA | TechCrunch

 

Google announces GUAC open source project on software supply chains

Google unveiled a new open source security project on Thursday centered around software supply chain management.

Given the acronym GUAC – which stands for Graph for Understanding Artifact Composition – the project is focused on creating sets of data about a software’s build, security and dependency.

Google worked with Purdue University, Citibank and supply chain security company Kusari on GUAC, a free tool built to bring together many different sources of software security metadata. Google has also assembled a group of technical advisory members to help with the project — including IBM, Intel, Anchore and more.

Google’s Brandon Lum, Mihai Maruseac, Isaac Hepworth pitched the effort as one way to help address the explosion in software supply chain attacks — most notably the widespread Log4j vulnerability that is still leaving organizations across the world exposed to attacks.

“GUAC addresses a need created by the burgeoning efforts across the ecosystem to generate software build, security, and dependency metadata,” they wrote in a blog post. “GUAC is meant to democratize the availability of this security information by making it freely accessible and useful for every organization, not just those with enterprise-scale security and IT funding.”

They noted that U.S. President Joe Biden issued an executive order last year that said all federal government agencies must send a Software Bill of Materials (SBOM) to Allan Friedman, the director Cybersecurity Initiatives at National Telecommunications and Information Administration (NIST).

[…]

While SBOMs are becoming increasingly common thanks to the work of several tech industry groups like OpenSSF, there have been a number of complaints, one of those centered around the difficulty of sorting through troves of metadata, some of which is not useful.

Maruseac, Lum and Hepworth explained that it is difficult to combine and collate the kind of information found in many SBOMs.

“The documents are scattered across different databases and producers, are attached to different ecosystem entities, and cannot be easily aggregated to answer higher-level questions about an organization’s software assets,” they said.

Google shared a proof of concept of the project, which allows users to search data sets of software metadata.

The three explained that GUAC effectively aggregates software security metadata into a database and makes it searchable.

They used the example of a CISO or compliance officer that needs to understand the “blast radius” of a vulnerability. GUAC would allow them to “trace the relationship between a component and everything else in the portfolio.”

Google says the tool will allow anyone to figure out the most used critical components in their software supply chain ecosystem, the security weak points and any risky dependencies.

[…]

Source: Google announces GUAC open source project on software supply chains

US starts looking at AI regulation, Seeks Public Input to Boost AI Accountability

Today, the Department of Commerce’s National Telecommunications and Information Administration (NTIA) launched a request for comment (RFC) to advance its efforts to ensure artificial intelligence (AI) systems work as claimed – and without causing harm. The insights gathered through this RFC will inform the Biden Administration’s ongoing work to ensure a cohesive and comprehensive federal government approach to AI-related risks and opportunities.

[…]

NTIA’s “AI Accountability Policy Request for Comment” seeks feedback on what policies can support the development of AI audits, assessments, certifications and other mechanisms to create earned trust in AI systems that they work as claimed. Much as financial audits create trust in the accuracy of a business’ financial statements, so for AI, such mechanisms can help provide assurance that an AI system is trustworthy in that it does what it is intended to do without adverse consequences.

[…]

President Biden has been clear that when it comes to AI, we must both support responsible innovation and ensure appropriate guardrails to protect Americans’ rights and safety. The White House Office of Science and Technology Policy’s Blueprint for an AI Bill of Rights provides an important framework to guide the design, development, and deployment of AI and other automated systems. The National Institute of Standards and Technology’s (NIST) AI Risk Management Framework serves as a voluntary tool that organizations can use to manage risks posed by AI systems.

Comments will be due 60 days from publication of the RFC in the Federal Register.

[…]

Source: NTIA Seeks Public Input to Boost AI Accountability | National Telecommunications and Information Administration

On the hunt for the businessmen behind a billion-dollar scam

[…]

Jan Erik, sound muddled, he tells the caller he has already lost one million Swedish Krona (about £80,000) in trading scams.

But the caller already knows this. And he knows it makes the pensioner a good target for a follow-up “recovery scam”. He tells Jan Erik that if he hands over his card details and pays a €250 deposit, Solo Capitals will use special software to track his lost investments and get his money back.

“We will be able to recover the whole amount,” William Grant says.

It takes him a while to wear Jan Erik down. But after about 30 minutes on the phone, the pensioner begins reading out his credit card details.

The audio recording was saved by the company under the file name “William Sweden scammed”. The BBC obtained the file from a former employee, but the company had not tried hard to hide it. In fact, it had handed it out to new recruits as part of the company training package.

