A team of physicists devise a model that maps a star’s surprising orbit about a supermassive black hole

Hundreds of millions of light-years away in a distant galaxy, a star orbiting a supermassive black hole is being violently ripped apart under the black hole’s immense gravitational pull. As the star is shredded, its remnants are transformed into a stream of debris that rains back down onto the black hole to form a very hot, very bright disk of material swirling around the black hole, called an accretion disc. This phenomenon—where a star is destroyed by a supermassive black hole and fuels a luminous accretion flare—is known as a tidal disruption event (TDE), and it is predicted that TDEs occur roughly once every 10,000 to 100,000 years in a given galaxy.

[…]

TDEs are usually “once-and-done” because the extreme gravitational field of the SMBH destroys the star, meaning that the SMBH fades back into darkness following the accretion flare. In some instances, however, the high-density core of the star can survive the gravitational interaction with the SMBH, allowing it to orbit the black hole more than once. Researchers call this a repeating partial TDE.

[…]

findings, published in Astrophysical Journal Letters, describe the capture of the star by a SMBH, the stripping of the material each time the star comes close to the black hole, and the delay between when the material is stripped and when it feeds the black hole again.

[…]

Once bound to the SMBH, the star powering the emission from AT2018fyk has been repeatedly stripped of its outer envelope each time it passes through its point of closest approach with the black hole. The stripped outer layers of the star form the bright accretion disk, which researchers can study using X-Ray and Ultraviolet /Optical telescopes that observe light from distant galaxies.

[…]

“Until now, the assumption has been that when we see the aftermath of a close encounter between a star and a , the outcome will be fatal for the star, that is, the star is completely destroyed,” he says. “But contrary to all other TDEs we know of, when we pointed our telescopes to the same location again several years later, we found that it had re-brightened again. This led us to propose that rather than being fatal, part of the star survived the initial encounter and returned to the same location to be stripped of material once more, explaining the re-brightening phase.”

[…]

So how could a star survive its brush with death? It all comes down to a matter of proximity and trajectory. If the star collided head-on with the black hole and passed the event horizon—the threshold where the speed needed to escape the black hole surpasses the speed of light—the star would be consumed by the black hole. If the star passed very close to the black hole and crossed the so-called “tidal radius”—where the tidal force of the hole is stronger than the gravitational force that keeps the star together—it would be destroyed. In the model they have proposed, the star’s orbit reaches a point of closest approach that is just outside of the tidal radius, but doesn’t cross it completely: some of the material at the stellar surface is stripped by the black hole, but the material at its center remains intact.

[…]

More information: T. Wevers et al, Live to Die Another Day: The Rebrightening of AT 2018fyk as a Repeating Partial Tidal Disruption Event, The Astrophysical Journal Letters (2023). DOI: 10.3847/2041-8213/ac9f36

Source: A team of physicists devise a model that maps a star’s surprising orbit about a supermassive black hole

D&D Publisher In All kinds of trouble Over Controversial License changes – unsubscribes caused server crash, PR statement made

After a week of silence amid intense backlash, Dungeons & Dragons publisher Wizards of the Coast (WoTC) has finally addressed its community’s concerns about changes to the open gaming license. The open gaming license (OGL) has existed since 2000 and has made it possible for a diverse ecosystem of third-party creators to publish virtual tabletop software, expansion books and more. Many of these creators can make a living thanks to the OGL. But over the last week, a new version of the OGL leaked after WoTC sent it to some top creators. More than 66,000 Dungeons & Dragons fans signed an open letter under the name #OpenDnD ahead of an expected announcement, and waves of users deleted their subscriptions to D&D Beyond, WoTC’s online platform. Now, WoTC admitted that “it’s clear from the reaction that we rolled a 1.” Or, in non-Dungeons and Dragons speak, they screwed up.

“We wanted to ensure that the OGL is for the content creator, the homebrewer, the aspiring designer, our players, and the community — not major corporations to use for their own commercial and promotional purpose,” the company wrote in a statement. But fans have critiqued this language, since WoTC — a subsidiary of Hasbro — is a “major corporation” in itself. Hasbro earned $1.68 billion in revenue during the third quarter of 2022. TechCrunch spoke to content creators who had received the unpublished OGL update from WoTC. The terms of this updated OGL would force any creator making more than $50,000 to report earnings to WoTC. Creators earning over $750,000 in gross revenue would have to pay a 25% royalty. The latter creators are the closest thing that third-party Dungeons & Dragons content has to “major corporations” — but gross revenue is not a reflection of profit, so to refer to these companies in that way is a misnomer. […] The fan community also worried about whether WoTC would be allowed to publish and profit off of third-party work without credit to the original creator. Noah Downs, a partner at Premack Rogers and a Dungeons & Dragons livestreamer, told TechCrunch that there was a clause in the document that granted WoTC a perpetual, royalty-free sublicense to all third-party content created under the OGL.

Now, WoTC appears to be walking back both the royalty clause and the perpetual license. “What [the next OGL] will not contain is any royalty structure. It also will not include the license back provision that some people were afraid was a means for us to steal work. That thought never crossed our minds,” WoTC wrote in a statement. “Under any new OGL, you will own the content you create. We won’t.” WoTC claims that it included this language in the leaked version of the OGL to prevent creators from being able to “incorrectly allege” that WoTC stole their work. Throughout the document, WoTC refers to the document that certain creators received as a draft — however, creators who received the document told TechCrunch that it was sent to them with the intention of getting them to sign off on it. The backlash against these terms was so severe that other tabletop roleplaying game (TTRPG) publishers took action. Paizo is the publisher of Pathfinder, a popular game covered under WoTC’s original OGL. Paizo’s owner and presidents were leaders at Wizards of the Coast at the time that the OGL was originally published in 2000, and wrote in a statement yesterday that the company was prepared to go to court over the idea that WoTC could suddenly revoke the OGL license from existing projects. Along with other publishers like Kobold Press, Chaosium and Legendary Games, Paizo announced it would release its own Open RPG Creative License (ORC). “Ultimately, the collective action of the signatures on the open letter and unsubscribing from D&D Beyond made a difference. We have seen that all they care about is profit, and we are hitting their bottom line,” said Eric Silver, game master of Dungeons & Dragons podcast Join the Party. He told TechCrunch that WoTC’s response on Friday is “just a PR statement.”

“Until we see what they release in clear language, we can’t let our foot off the gas pedal,” Silver said. “The corporate playbook is wait it out until the people get bored; we can’t and we won’t.”

Source: D&D Publisher Addresses Backlash Over Controversial License – Slashdot

Players heard this message loud and clear, and began flocking to D&D Beyond’s website to cancel their subscriptions and delete their accounts. “DnDBegone” and “StopTheSub” joined OpenDnD as trending on Twitter as players disparaged Wizards of the Coast and parent company Hasbro over its draconian policies. The volume of players on the D&D Beyond website overloaded its servers, causing the Subscription Management page to temporarily crash.