This was a lesson in how to scam.

[…]

The scam

For more than a year, BBC Eye has been investigating a global fraudulent trading network of hundreds of different investment brands that has scammed unwitting customers like Jan Erik out of more than a billion dollars.

Our investigation reveals for the first time the sheer scale of the fraud, as well as the identities of a shadowy network of individuals who appear to be behind it.

The network is known to police as the Milton group, a name originally used by the scammers themselves but abandoned in 2020. We identified 152 brands, including Solo Capitals, that appear to be part of the network. It operates by targeting investors and scamming them out of thousands – or in some cases hundreds of thousands – of pounds.

One Milton group investment brand even sponsored a top-flight Spanish football club, and advertised in major newspapers, lending it credibility with potential investors.

In November, BBC Eye accompanied German and Georgian police on call-centre raids in the Georgian capital Tbilisi. On the computer screens, we saw row after row of British phone numbers. We phoned several and spoke to British citizens who told us they had just invested money. On one desk, there was a handwritten note with a list of names and useful details for the scammers: “Homeowner, no responsibilities”; “50k in savings”; “From Poland, British citizen”; “50k in stocks.”

Next to the name of one British man, a note said: “Savings less than 10K, very pussy, should scam soon”.

Milton group brands had office space in this downtown Kyiv office building. (Alexander Mahmoud/DG)
Image caption,

Milton group brands had office space in this downtown Kyiv office building. (Alexander Mahmoud/DG)

The majority of victims sign up after seeing an ad on social media. Within 48 hours typically they receive a phone call from someone who tells them they could make returns of up to 90% per day. On the other end of the phone there is usually a call centre with many of the trappings of a legitimate business – a smart, modern office with an HR department, monthly targets and bonuses, awaydays and competitions for best salesperson. Some call centres play pumping music in the background. But there are also elements you won’t find in a legitimate business – written guidance on how to identify a potential investor’s weaknesses and turn those weaknesses against them.

From their first phone call, victims can be directed into regulated companies or sometimes unregulated, offshore entities. Some victims who signed up to regulated brands within the Milton group are directed by their broker to place trades designed to lose the customer money and make money for the broker – a practice which is illegal under UK regulations. Some victims are instructed to download software that allows the scammer to remotely control their PC and place trades for them – also illegal. And according to former employees of Milton group brands, some customers think they are making real trades, but their money is simply being siphoned away.

“The victims think they have a real account with the company, but there isn’t really any trading, it’s just a simulation,” said Alex, a former employee who worked in a Milton group office in Kyiv, Ukraine.

In order to better understand how the scam works, the BBC posed as an aspiring trader and contacted Coinevo, one of the Milton group’s trading platforms. We were connected to an adviser who gave the name Patrick, and told us we could make “70% or 80% or 90% as a return in one single day”. He told us to send $500 worth of Bitcoin as a deposit to begin trading with.

Patrick pressed our undercover trader to provide a copy of their passport, and after providing a fake copy we were able to continue to operate the account for about two months before Coinevo appeared to detect the fake. At that point, Patrick wrote to us by email, swearing at us and cutting off contact.

But the BBC’s deposit money was already in the system. We were able to track it as it was divided up into small fractions and moved through many different Bitcoin wallets, all seemingly associated with the Milton group. Experts told the BBC that genuine financial institutions do not funnel money in this way. Louise Abbott, a lawyer who specialises in cryptocurrency and fraud, examined the flow of the money and said it suggested “large-scale organised crime”. The reason the money was spread over various different bitcoin wallets, Abbott said, was to “make it as complicated as possible and as difficult as possible for either you, or the victim, or us as lawyers to find”.

[…]

Soon they were speaking nearly every morning, and Jane was revealing specific things she needed money for – expensive repairs to her roof, a buffer for her pension. Hunt used them against her, she said, telling her certain trades would “get her that roof” and “help her future”.

Over the next few months, Jane invested about £15,000. But her trades weren’t doing well. Hunt advised her to withdraw her money and invest with a different trading platform, BproFX, where she could get better returns.

By that point, Jane fully trusted David Hunt. “I felt like I knew him well and I thought he had my interests at heart,” she said, welling up. “So I agreed to move with him.”

What she didn’t know was that BproFX was an unregulated, offshore entity based in Dominica. In reality, EverFX’s UK regulatory status did not stop it from scamming British citizens, but the move over to BproFX would strip Jane of even the scant protections she might be afforded under UK law. The BBC found several victims who were moved to unregulated companies in this way.

[…]

Other victims told the BBC they were scammed this way. Londoner Barry Burnett said he started investing after seeing an ad for EverFX, but after a few early wins, he suddenly lost more than £10,000 in 24 hours. The adviser pressured him to put in another £25,000 to trade himself out of his black hole.

“I must have got at least half a dozen calls in the space of about two hours,” Barry said. “People begging me to put more money in.”

Jane faced similar pressures from David Hunt. “He kept telling me that the more I put in the more I can recover,” she said.

Instead, both finally decided to call it quits. Barry had lost £12,000, Jane £27,000.

[…]

The operations of the Milton group have been investigated before, by the Swedish newspaper Dagens Nyheter and others, but the BBC set out to identify the senior figures behind the global scam.

We began by combing through publicly available corporate documents to map the connections between companies in the Milton group. Five names appeared again and again, listed as directors of the Milton trading platforms or supporting tech companies – David Todua, Rati Tchelidze, Guram Gogeshvili, Joseph Mgeladze, and Michael Benimini.

We plugged the five names into the Panama Papers, a massive 2016 leak detailing offshore companies, and discovered that four of them – Tchelidze, Gogeshvili, Mgeladze and Benimini – were listed as directors or senior figures within a group of linked offshore companies or subsidiary companies that pre-dated the Milton group.

Many of these non-Milton companies led back in some way to one figure: David Kezerashvili, a former Georgian government official who served for two years as the country’s defence minister.

David Kezerashvili, a former defence minister of Georgia, appears to be involved in the Milton scam. (Alamy/BBC)
Image caption,

David Kezerashvili, a former defence minister of Georgia, appears to be involved in the Milton scam. (Alamy/BBC)

Kezerashvili was dismissed as defence minister and later convicted in absentia for embezzling more than €5m of government funds. By the time of his conviction, he was living in London and the UK turned down a request from Georgia for his extradition.

There were no publicly available documents linking Kezerashvili to this pre-Milton network, but when we looked at the Panama Papers, his name came up again and again, identifying him as either the founder of the parent companies in the network or as one of their initial shareholders. Behind the scenes, Kezerashvili appeared to be at the centre of that network.

When it came to the Milton group, there was similarly no publicly available documentation linking Kezerashvili to the scam companies, and there was no evidence that he had any direct financial interest in the Milton brands.

But several former employees of Milton-linked companies told us confidentially that they had had direct dealings with Kezerashvili and knew him to be involved in the Milton group.

Kezerashvili has frequently promoted the scam trading platforms on his personal social media accounts. On the business networking site LinkedIn, he has used his account almost exclusively to promote jobs and share posts about Milton-linked companies.

The BBC was able to find a number of other pieces of evidence linking the former defence minister to Milton brands. Several companies owned by Kezerashvili used a private email server on which the only other users were Milton group companies. His venture capital firm, Infinity VC, owned the branding and web domains for companies that provided trading platform technology to the scammers.

Kezerashvili also owns a Kyiv office building that was home to both the scam call centre selling EverFX and the tech firms that provided the software – offices which were raided by police in November. He also owns a Tbilisi office block that contained some of the same tech firms.

When the BBC examined social media profiles belonging to the four senior Milton group men, it became clear from pictures posted of wedding parties and other social events that they all had close social ties to Kezerashvili. Kezerashvili is Facebook friends with at least 45 people linked to the Milton group scams, and one of the four senior figures identified by the BBC is his cousin.

The BBC tracked Kezerashvili to his £18m London mansion and asked to speak to him, but we were told he wasn’t available. He told the BBC via his lawyers that he strongly denied any involvement with the Milton group, or that he gained financially from scams. He said that EverFX was to his knowledge a legitimate business and his lawyers argued other connections we have found to the people and IT behind it “proved nothing”.

Scam victims download a trading platform, but some are never placing real trades at all. (Joel Gunter/BBC)
Image caption,

Scam victims download a trading platform, but some are never placing real trades at all. (Joel Gunter/BBC)

Mr Chelidze and Mr Gogeshvili also strongly denied our accusations, saying that EverFX was a legitimate, regulated platform. They denied knowledge of Milton or any connection between EverFX and the brands we identified, which they suggested had misused EverFX’s source code and brand to confuse users. They said EverFX had never had a crypto wallet and had no control over how its third-party payment processors directed funds.

Mr Mgeladze also denied our accusations, telling us that he has never owned any call centres fraudulently mis-selling investments and has no knowledge of the Milton group.

Mr Benimini did not respond to our questions.