The D&D Beyond page has since been restored, but further outages should be expected by fans wishing to make their voices heard. Thousands of players and content creators have already pulled their support of Dungeons and Dragons via D&D Beyond. Regardless of if Wizards of the Coast can revoke the old OGL, it is clear the bad faith it has earned will take a lot to clear.

Source: Dungeons and Dragons Players Cancel D&D Beyond Subscriptions En Masse After Insider Leak, Crash Servers

Rape survivor secretly recorded her abuser’s confession – despite audio + written confessions, jury verdict not unanimous

A woman who released audio of her rapist’s confession said she wanted to show how “manipulative” abusers can be.

Ellie Wilson, 25, secretly captured Daniel McFarlane admitting to his crimes by setting her phone to record in her handbag.

McFarlane was found guilty of two rape charges and sentenced to five years in prison in July last year.

Ms Wilson said that despite audio and written confessions being used in court, the verdict was not unanimous.

The attacks took place between December 2017 and February 2018 when McFarlane was a medical student at the University of Glasgow.

Since the conviction Ms Wilson, who waived her anonymity, has campaigned on behalf of victims.

Earlier this week Ms Wilson, who was a politics student and champion athlete at the university at the time, released audio on Twitter of a conversation with McFarlane covertly captured the year after the attacks.

In the recording she asks him: “Do you not get how awful it makes me feel when you say ‘I haven’t raped you’ when you have?”

McFarlane replies: “Ellie, we have already established that I have. The people that I need to believe me, believe me. I will tell them the truth one day, but not today.”

When asked how he feels about what he has done, he says: “I feel good knowing I am not in prison.”

Ellie was a university athletics champion
Image caption,

Ellie was a university athletics champion
line

The tweet has been viewed by more than 200,000 people.

Ms Wilson told BBC Scotland’s The Nine she had released the clip because many people wondered what evidence she had to secure a rape conviction.

She said the reaction had been “overwhelmingly positive” although a small minority had been very unkind.

And even with the recording of the confession being posted online some people were still saying ‘he didn’t do it’, Ms Wilson said.

In addition to the audio confession, Ms Wilson had text messages that pointed to McFarlane’s guilt yet she said she was still worried that it would not be enough to secure a conviction.

“The verdict was not unanimous,” she said.

“You can literally have a written confession, an audio confession and not everyone on the jury is going to believe you. I think that says a lot about society.”

Ms Wilson has previously said the experience she had in court was appalling.

She said she was subjected to personal attacks by the defence advocate and felt blamed for being assaulted.

[…]

Source: Rape survivor secretly recorded her abuser’s confession – BBC News

We Exist Inside a Giant Space Bubble, And Scientists Have Finally Mapped the magnetic field around it

You may not realize it in your day-to-day life, but we are all enveloped by a giant “superbubble” that was blown into space by the explosive deaths of a dozen-odd stars. Known as the Local Bubble, this structure extends for about 1,000 light years around the solar system, and is one of countless similar bubbles in our galaxy that are produced by the fallout of supernovas. Cosmic superbubbles have remained fairly mysterious for decades, but recent astronomical advances have finally exposed key details about their evolution and structure. Just within the past few years, researchers have mapped the geometry of the Local Bubble in three dimensions and demonstrated that its surface is an active site of star birth, because it captures gas and dust as it expands into space.

Now, a team of scientists has added another layer to our evolving picture of the Local Bubble by charting the magnetic field of the structure, which is thought to play a major role in star formation. Astronomers led by Theo O’Neill, who conducted the new research during a summer research program at the Center for Astrophysics at Harvard & Smithsonian (CfA), presented “the first-ever 3D map of a magnetic field over a superbubble” on Wednesday at the American Astronomical Society’s 241st annual meeting in Seattle, Washington. The team also unveiled detailed visualizations of their new map, bringing the Local Bubble into sharper focus.

“We think that the entire interstellar medium is really full of all these bubbles that are driven by various forms of feedback from, especially, really massive stars, where they’re outputting energy in some form or another into the space between the stars,” said O’Neill, who just received an undergraduate degree in astronomy-physics and statistics from the University of Virginia, in a joint call with their mentor Alyssa Goodman, an astronomer at CfA who co-authored the new research. […] “Now that we have this map, there’s a lot of cool science that can be done both by us, but hopefully by other people as well,” O’Neill said. “Since stars are clustered, it’s not as if the Sun is super special, and is in the Local Bubble because we’re just lucky. We know that the interstellar medium is full of bubbles like this, and there’s actually a lot of them nearby our own Local Bubble.” “One cool next step will be looking at places where the Local Bubble is nearby other feedback bubbles,” they concluded. “What happens when these bubbles interact, and how does that drive start formation in general, and the overall long-term evolution of galactic structures?”

Source: We Exist Inside a Giant Space Bubble, And Scientists Have Finally Mapped It – Slashdot

BMW Further Embraces Making Basic Features A Costly Subscription Service – now it’s remote starting

Last year BMW took ample heat for its plans to turn heated seats into a costly $18 per month subscription in numerous countries. As we noted at the time, BMW is already including the hardware in new cars and adjusting the sale price accordingly. So it’s effectively charging users a new, recurring fee to enable technology that already exists in the car and consumers already paid for.

The move portends a rather idiotic and expensive future for consumers that’s arriving faster than you’d think. Other companies have also embraced the idea, and BMW continues to find new options to turn into subscription services. The latest: remote engine starting, which will soon cost car owners an additional $105 every year. On the plus side, there’s at least some flexibility with the pricing:

Most of these features are available through either a 1-month, 1-year, or 3-year subscription, or can be purchased outright for a one-time fee. Motorauthority reached out to BMW USA and found that the Remote Engine Start costs $10 for 1 month, $105 for 1 year, $250 for 3 years, or can be purchased for $330 for the life of the vehicle.

Again, this technology — and every other technology BMW is going to do this with — is already included in the higher-end price tag of BMW vehicles. It’s effectively double dipping (to please Wall Street’s insatiable desire for improved quarterly returns at any cost) dressed up as innovation. It’s not a whole lot better than your broadband ISP charging you $10-$25 every month for years for a modem worth $70.

Once companies get a taste of fatter revenues from charging customers for things they’ve already technically paid for, it won’t really stop without either regulatory intervention, or competitive pressure from automakers that avoid the model. BMW’s also turning a lot of other features into subscription services, like parking assist, video driver recording, and other features:

As for the Driver Recorder, it is available for $39 for 1 year, $99 for 3 years, and $149 for a one-time payment. Driving Assistant Plus with Stop&Go can be added for $20 for 1 month, $210 for 1 year, $580 for 3 years, and $950 with a one-time payment. As for Parking Assistant Professional, it is available for $5 for 1 month, $50 for 1 year, $130 for 3 years, or a one-time fee of $220.