EverFX denied our allegations, saying that they were a legitimate and regulated platform where risks were fully explained. They said that they had investigated Barry Burnett’s case and found that he was responsible for his losses.

In Jane’s case, they told us her losses were as a result of her moving to an unconnected company. They said that they had fully cooperated with the FCA and there were no outstanding UK regulatory complaints.

Sevilla FC told the BBC only that once their contract with EverFX ended, they had no more contact with the company.

[…]

 

Source: On the hunt for the businessmen behind a billion-dollar scam – BBC News

South Korea fines Google $32 mln for blocking games on competing platforms

South Korea’s antitrust regulator has fined Alphabet Inc’s (GOOGL.O) Google 42.1 billion won ($31.88 million) for blocking the release of mobile video games on a competitor’s platform.

The Korea Fair Trade Commission (KFTC) said on Tuesday that Google bolstered its market dominance, and hurt local app market One Store’s revenue and value as a platform, by requiring video game makers to exclusively release their titles on Google Play in exchange for providing in-app exposure between June 2016 and April 2018.

[…]

Game makers affected by Google’s action include Netmarble (251270.KS), Nexon (225570.KQ) and NCSOFT (036570.KS), as well as other smaller companies, the antitrust regulator added.

In 2021, Google was fined more than 200 billion won by the KFTC for blocking customised versions of its Android operating system.

($1 = 1,320.4200 won)

Source: South Korea fines Google $32 mln for blocking games on competing platform | Reuters

Monopoly for the monopolists is starting to break down

Windows 11 KB5025310 changes how the Print Screen key works

Microsoft has been trying to make changes to almost every feature we use on Windows, from the taskbar to notifications. With Windows 11 KB5025310 available in the Beta channel, Microsoft is changing how the Print Screen key works, i.e. its default behaviour.

If your laptop has a dedicated Print Screen key, you can press it to instantly take a screenshot of the screen and save it to the clipboard. You can paste the screenshot into any app like Paint and do whatever you want to. This has always been the default behaviour of the Print Screen key (PrtSc).

KB5025310 is changing the default behaviour for everyone. After installing this or a newer update, your Print Screen key will open the new Snipping Tool. For those unaware, Windows 11’s new Snipping Tool replaces the legacy Snipping Tool and Snip & Sketch app and combines the best features.

Windows 11 screen recording tool
Image Courtesy: Microsoft | Snipping Tool with screen recorder

This means Windows 11 won’t save your screenshots to the clipboard. Instead, it will open Snipping Tool, so you can change the screenshot and save it later. Thankfully, it is possible to revert to the original behaviour.

To restore the classic Print Screen key, head to Settings > Accessibility > Keyboard, and change the setting to how you want.

[…]

Source: Windows 11 KB5025310 changes how the Print Screen key works

This Chinese Electric Supercar Can Drive on Three Wheels, Jump in the Air

A week before the 2023 Auto Shanghai show, Chinese EV maker BYD revealed Tuesday the coolest suspension technology since the Citroen DS’s hydropneumatic system. However, instead of being used on a quirky French sedan, BYD’s DiSus-X suspension was showcased on a quad-motor electric supercar, the BYD YangWang U9. With DiSus-X, the U9 can drive on only three wheels and hop in the air on all four wheels. Yep. We live in a new world now, folks.

YangWang is BYD’s luxury electric sub-brand, and the U9 is its first supercar. Battery, power, and performance specs should be revealed next week at Auto Shanghai, but BYD smartly revealed this trick suspension system first, as it’s far more interesting.

BYD’s DiSus-X is the newest in a family of clever hydraulic DiSus suspension systems and debuts on the U9. More details on how the newest system works will come next week, but BYD is just showing off some of its tricks.

One such trick driving on just three wheels for short periods in case of a tire blowout, just like the old DS. The U9 probably can’t drive on three wheels for long, but it’s enough to get its driver home or to a repair shop in a pinch. However, the U9’s main party trick is its vertical leap. The suspension system can raise or lower the car at each corner independently, but if it raises each corner quickly, the kinetic energy is enough to jump the U9 an inch or two off the ground. If you’re wondering what the practical application for hopping a car is, stop being a square. It’s just cool.

With that level of suspension technology, BYD should be able to make a shockingly capable supercar that can level itself through corners, provide additional grip to specific tires, and even swaddle passengers in a way most supercars simply can’t. But who cares about any of that? The car can jump.

Source: This Chinese Electric Supercar Can Drive on Three Wheels, Jump in the Air

NASA Reveals What Made an Entire Starlink Satellite Fleet Go Down – movie included

On March 23, sky observers marveled at a gorgeous display of northern and southern lights. It was a reminder that when our Sun gets active, it can spark a phenomenon called “space weather.” Aurorae are among the most benign effects of this phenomenon. At the other end of the space weather spectrum are solar storms that can knock out satellites. The folks at Starlink found that out the hard way in February 2022. On January 29 that year, the Sun belched out a class M 1.1 flare and related coronal mass ejection. Material from the Sun traveled out on the solar wind and arrived at Earth a few days later. On February 3, Starlink launched a group of 49 satellites to an altitude only 130 miles above Earth’s surface. They didn’t last long, and now solar physicists know why.

A group of researchers from NASA Goddard Space Flight Center and the Catholic University of America took a closer look at the specifics of that storm. Their analysis identified a mass of plasma that impacted our planet’s magnetosphere. The actual event was a halo coronal mass ejection from an active region in the northeast quadrant of the Sun. The material traveled out at around 690 kilometers per second as a shock-driving magnetic cloud. Think of it as a long ropy mass of material writhing its way through space. As it traveled, it expanded and at solar-facing satellites — including STEREO-A, which took a direct hit from it — made observations. Eventually, the cloud smacked into Earth’s magnetosphere creating a geomagnetic storm.

The atmosphere thickened enough that it affected the newly launched Starlink stations. They started to experience atmospheric drag, which caused them to deorbit and burn up on the way down. It was an expensive lesson in space weather and provided people on Earth with a great view of what happens when satellites fall back to Earth. It was also that could have been avoided if they’d delayed their launch to account for the ongoing threat.

Source: NASA Reveals What Made an Entire Starlink Satellite Fleet Go Down – Slashdot

Wolverine Gives Your Python Scripts The Ability To Self-Heal bugs using chatGPT

combined Python and a hefty dose of of AI for a fascinating proof of concept: self-healing Python scripts. He shows things working in a video, embedded below the break, but we’ll also describe what happens right here.

The demo Python script is a simple calculator that works from the command line, and [BioBootloader] introduces a few bugs to it. He misspells a variable used as a return value, and deletes the subtract_numbers(a, b) function entirely. Running this script by itself simply crashes, but using Wolverine on it has a very different outcome.In a short time, error messages are analyzed, changes proposed, those same changes applied, and the script re-run.

Wolverine is a wrapper that runs the buggy script, captures any error messages, then sends those errors to GPT-4 to ask it what it thinks went wrong with the code. In the demo, GPT-4 correctly identifies the two bugs (even though only one of them directly led to the crash) but that’s not all! Wolverine actually applies the proposed changes to the buggy script, and re-runs it. This time around there is still an error… because GPT-4’s previous changes included an out of scope return statement. No problem, because Wolverine once again consults with GPT-4, creates and formats a change, applies it, and re-runs the modified script. This time the script runs successfully and Wolverine’s work is done.

LLMs (Large Language Models) like GPT-4 are “programmed” in natural language, and these instructions are referred to as prompts. A large chunk of what Wolverine does is thanks to a carefully-written prompt, and you can read it here to gain some insight into the process. Don’t forget to watch the video demonstration just below if you want to see it all in action.

While AI coding capabilities definitely have their limitations, some of the questions it raises are becoming more urgent. Heck, consider that GPT-4 is barely even four weeks old at this writing.

https://platform.twitter.com/embed/Tweet.html?creatorScreenName=hackaday&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfbWl4ZWRfbWVkaWFfMTU4OTciOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd19leHBlcmltZW50c19jb29raWVfZXhwaXJhdGlvbiI6eyJidWNrZXQiOjEyMDk2MDAsInZlcnNpb24iOm51bGx9LCJ0ZndfZHVwbGljYXRlX3NjcmliZXNfdG9fc2V0dGluZ3MiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3ZpZGVvX2hsc19keW5hbWljX21hbmlmZXN0c18xNTA4MiI6eyJidWNrZXQiOiJ0cnVlX2JpdHJhdGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2xlZ2FjeV90aW1lbGluZV9zdW5zZXQiOnsiYnVja2V0Ijp0cnVlLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X2VkaXRfZnJvbnRlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1636880208304431104&lang=en&origin=https%3A%2F%2Fhackaday.com%2F2023%2F04%2F09%2Fwolverine-gives-your-python-scripts-the-ability-to-self-heal%2F&sessionId=de39ae5f7a5963d32185e4edfa3b5d86374d2d37&siteScreenName=hackaday&theme=light&widgetsVersion=aaf4084522e3a%3A1674595607486&width=550px