Hackers are already fiddling with ways to enable the technology without paying a subscription fee, which will launch an entirely new cat and mouse game that, if automakers get too creative with their crackdowns (like claiming you’re voiding your warranty by enabling something you already own), could also run afoul of the FTC’s tougher stance on right to repair issues.

Source: BMW Further Embraces Making Basic Features A Costly Subscription Service

If it was for a service they offer, one for which BMW needs to expend energy and effort, eg updating maps, posting locations of speeding cams, etc, this would be fine. But you are paying again for hardware you already own and have already paid for once you bought the car.

Moderna CEO: 400% price hike on COVID vaccine “consistent with the value”, Pfizer-BioNTech thinks so too

Moderna is considering raising the price of its COVID-19 vaccine by over 400 percent—from $26 per dose to between $110 and $130 per dose—according to a report by The Wall Street Journal.

Ars has reached out to Moderna for comment but has not yet received a response. The plan, if realized, would match the previously announced price hike for Pfizer-BioNTech’s rival COVID-19 vaccine.

The Journal spoke with Moderna CEO Stephane Bancel at the JP Morgan Healthcare Conference in San Francisco Monday, who said of the 400 percent price hike: “I would think this type of pricing is consistent with the value.”

Until now, the mRNA-based COVID-19 vaccines from Moderna and Pfizer-BioNTech have been purchased by the government and offered to Americans for free. In the latest federal contract from July, Moderna’s updated booster shot cost the government $26 per dose, up from $15–$16 per dose in earlier supply contracts, the Journal notes. Similarly, the government paid a little over $30 per dose for Pfizer-BioNTech’s vaccine this past summer, up from $19.50 per dose in contracts from 2020.

But now that the federal government is backing away from distributing the vaccines, their makers are moving to the commercial market—with price adjustments. Financial analysts had previously anticipated Pfizer would set the commercial price for its vaccine at just $50 per dose but were taken aback in October when Pfizer announced plans of a price between $110 and $130. Analysts then anticipated that Pfizer’s price would push Moderna and other vaccine makers to follow suit, which appears to be happening now.

Lawmakers have already lambasted Pfizer for the steep increase. In a letter sent last month to Pfizer CEO Albert Bourla, Senators Elizabeth Warren (D-Mass.) and Peter Welch (D-Vt.) called the price hike “pure and deadly greed” and accused the company of “unseemly profiteering.”

“We urge you to back off from your proposed price increases and ensure COVID-19 vaccines are reasonably priced and accessible to people across the United States,” they wrote.

The revelation that Moderna may match Pfizer’s price increase comes just a day after Moderna announced that its COVID-19 vaccine sales in 2022 totaled approximately $18.4 billion.

[…]

Source: Moderna CEO: 400% price hike on COVID vaccine “consistent with the value” | Ars Technica

Kids Are Being Exposed to Lead From Aircraft at Airports using AVGAS

People living near airports that service piston-engine aircraft are disproportionately exposed to lead, a dangerous neurotoxin.

A study published this week in PNAS Nexus found that children living near the Reid-Hillview Airport in Santa Clara County, California, had elevated blood lead levels. They’ve pinpointed piston-engine aircrafts at airports like the one in California as a source of lead exposure for children.

Overall blood lead levels in U.S. children have gone down significantly in the last half century. Since the 1970s, policymakers have removed lead from everyday items like pipes, food cans, and vehicle gasoline. But despite those efforts, airports that house and service piston-engine aircraft, which mainly use leaded aviation fuel, continue to pollute the air. These are small, single- or two-propeller airplanes, such as training Cessna airplanes, small commercial aircraft, and the planes commonly seen trailing advertisement banners.

“Lead-formulated aviation gasoline (avgas) is the primary source of lead emissions in the United States today, consumed by over 170,000 piston-engine aircraft,” according to the new paper.

The researchers analyzed 14,000 blood samples, taken from 2011 to 2020 from children under 6 years old living near the California airport, to gauge exposure to lead. They found that blood lead levels increased the closer the children lived to the airport. Blood lead levels were also 2.18 times higher than a health department threshold of 4.5 micrograms per deciliter in children who lived east, or downwind, of the airport, according to the study.

[…]

Source: American Kids Are Being Exposed to Lead From Airports

Corrupt NOTAM database file and backup led to the FAA ground stoppage.

Officials are still trying to figure out exactly what led to the Federal Aviation Administration system outage on Wednesday but have traced it to a corrupt file, which was first reported by CNN.
In a statement late Wednesday, the FAA said it was continuing to investigate the outage and “take all needed steps to prevent this kind of disruption from happening again.”
“Our preliminary work has traced the outage to a damaged database file. At this time, there is no evidence of a cyberattack,” the FAA said.
The FAA is still trying to determine whether any one person or “routine entry” into the database is responsible for the corrupted file, a government official familiar with the investigation into the NOTAM system outage told CNN.
Another source familiar with the Federal Aviation Administration operation described exclusively to CNN on Wednesday how the outage played out.
When air traffic control officials realized they had a computer issue late Tuesday, they came up with a plan, the source said, to reboot the system when it would least disrupt air travel, early on Wednesday morning.
But ultimately that plan and the outage led to massive flight delays and an unprecedented order to stop all aircraft departures nationwide.
The computer system that failed was the central database for all NOTAMs (Notice to Air Missions) nationwide. Those notices advise pilots of issues along their route and at their destination. It has a backup, which officials switched to when problems with the main system emerged, according to the source.
FAA officials told reporters early Wednesday that the issues developed in the 3 p.m. ET hour on Tuesday.
Officials ultimately found a corrupt file in the main NOTAM system, the source told CNN. A corrupt file was also found in the backup system.
In the overnight hours of Tuesday into Wednesday, FAA officials decided to shut down and reboot the main NOTAM system — a significant decision, because the reboot can take about 90 minutes, according to the source.
They decided to perform the reboot early Wednesday, before air traffic began flying on the East Coast, to minimize disruption to flights.
“They thought they’d be ahead of the rush,” the source said.
During this early morning process, the FAA told reporters that the system was “beginning to come back online,” but said it would take time to resolve.
The system, according to the source, “did come back up, but it wasn’t completely pushing out the pertinent information that it needed for safe flight, and it appeared that it was taking longer to do that.”
That’s when the FAA issued a nationwide ground stop at around 7:30 a.m. ET, halting all domestic departures.
Aircraft in line for takeoff were held before entering runways. Flights already in the air were advised verbally of the safety notices by air traffic controllers, who keep a static electronic or paper record at their desks of the active notices.
Transportation Secretary Pete Buttigieg ordered an after-action review and also said there was “no direct evidence or indication” that the issue was a cyberattack.
The source said the NOTAM system is an example of aging infrastructure due for an overhaul.
[…]

Source: A corrupt file led to the FAA ground stoppage. It was also found in the backup system | CNN Travel

Agreed, the NOTAM system (which stood for NOtice To AirMen until this article) is definitely ancient and in dire need of a refresh.