https://platform.twitter.com/embed/Tweet.html?creatorScreenName=hackaday&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfbWl4ZWRfbWVkaWFfMTU4OTciOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd19leHBlcmltZW50c19jb29raWVfZXhwaXJhdGlvbiI6eyJidWNrZXQiOjEyMDk2MDAsInZlcnNpb24iOm51bGx9LCJ0ZndfZHVwbGljYXRlX3NjcmliZXNfdG9fc2V0dGluZ3MiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3ZpZGVvX2hsc19keW5hbWljX21hbmlmZXN0c18xNTA4MiI6eyJidWNrZXQiOiJ0cnVlX2JpdHJhdGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2xlZ2FjeV90aW1lbGluZV9zdW5zZXQiOnsiYnVja2V0Ijp0cnVlLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X2VkaXRfZnJvbnRlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1636880208304431104&lang=en&origin=https%3A%2F%2Fhackaday.com%2F2023%2F04%2F09%2Fwolverine-gives-your-python-scripts-the-ability-to-self-heal%2F&sessionId=de39ae5f7a5963d32185e4edfa3b5d86374d2d37&siteScreenName=hackaday&theme=light&widgetsVersion=aaf4084522e3a%3A1674595607486&width=550px

https://hackaday.com/2023/04/09/wolverine-gives-your-python-scripts-the-ability-to-self-heal/

Blach hole streaking through galaxy leaves wake of new stars

There’s an invisible monster on the loose, barreling through intergalactic space so fast that if it were in our solar system, it could travel from Earth to the Moon in 14 minutes. This supermassive black hole, weighing as much as 20 million Suns, has left behind a never-before-seen 200,000-light-year-long “contrail” of newborn stars, twice the diameter of our Milky Way galaxy. It’s likely the result of a rare, bizarre game of galactic billiards among three massive black holes.

Rather than gobbling up stars ahead of it, like a cosmic Pac-Man, the speedy black hole is plowing into gas in front of it to trigger new star formation along a narrow corridor. The black hole is streaking too fast to take time for a snack. Nothing like it has ever been seen before, but it was captured accidentally by NASA’s Hubble Space Telescope.

Illustration of a black field with white, yellow, and red galaxies. A black hole near bottom left corner plows through space, leaving a diagonal trail of newborn stars stretching back to the black hole's parent galaxy in the upper right corner.

This is an artist’s impression of a runaway supermassive black hole that was ejected from its host galaxy as a result of a tussle between it and two other black holes. As the black hole plows through intergalactic space it compresses tenuous gas in front to it. This precipitates the birth of hot blue stars. This illustration is based on Hubble Space Telescope observations of a 200,000-light-year-long “contrail” of stars behind an escaping black hole. For more details, read the Extended Text Description.

Credits: NASA, ESA, Leah Hustak (STScI)

“We think we’re seeing a wake behind the black hole where the gas cools and is able to form stars. So, we’re looking at star formation trailing the black hole,” said Pieter van Dokkum of Yale University in New Haven, Connecticut. “What we’re seeing is the aftermath. Like the wake behind a ship we’re seeing the wake behind the black hole.” The trail must have lots of new stars, given that it is almost half as bright as the host galaxy it is linked to.

The black hole lies at one end of the column, which stretches back to its parent galaxy. There is a remarkably bright knot of ionized oxygen at the outermost tip of the column. Researchers believe gas is probably being shocked and heated from the motion of the black hole hitting the gas, or it could be radiation from an accretion disk around the black hole. “Gas in front of it gets shocked because of this supersonic, very high-velocity impact of the black hole moving through the gas. How it works exactly is not really known,” said van Dokkum.

“This is pure serendipity that we stumbled across it,” van Dokkum added. He was looking for globular star clusters in a nearby dwarf galaxy. “I was just scanning through the Hubble image and then I noticed that we have a little streak. I immediately thought, ‘oh, a cosmic ray hitting the camera detector and causing a linear imaging artifact.’ When we eliminated cosmic rays we realized it was still there. It didn’t look like anything we’ve seen before.”

Hubble image of black, deep-space field with white, yellow, and reddish galaxies. Image center: small, white-bordered, boxed area that contains one, long, thin, diagonal streak of whitish-blue stars. Two galaxies also reside within the box.

This Hubble Space Telescope archival photo captures a curious linear feature that is so unusual it was first dismissed as an imaging artifact from Hubble’s cameras. But follow-up spectroscopic observations reveal it is a 200,000-light-year-long chain of young blue stars. A supermassive black hole lies at the tip of the bridge at lower left. The black hole was ejected from the galaxy at upper right. It compressed gas in its wake to leave a long trail of young blue stars. Nothing like this has ever been seen before in the universe. This unusual event happened when the universe was approximately half its current age.

Credits: NASA, ESA, Pieter van Dokkum (Yale); Image Processing: Joseph DePasquale (STScI)

Because it was so weird, van Dokkum and his team did follow-up spectroscopy with the W. M. Keck Observatories in Hawaii. He describes the star trail as “quite astonishing, very, very bright and very unusual.” This led to the conclusion that he was looking at the aftermath of a black hole flying through a halo of gas surrounding the host galaxy.

This intergalactic skyrocket is likely the result of multiple collisions of supermassive black holes. Astronomers suspect the first two galaxies merged perhaps 50 million years ago. That brought together two supermassive black holes at their centers. They whirled around each other as a binary black hole.

Then another galaxy came along with its own supermassive black hole. This follows the old idiom: “two’s company and three’s a crowd.” The three black holes mixing it up led to a chaotic and unstable configuration. One of the black holes robbed momentum from the other two black holes and got thrown out of the host galaxy. The original binary may have remained intact, or the new interloper black hole may have replaced one of the two that were in the original binary, and kicked out the previous companion.

When the single black hole took off in one direction, the binary black holes shot off in the opposite direction. There is a feature seen on the opposite side of the host galaxy that might be the runaway binary black hole. Circumstantial evidence for this is that there is no sign of an active black hole remaining at the galaxy’s core. The next step is to do follow-up observations with NASA’s James Webb Space Telescope and the Chandra X-ray Observatory to confirm the black hole explanation.

https://youtube.com/watch?v=aPAP2ewFR0A%3Frel%3D0

There’s an invisible monster on the loose! It’s barreling through intergalactic space fast enough to travel from Earth to the Moon in 14 minutes. But don’t worry, luckily this beast is very, very far away! This potential supermassive black hole, weighing as much as 20 million Suns, has left behind a never-before-seen 200,000 light-year-long trail of newborn stars. The streamer is twice the diameter of our Milky Way galaxy. It’s likely the result of a rare, bizarre game of galactic billiards among three massive black holes.

Credits: NASA’s Goddard Space Flight Center; Lead Producer: Paul Morris

NASA’s upcoming Nancy Grace Roman Space Telescope will have a wide-angle view of the universe with Hubble’s exquisite resolution. As a survey telescope, the Roman observations might find more of these rare and improbable “star streaks” elsewhere in the universe. This may require machine learning using algorithms that are very good at finding specific weird shapes in a sea of other astronomical data, according to van Dokkum.

The research paper will be published on April 6 in The Astrophysical Journal Letters.

https://www.nasa.gov/feature/goddard/2023/hubble-sees-possible-runaway-black-hole-creating-a-trail-of-stars

Tired Of Web Scraping? Make The AI Do It

a novel approach to the problem of scraping web content in a structured way without needing to write the kind of page-specific code web scrapers usually have to deal with. How? Just enlist the help of a natural language AI. Scrapeghost relies on OpenAI’s GPT API to parse a web page’s content, pull out and classify any salient bits, and format it in a useful way.

What makes Scrapeghost different is how data gets organized. For example, when instantiating scrapeghost one defines the data one wishes to extract. For example:

from scrapeghost importSchemaScraper

scrape_legislators = SchemaScraper(

schema={

"name": "string",

"url": "url",

"district": "string",

"party": "string",

"photo_url": "url",

"offices": [{"name": "string", "address": "string", "phone": "string"}],

}

)

The kicker is that this format is entirely up to you! The GPT models are very, very good at processing natural language, and scrapeghost uses GPT to process the scraped data and find (using the example above) whatever looks like a name, district, party, photo, and office address and format it exactly as requested.

It’s an experimental tool and you’ll need an API key from OpenAI to use it, but it has useful features and is certainly a novel approach. There’s a tutorial and even a command-line interface, so check it out.

https://hackaday.com/2023/04/09/tired-of-web-scraping-make-the-ai-do-it/

Triggering Blinks i n VR, a useful thing to do

In VR, a blink can be a window of opportunity to improve the user’s experience. We’ll explain how in a moment, but blinks are tough to capitalize on because they are unpredictable and don’t last very long. That’s why researchers spent time figuring out how to induce eye blinks on demand in VR (video) and the details are available in a full PDF report. Turns out there are some novel, VR-based ways to reliably induce blinks. If an application can induce them, it makes it easier to use them to fudge details in helpful ways.