3 Native Americans ask Apache foundation to change name, hope to cancel a culture bigger than Native Americans have ever been

Natives in Tech, a US-based non-profit organization, has called upon the Apache Software Foundation (ASF) to change its name, out of respect for indigenous American peoples and to live up to its own code of conduct.

In a blog post, Natives in Tech members Adam Recvlohe, Holly Grimm, and Desiree Kane have accused the ASF of appropriating Indigenous culture for branding purposes.

Citing ASF founding member Brian Behlendorf’s description in the documentary “Trillions and Trillions Served” of how he wanted something more romantic than a tech term like “spider” and came up with “Apache” after seeing a documentary about Geronimo, the group said:

This frankly outdated spaghetti-Western ‘romantic’ presentation of a living and vibrant community as dead and gone in order to build a technology company ‘for the greater good’ is as ignorant as it is offensive.

(We could have sworn Apache stood for a patchy web server at one point…)

The aggrieved trio challenged the ASF to make good on its code of conduct commitment to “be careful in the words that [they] choose” by choosing a new name. The group took issue with what they said was the suggestion that the Apache tribe exists only in a past historical context, citing eight federally recognized Native American tribes that bear the name.

[…]

Source: Native Americans ask Apache foundation to change name • The Register

Most of the world wide web runs on servers running Apache software. I’d say the tech apache outnumbers the Native American Apaches significantly and these guys are pulling on the tails of the  Apache foundation to gather attention to their cause of putting themselves into the news.

CNET Is Quietly Publishing Articles Generated By AI, curated by journalists

[…]

CNET, a massively popular tech news outlet, has been quietly employing the help of “automation technology” — a stylistic euphemism for AI — on a new wave of financial explainer articles, seemingly starting around November of last year.

In the absence of any formal announcement or coverage, it appears that this was first spotted by online marketer Gael Breton in a tweet on Wednesday.

The articles are published under the unassuming appellation of “CNET Money Staff,” and encompass topics like “Should You Break an Early CD for a Better Rate?” or “What is Zelle and How Does It Work?”

That byline obviously does not paint the full picture, and so your average reader visiting the site likely would have no idea that what they’re reading is AI-generated. It’s only when you click on “CNET Money Staff,” that the actual “authorship” is revealed.

“This article was generated using automation technology,” reads a dropdown description, “and thoroughly edited and fact-checked by an editor on our editorial staff.”

Since the program began, CNET has put out around 73 AI-generated articles. That’s not a whole lot for a site that big, and absent an official announcement of the program, it appears leadership is trying to keep the experiment as lowkey as possible. CNET did not respond to questions about the AI-generated articles.

[…]

Based on Breton’s observations, though, some of the articles appear to be pulling in large amounts of traffic

[…]

But AI usage is not limited to those kinds of bottom of the barrel outlets. Even the prestigious news agency The Associated Press has been using AI since 2015 to automatically write thousands and thousands of earnings reports. The AP has even proudly proclaimed itself as “one of the first news organizations to leverage artificial intelligence.”

It’s worth noting, however, that the AP‘s auto-generated material appears to be essentially filling in blanks in predetermined formats, whereas the more sophisticated verbiage of CNET‘s publications suggests that it’s using something more akin to OpenAI’s GPT-3.

[…]

Source: CNET Is Quietly Publishing Entire Articles Generated By AI

The source article is the usual fearmongering against AI and you must check / care if it was written by a human, but to me it seems that this is a good way of partnering current AI with humans to create good content.

Microsoft’s new AI can simulate anyone’s voice with 3 seconds of audi

On Thursday, Microsoft researchers announced a new text-to-speech AI model called VALL-E that can closely simulate a person’s voice when given a three-second audio sample. Once it learns a specific voice, VALL-E can synthesize audio of that person saying anything—and do it in a way that attempts to preserve the speaker’s emotional tone.

Its creators speculate that VALL-E could be used for high-quality text-to-speech applications, speech editing where a recording of a person could be edited and changed from a text transcript (making them say something they originally didn’t), and audio content creation when combined with other generative AI models like GPT-3.

Microsoft calls VALL-E a “neural codec language model,” and it builds off of a technology called EnCodec, which Meta announced in October 2022. Unlike other text-to-speech methods that typically synthesize speech by manipulating waveforms, VALL-E generates discrete audio codec codes from text and acoustic prompts. It basically analyzes how a person sounds, breaks that information into discrete components (called “tokens”) thanks to EnCodec, and uses training data to match what it “knows” about how that voice would sound if it spoke other phrases outside of the three-second sample. Or, as Microsoft puts it in the VALL-E paper:

To synthesize personalized speech (e.g., zero-shot TTS), VALL-E generates the corresponding acoustic tokens conditioned on the acoustic tokens of the 3-second enrolled recording and the phoneme prompt, which constrain the speaker and content information respectively. Finally, the generated acoustic tokens are used to synthesize the final waveform with the corresponding neural codec decoder.

Microsoft trained VALL-E’s speech-synthesis capabilities on an audio library, assembled by Meta, called LibriLight. It contains 60,000 hours of English language speech from more than 7,000 speakers, mostly pulled from LibriVox public domain audiobooks. For VALL-E to generate a good result, the voice in the three-second sample must closely match a voice in the training data.

On the VALL-E example website, Microsoft provides dozens of audio examples of the AI model in action. Among the samples, the “Speaker Prompt” is the three-second audio provided to VALL-E that it must imitate.

Source: Microsoft’s new AI can simulate anyone’s voice with 3 seconds of audio | Ars Technica

It’s fun, but it’s not quite there yet though

Astronomers Find the Edge of Our Galaxy, 1.04m light years away

(Andromeda Galaxy)

In the quest to find the outer limits of our galaxy, astronomers have discovered over 200 stars that form the Milky Way’s edge, the most distant of which is over one million light-years away—nearly halfway to the Andromeda galaxy.

The 208 stars the researchers identified are known as RR Lyrae stars, which are stars with a brightness that can change as viewed from Earth. These stars are typically old and brighten and dim at regular intervals, which is a mechanism that allows scientists to calculate how far away they are. By calculating the distance to these RR Lyrae stars, the team found that the farthest of the bunch was located about halfway between the Milky Way and the Andromeda galaxy, one of our cosmic next-door neighbors.

“This study is redefining what constitutes the outer limits of our galaxy,” said Raja GuhaThakurta in a press release. GuhaThakurta is professor and chair of astronomy and astrophysics at the University of California Santa Cruz. “Our galaxy and Andromeda are both so big, there’s hardly any space between the two galaxies.”

Image for article titled Astronomers Find the Edge of Our Galaxy
Illustration: NASA, ESA, AND A. FEILD (STSCI)

The Milky Way galaxy consists of a few different parts, the primary of which is a thin, spiral disk about 100,000 light-years across. Our home solar system sits on one of the arms of this disk. An inner and outer halo surround the disk, and these halos contain some of the oldest stars in our galaxy.

Previous studies have placed the edge of the outer halo at 1 million light-years from the Milky Way’s center, but based on the new work, the edge of this halo should be about 1.04 million light-years from the galactic center. Yuting Feng, a doctoral student at the university working with GuhaThakurta, led the study and is presenting the findings this week at the American Astronomical Society meeting in Seattle.

[…]

Source: Astronomers Find the Edge of Our Galaxy

Hydrogen masers (jets at 500 km/s) reveal new secrets of a massive star

While using the Atacama Large Millimeter/submillimeter Array (ALMA) to study the masers around oddball star MWC 349A scientists discovered something unexpected: a previously unseen jet of material launching from the star’s gas disk at impossibly high speeds. What’s more, they believe the jet is caused by strong magnetic forces surrounding the star.

The discovery could help researchers to understand the nature and evolution of massive stars and how hydrogen are formed in space. The new observations were presented today (January 9) in a press conference at the 241st meeting of the American Astronomical Society (AAS) in Seattle, Washington.

Located roughly 3,900 light-years away from Earth in the constellation Cygnus, MWC 349A’s unique features make it a hot spot for in optical, infrared, and radio wavelengths. The massive star—roughly 30 times the mass of the sun—is one of the brightest radio sources in the sky, and one of only a handful of objects known to have hydrogen masers. These masers amplify microwave radio emissions, making it easier to study processes that are typically too small to see. It is this unique feature that allowed scientists to map MWC 349A’s disk in detail for the first time.

“A maser is like a naturally occurring laser,” said Sirina Prasad, an undergraduate research assistant at the Center for Astrophysics | Harvard & Smithsonian (CfA), and the primary author of the paper. “It’s an area in that emits a really bright kind of light. We can see this light and trace it back to where it came from, bringing us one step closer to figuring out what’s really going on.”

The massive star MWC 349A is one of the brightest radio sources in the sky. But, at 3,900 light-years away from Earth, scientists needed help to see what’s really going on, and in this case, to discover a jet of material blasting out from the star’s gas disk at 500 km/s. Previously hidden amongst the winds flowing out from the star, the jet was discovered using the combined resolving power of ALMA’s Band 6 (right) and Band 7 (left), and hydrogen masers— naturally occurring lasers that amplify microwave radio emissions, shown here in this ALMA science image. The revelation may help scientists to better understand the nature and evolution of massive stars. Credit: ALMA (ESO/NAOJ/NRAO), S. Prasad/CfA

Leveraging the resolving power of ALMA’s Band 6, developed by the U.S. National Science Foundation’s National Radio Astronomy Observatory (NRAO), the team was able to use the masers to uncover the previously unseen structures in the star’s immediate environment. Qizhou Zhang, a senior astrophysicist at CfA, and the project’s principal investigator added, “We used masers generated by hydrogen to probe the physical and dynamic structures in the gas surrounding MWC 349A and revealed a flattened gas disk with a diameter of 50 au, approximately the size of the Solar System, confirming the near-horizontal disk structure of the star. We also found a fast-moving jet component hidden within the winds flowing away from the star.”

The observed jet is ejecting material away from the star at a blistering 500 km per second. That’s akin to traveling the distance between San Diego, California, and Phoenix, Arizona, in the literal blink of an eye. According to researchers, it is probable that a jet moving this fast is being launched by a magnetic force. In the case of MWC 349A, that force could be a magnetohydrodynamic wind—a type of wind whose movement is dictated by the interplay between the star’s magnetic field and gases present in its surrounding disk.

“Our previous understanding of MWC 349A was that the star was surrounded by a rotating disk and photo-evaporating wind. Strong evidence for an additional collimated jet had not yet been seen in this system. Although we don’t yet know for certain where it comes from or how it is made, it could be that a magnetohydrodynamic wind is producing the jet, in which case the magnetic field is responsible for launching rotating material from the system,” said Prasad. “This could help us to better understand the disk- dynamics of MWC 349A, and the interplay between circumstellar disks, winds, and jets in other star systems.”

More information: These results will be presented during a press conference at the 241st proceedings of the American Astronomical Society on Monday, January 9th at 2:15pm Pacific Standard Time (PST).

Source: Hydrogen masers reveal new secrets of a massive star

Citizen’s volunteer ‘safety’ app accidentally doxxes singer Billie Eilish

Citizen, the provocative crime-reporting app formerly known as Vigilante, is in the news again for all the wrong reasons. On Thursday evening, it doxxed singer Billie Eilish, publishing her address to thousands of people after an alleged burglary at her home.

Shortly after the break-in, the app notified users of a break-in in Los Angeles’ Highland Park neighborhood — including the home’s address. As reported by Vice, Citizen’s message was updated at 9:41 PM to state that the house belonged to Eilish. According to Citizen’s metrics, the alert was sent to 178,000 people and viewed by nearly 78,000. On Friday morning, Citizen updated the app’s description of the incident, replacing the precise address with a nearby cross-street.

Although celebrity home addresses are often publicly available (usually on seedy websites specializing in such invasive nonsense), a popular app pushing the home address of one of pop music’s biggest stars to thousands of users is… new. Unfortunately, it’s also just the latest potentially destructive move from Citizen.

 

When Citizen launched as Vigilante in 2016, Apple quickly pulled the title from the App Store based on concerns about its encouraging users to thrust themselves into dangerous situations. So it rebranded as Citizen with a new focus on safety, and Apple re-opened its gates. The app began advising users to avoid incidents in progress while providing tools to help those caught in a dangerous situation. Although that sounds reasonable, at least one episode reveals an overzealousness company prioritizing attention and profit over social responsibility.

Visual of three phones showing screenshots from the Citizen app
Citizen

In May 2021, CEO Andrew Frame ordered the launch of a live stream, encouraging the app’s users to hunt down a suspected wildfire arsonist (based on a tip from an LAPD sergeant and emails from residents questioned by police). He offered a $10,000 bounty for finding the suspect, which grew to $30,000 later in the evening. As the hunt continued, the CEO reportedly grew more frantic, with one of his internal Slack conversations encouraging the team to “get this guy before midnight” in an ecstatic, all-caps message.