It turns out that humans experience a form of change blindness during blinks, and this can be used to sneak small changes into a scene in useful ways. Two examples are hand redirection (HR), and redirected walking (RDW). Both are ways to subtly break the implicit one-to-one mapping of physical and virtual motions. Redirected walking can nudge a user to stay inside a physical boundary without realizing it, leading the user to feel the area is larger than it actually is. Hand redirection can be used to improve haptics and ergonomics. For example, VR experiences that use physical controls (like a steering wheel in a driving simulator, or maybe a starship simulator project like this one) rely on physical and virtual controls overlapping each other perfectly. Hand redirection can improve the process by covering up mismatches in a way that is imperceptible to the user.

There are several known ways to induce a blink reflex, but it turns out that one novel method is particularly suited to implementing in VR: triggering the menace reflex by simulating a fast-approaching object. In VR, a small shadow appears in the field of view and rapidly seems to approach one’s eyes. This very brief event is hardly noticeable, yet reliably triggers a blink. There are other approaches as well such as flashes, sudden noise, or simulating the gradual blurring of vision, but to be useful a method must be unobtrusive and reliable.

We’ve already seen saccadic movement of the eyes used to implement redirected walking, but it turns out that leveraging eye blinks allows for even larger adjustments and changes to go unnoticed by the user. Who knew blinks could be so useful to exploit?

https://youtube.com/watch?v=cxapHXQysh8%3Fversion%3D3%26rel%3D1%26showsearch%3D0%26showinfo%3D1%26iv_load_policy%3D1%26fs%3D1%26hl%3Den-US%26autohide%3D2%26wmode%3Dtransparent

https://hackaday.com/2023/04/09/blinks-are-useful-in-vr-but-triggering-blinks-is-tricky/

A super high resolution, Global CTX Mosaic map of Mars

The Bruce Murray Laboratory for Planetary Visualization has completed a 5.7 terapixel mosaic of the surface of Mars rendered at 5.0 m/px. Each pixel in the mosaic is about the size of a typical parking space, providing unprecedented resolution of the martian surface at the global scale.

The mosaic covers 99.5% of Mars from 88°S to 88°N. The pixels that make up the mosaic can all be mapped back to their source data, providing full traceability for the entire mosaic. The mosaic is available to stream over the internet and to download, as described below.

All data in the mosaic come from the Context Camera (CTX) onboard the Mars Reconnaissance Orbiter (MRO).

Below is the entire mosaic within a 3D viewer. Click “See the Mosaic in 3D,” or click here to see it in a new window.

https://murray-lab.caltech.edu/CTX/

Google Will Require Android Apps to Make Account Deletion Easier

Right now, developers simply need to declare to Google that account deletion is somehow possible, but beginning next year, developers will have to make it easier to delete data through both their app and an online portal. Google specifies:

For apps that enable app account creation, developers will soon need to provide an option to initiate account and data deletion from within the app and online.

This means any app that lets you create an account to use it is required to allow you to delete that information when you’re done with it (or rather, request the developer delete the data from their servers). Although you can request that your data be deleted now, it usually requires manually contacting the developer to remove it. This new policy would mean developers have to offer a kill switch from the get-go rather than having Android users do the leg work.

The web deletion requirement is particularly new and must be “readily discoverable.” Developers must provide a link to a web form from the app’s Play Store landing page, with the idea being to let users delete account data even if they no longer have the app installed. Per the existing Android developer policy, all apps must declare how they collect and handle user data—Google introduced the policy in 2021 and made it mandatory last year. When you go into the Play Store and expand the “Data Safety” section under each app listing, developers list out data collection by criteria.

Simply removing an app from your Android device doesn’t completely scrub your data. Like software on a desktop operating system, files and folders are sometimes left behind from when the app was operating. This new policy will hopefully help you keep your data secure by wiping any unnecessary account info from the app developer’s servers, but also hopes to cut down on straggling data on your device. Conversely, you don’t have to delete your data if you think you’ll come to the app later. When it says you have a “choice,” Google wants to ensure it can point to something obvious.

It’s unclear how Google will determine if a developer follows the rules. It is up to the app developer to disclose whether user-specific app data is actually deleted. Earlier this year, Mozilla called out Google after discovering significant discrepancies between the top 20 most popular free apps’ internal privacy policies and those they listed in the Play Store.

https://gizmodo.com/google-android-delete-account-apps-request-uninstall-1850304540