[…]

Source: Citizen’s volunteer ‘safety’ app accidentally doxxes singer Billie Eilish | Engadget

Google will pay $9.5 million to settle Washington DC AG’s location-tracking lawsuit

Google has agreed to pay $9.5 million to settle a lawsuit brought by Washington DC Attorney General Karl Racine, who accused the company earlier this year of “deceiving users and invading their privacy.” Google has also agreed to change some of its practices, primarily concerning how it informs users about collecting, storing and using their location data.

“Google leads consumers to believe that consumers are in control of whether Google collects and retains information about their location and how that information is used,” the complaint, which Racine filed in January, read. “In reality, consumers who use Google products cannot prevent Google from collecting, storing and profiting from their location.”

Racine’s office also accused Google of employing “dark patterns,” which are design choices intended to deceive users into carrying out actions that don’t benefit them. Specifically, the AG’s office claimed that Google repeatedly prompted users to switch in location tracking in certain apps and informed them that certain features wouldn’t work properly if location tracking wasn’t on. Racine and his team found that location data wasn’t even needed for the app in question. They asserted that Google made it “impossible for users to opt out of having their location tracked.”

 

The $9.5 million payment is a paltry one for Google. Last quarter, it took parent company Alphabet under 20 minutes to make that much in revenue. The changes that the company will make to its practices as part of the settlement may have a bigger impact.

Folks who currently have certain location settings on will receive notifications telling them how they can disable each setting, delete the associated data and limit how long Google can keep that information. Users who set up a new Google account will be informed which location-related account settings are on by default and offered the chance to opt out.

Google will need to maintain a webpage that details its location data practices and policies. This will include ways for users to access their location settings and details about how each setting impacts Google’s collection, retention or use of location data.

Moreover, Google will be prevented from sharing a person’s precise location data with a third-party advertiser without the user’s explicit consent. The company will need to delete location data “that came from a device or from an IP address in web and app activity within 30 days” of obtaining the information

[…]

Source: Google will pay $9.5 million to settle Washington DC AG’s location-tracking lawsuit | Engadget

Spy Tech Palantir’s Covid-era UK health contract extended without public consultation or competition

NHS England has extended its contract with US spy-tech biz Palantir for the system built at the height of the pandemic to give it time to resolve the twice-delayed procurement of a data platform to support health service reorganization and tackle the massive care backlog.

The contract has already been subject to the threat of a judicial review, after which NHS England – a non-departmental government body – agreed to three concessions, including the promise of public consultation before extending the contract.

Campaigners and legal groups are set to mount legal challenges around separate, but related, NHS dealing with Palantir.

In a notice published yesterday, the NHS England said the contract would be extended until September 2023 in a deal worth £11.5 million ($13.8 million).

NHS England has been conducting a £360 million ($435 million) procurement of a separate, but linked, Federated Data Platform (FDP), a deal said to be a “must-win” for Palantir, a US data management company which cut its teeth working for the CIA and controversial US immigration agency ICE.

The contract notice for FDP, which kicks off the official competition, was originally expected in June 2022 but was delayed until September 2022, when NHS England told The Register it would be published. The notice has yet to appear

[…]

Source: Palantir’s Covid-era UK health contract extended • The Register

LG allows you to choose picture mode by comparing pictures

An image showing LG’s new personalized picture wizard software feature on its 2023 TVs.

Setting up a new TV? Ask any videophile or home theater nerd and they’ll probably tell you to set your picture mode to the movie/cinema option (or whatever’s closest on your particular TV) and leave it there. Traditionally, this has been the most color accurate option and leans toward a pleasant, warm white balance instead of the cooler temperature that usually accompanies “standard” modes. But there are inevitably those people who prefer the standard or vivid settings — much to the chagrin of enthusiasts.

With its new 2023 TV lineup, LG is throwing these conventional choices out the window — if you’re willing to try — and has come up with a new way of personalizing your picture preferences. Instead of giving you a few labeled options to switch between, a new “Personalized Picture Wizard” will present you with a series of images. On each screen, you choose one or two that look best to you.

A photo showing the process of LG’s personalized picture wizard TV software feature.
Of course AI deep learning is involved. It’s 2023.
Photo by Chris Welch / The Verge

After you do this six times, the TV will formulate a preset that’s based on your selections. It considers the brightness, color, and contrast levels that you indicated a preference for. LG says a ton of AI deep learning is involved throughout this process; it sampled millions of images in creating the Picture Wizard. If you’re ready to see how your picture mode looks while watching real content, you can hit “apply.”

Obviously LG will still be offering the tried and true picture settings along with deeper calibration options; your personalized picture mode will appear right alongside those in the settings menu on 2023 LG TVs. So you can easily switch between all of them and see the differences. For now, you can only create one personalized picture mode that applies to everyone using the same TV, but LG told me that it eventually wants to let each user profile make their own.

[…]

Source: LG wants to reinvent how you think of TV picture modes – The Verge

Apple Faces French $8.5M Fine For Illegal Data Harvesting

France’s data protection authority, CNIL, fined Apple €8 million (about $8.5 million) Wednesday for illegally harvesting iPhone owners’ data for targeted ads without proper consent.

[…]

The French fine, though, is the latest addition to a growing body of evidence that Apple may not be the privacy guardian angel it makes itself out to be.

[…]

Apple failed to “obtain the consent of French iPhone users (iOS 14.6 version) before depositing and/or writing identifiers used for advertising purposes on their terminals,” the CNIL said in a statement. The CNIL’s fine calls out the search ads in Apple’s App Store, specifically. A French court fined the company over $1 million in December over its commercial practices related to the App Store.

[…]

Eight million euros is peanuts for a company that makes billions a year on advertising alone and is so inconceivably wealthy that it had enough money to lose $1 trillion in market value last year—making Apple the second company in history to do so. The fine could have been higher but for the fact that Apple’s European headquarters are in Ireland, not France, giving the CNIL a smaller target to go after.

Still, its a signal that Apple may face a less friendly regulatory future in Europe. Commercial authorities are investigating Apple for anti-competitive business practices, and are even forcing the company to abandon its proprietary charging cable in favor of USB-C ports.

Source: Apple Faces Rare $8.5M Fine For Illegal Data Harvesting

Asus brings glasses-free 3D to OLED laptops | Ars Technica

Asus announced an upcoming feature that allows users to view and work with content in 3D without wearing 3D glasses. Similar technology has been used in a small number of laptops and displays before, but Asus is incorporating the feature for the first time in OLED laptop screens. Combined with high refresh rates, unique input methods like an integrated dial, and the latest CPUs and laptop GPUs, the company is touting the laptops with the Asus Spatial Vision feature as powerful niche options for creative professionals looking for new ways to work.

Asus’ Spatial Vision 3D tech is debuting on two laptops in Q2 this year: the ProArt Studiobook 16 3D OLED (H7604) and Vivobook Pro 16 3D OLED (K6604).

Asus' ProArt Studiobook 16 3D OLED (H7604) is one of the two PCs announced with Asus Spatial Vision.
Asus’ ProArt Studiobook 16 3D OLED (H7604) is one of the two PCs announced with Asus Spatial Vision.

The laptops each feature a 16-inch, 3200×2000 OLED panel with a 120 Hz refresh rate. The OLED panel is topped with a layer of optical resin, a glass panel, and a lenticular lens layer. The lenticular lens works with a pair of eye-tracking cameras to render real-time images for each eye that adjust with your physical movements.

In a press briefing, an Asus spokesperson said that because the OLED screens claim a low gray-to-gray response time of 0.2 ms, as well as the extremely high contrast that comes with OLED, there’s no crosstalk between the left and right eye’s image, ensuring more realistic-looking content. However, Asus’ product pages for the laptops acknowledge that  experiences may vary, and some may still suffer from “dizziness or crosstalk due to other reasons, and this varies according to the individual.” Asus said it’s aiming to offer demos to users, which would be worth trying out before committing to this unique feature.

The ProArt Studiobook 16 3D OLED weighs 5.29 lbs and is 0.94-inches thick.
The ProArt Studiobook 16 3D OLED weighs 5.29 lbs and is 0.94-inches thick.

On top of the lenticular lens is a 2D/3D liquid-crystal switching layer, which is topped with a glass front panel with an anti-reflective coating. According to Asus, it’ll be easy to switch from 2D mode to 3D and back again. When the laptops aren’t in 3D mode, their display will appear as a highly specced OLED screen, Asus claimed.

The laptops can apply a 3D effect to any game, movie, or content that supports 3D. However, content not designed for 3D display may appear more “stuttery,” per a demo The Verge saw. The laptops are primarily for people working with and creating 3D models and content, such as designers and architects.

The Vivobook Pro 16X 3D OLED weighs 4.41 lbs and is 0.9-inches thick.
Enlarge / The Vivobook Pro 16X 3D OLED weighs 4.41 lbs and is 0.9-inches thick.

The two laptops will ship with Spatial Vision Hub software. It includes a Model Viewer, Player for movies and videos, Photo Viewer for transforming side-by-side photos shot with a 180-degree camera into one stereoscopic 3D image, and Connector, a plug-in that Asus’ product page says is compatible with “various apps and tools, so you can easily view any project in 3D.”

Asus’ Spatial Vision laptops have glasses-free 3D that’s similar to some Acer products already released. In May, Acer announced the SpatialLabs View and SpatialLabs View Pro portable monitors that can convert 2D content into stereoscopic 3D by rendering images for the left and right eye and projecting them through an optical lens. The monitors require an Intel Core i7 CPU and RTX 3070 Ti for laptops or RTX 2080 for desktops, however. Asus’ laptops give you everything you need to try the emerging technology.

Acer has also released its laptops with glasses-free 3D: the ConceptD SpatialLabs Edition workstation-esque clamshell and the Acer Predator Helios 300 Spatial Edition gaming laptop.

[…]

Source: Asus brings glasses-free 3D to OLED laptops | Ars Technica

US Moves To Bar Noncompete Agreements in Labor Contracts

In a far-reaching move that could raise wages and increase competition among businesses, the Federal Trade Commission on Thursday unveiled a rule that would block companies from limiting their employees’ ability to work for a rival. From a report: The proposed rule would ban provisions of labor contracts known as noncompete agreements, which prevent workers from leaving for a competitor or starting a competing business for months or years after their employment, often within a certain geographic area. The agreements have applied to workers as varied as sandwich makers, hair stylists, doctors and software engineers.

Studies show that noncompetes, which appear to directly affect roughly 20 percent to 45 percent of private-sector U.S. workers, hold down pay because job switching is one of the more reliable ways of securing a raise. Many economists believe they help explain why pay for middle-income workers has stagnated in recent decades. Other studies show that noncompetes protect established companies from start-ups, reducing competition within industries. The arrangements may also harm productivity by making it hard for companies to hire workers who best fit their needs.

The F.T.C. proposal is the latest in a series of aggressive and sometimes unorthodox moves to rein in the power of large companies under the agency’s chair, Lina Khan. “Noncompetes block workers from freely switching jobs, depriving them of higher wages and better working conditions, and depriving businesses of a talent pool that they need to build and expand,” Ms. Khan said in a statement announcing the proposal. “By ending this practice, the F.T.C.’s proposed rule would promote greater dynamism, innovation and healthy competition.”

Source: US Moves To Bar Noncompete Agreements in Labor Contracts – Slashdot

200 Million Twitter Users’ Data for Sale on the Dark Web for $2

[…]

The short version of the latest drama is this: data stolen from Twitter more than a year ago found its way onto a major dark web marketplace this week. The asking price? The crypto equivalent of $2. In other words, it’s basically being given away for free. The hacker who posted the data haul, a user who goes by the moniker “StayMad,” shared the data on the market “Breached,” where anyone can now purchase and peruse it. The cache is estimated to cover at least 235 million people’s information.

[…]

According to multiple reports, the breach material includes the email addresses and/or phone numbers of some 235 million people, the credentials that users used to set up their accounts. This information has been paired with details publicly scraped from users’ profiles, thus allowing the cybercriminals to create more complete data dossiers on potential victims. Bleeping Computer reports that the information for each user includes not only email addresses and phone numbers but also names, screen names/user handles, follower count, and account creation date.

[…]

The data that appeared on “Breached” this week was actually stolen during 2021. Per the Washington Post, cybercriminals exploited an API vulnerability in Twitter’s platform to call up user information connected to hundreds of millions of user accounts. This bug created a bizarre “lookup” function, allowing any person to plug in a phone number or email to Twitter’s systems, which would then verify whether the credential was connected to an active account. The bug would also reveal which specific account was tied to the credential in question.

The vulnerability was originally discovered by Twitter’s bug bounty program in January of 2022 and was first publicly acknowledged last August.

[…]

 

Source: 200 Million Twitter Users’ Data for Sale on the Dark Web for $2

Californian law forces salary disclosure for companies > 15 people – fair and inclusive

The law affects every company with more than 15 employees looking to fill a job that could be performed from the state of California. It covers hourly and temporary work, all the way up to openings for highly paid technology executives.

That means it’s now possible to know the salaries top tech companies pay their workers. For example:

  • A program manager in Apple
  • ’s augmented reality group will receive base pay between $121,000 and $230,000 per year, according to an Apple posting Wednesday.
  • A midcareer software engineer at Google
  • Health can expect to make between $126,000 and $190,000 per year.
  • A director of software engineering at Meta

Notably, these salary listings do not include any bonuses or equity grants, which many tech companies use to attract and retain employees.

[…]

In the U.S., there are now 13 cities and states that require employers to share salary information, covering about 1 in 4 workers, according to Payscale, a software firm focusing on salary comparison.

California’s pay transparency law is intended to reduce gender and race pay gaps and help minorities and women better compete in the labor market. For example, people can compare their current pay with job listings with the same job title and see if they’re being underpaid.

Women earn about 83 cents for every dollar a man earns, according to the U.S. Census.

[…]

There are two primary components to California Senate Bill No. 1162, which was passed in September and went into effect Jan. 1.

First is the pay transparency component on job listings, which applies to any company with more than 15 employees if the job could be done in California.

The second part requires companies with more than 100 employees to submit a pay data report to the state of California with detailed salary information broken down by race, sex and job category. Companies have to provide a similar report on the federal level, but California now requires more details.

Employers are required to maintain detailed records of each job title and its wage history, and California’s labor commissioner can inspect those records. California can enforce the law through fines and can investigate violations. The reports won’t be published publicly under the new law.

[…]

The new law doesn’t require employers to post total compensation, meaning that companies can leave out information about stock grants and bonuses, offering an incomplete picture for some highly paid jobs.

For high-paying jobs in the technology industry, equity compensation in the form of restricted stock units can make up a large percentage of an employee’s take-home pay. In industries such as finance, bonuses make up a big portion of annual pay.

[…]

The new law also allows companies to provide wide ranges for pay, sometimes ranging over $100,000 or more between the lowest salary and the highest salary for a position. That seemingly violates the spirit of the law, but companies say the ranges are realistic because base pay can vary widely depending on skills, qualifications, experience and location.

[…]

Some California companies are not listing salaries for jobs clearly intended to be performed in other states, but advocates hope California’s new law could spark more salary disclosures around the country. After all, a job listing with an explicit starting salary or range is likely to attract more candidates than one with unclear pay.

[…]

Source: Here’s how much top tech jobs in California pay, according to job ads

Connected car security is very poor – fortunately they do actually take it seriously, fix bugs quickly

Multiple bugs affecting millions of vehicles from almost all major car brands could allow miscreants to perform any manner of mischief — in some cases including full takeovers —  by exploiting vulnerabilities in the vehicles’ telematic systems, automotive APIs and supporting infrastructure, according to security researchers.

Specifically, the vulnerabilities affect Mercedes-Benz, BMW, Rolls Royce, Ferrari, Ford, Porsche, Toyota, Jaguar and Land Rover, plus fleet management company Spireon and digital license plate company Reviver.

The research builds on Yuga Labs’ Sam Curry’s earlier car hacking expeditions that uncovered flaws affecting Hyundai and Genesis vehicles, as well as Hondas, Nissans, Infinitis and Acuras via an authorization flaw in Sirius XM’s Connected Vehicle Services.

All of the bugs have since been fixed.

“The affected companies all fixed the issues within one or two days of reporting,” Curry told The Register. ” We worked with all of them to validate them and make sure there weren’t any bypasses.”

[…]

Curry and the team discovered multiple vulnerabilities in SQL injection and authorization bypass to perform remote code execution across all of Spireon and fully take over any fleet vehicle.

“This would’ve allowed us to track and shut off starters for police, ambulances, and law enforcement vehicles for a number of different large cities and dispatch commands to those vehicles,” the researchers wrote.

The bugs also gave them full administrator access to Spireon and a company-wide administration panel from which an attacker could send arbitrary commands to all 15 million vehicles, thus remotely unlocking doors, honking horns, starting engines […]

[…]

With Ferrari, the researchers found overly permissive access controls that allowed them to access JavaScript code for several internal applications. The code contained API keys and credentials that could have allowed attackers to access customer records and take over (or delete) customer accounts.

[…]

a misconfigured single-sign on (SSO) portal for all employees and contractors of BMW, which owns Rolls-Royce, would have allowed access to any application behind the portal.

[…]

misconfigured SSO for Mercedes-Benz allowed the researchers to create a user account on a website intended for vehicle repair shops to request specific tools. They then used this account to sign in to the Mercedes-Benz Github, which held internal documentation and source code for various Mercedes-Benz projects including its Me Connect app used by customers to remotely connect to their vehicles.

The researchers reported this vulnerability to the automaker, and they noted that Mercedes-Benz “seemed to misunderstand the impact” and wanted further details about why this was a problem.

So the team used their newly created account credentials to login to several applications containing sensitive data. Then they “achieved remote code execution via exposed actuators, spring boot consoles, and dozens of sensitive internal applications used by Mercedes-Benz employees.”

One of these was the carmaker’s version of Slack. “We had permission to join any channel, including security channels, and could pose as a Mercedes-Benz employee who could ask whatever questions necessary for an actual attacker to elevate their privileges across the Benz infrastructure,” the researchers explained.

A Mercedes-Benz spokesperson confirmed that Curry contacted the company about the vulnerability and that it had been fixed.

[…]

vulnerabilities affecting Porsche’s telematics service that allowed them to remotely retrieve vehicle location and send vehicle commands.

Plus, they found an access-control vulnerability on the Toyota Financial app that disclosed the name, phone number, email address, and loan status of any customers. Toyota Motor Credit told The Register that it fixed the issue

[…]

Source: Here’s how to remotely takeover a Ferrari…account, that is • The Register

We Found Subscription Menus in Our BMW Test Car. And other models have different subscriptions. WTF BMW?

[…]

We were recently playing in the menus of a 2023 BMW X1 when we came across a group of screens offering exactly that sort of subscription. BMW TeleService and Remote Software Upgrade showed a message that read Activated, while BMW Drive Recorder had options to subscribe for one month, one year, three years, or “Unlimited.” Reactions from the Car and Driver staff were swift and emotional. One staff member responded to the menus with a vomiting emoji, while another likened the concept to a video-game battle pass.

We reached out to BMW to ask about the menus we found and to learn more about its plan for future subscriptions. The company replied that it doesn’t post a comprehensive list of prices online because of variability in what each car can receive. “Upgrade availability depends on factors such as model year, equipment level, and software version, so this keeps things more digestible for consumers,” explained one BMW representative.

Our X1 for example, has an optional $25-per-year charge for traffic camera alerts, but that option isn’t available to cars without BMW Live Cockpit. Instead of listing all the available options online, owners can see which subscriptions are available for their car either in the menus of the vehicle itself or from a companion app.

[…]

BMW USA may not want to confuse its customers by listing all its options in one place, but BMW Australia has no such reservations. In the land down under, heated front seats and a heated steering wheel are available in a month-to-month format, as is BMW’s parking assistant technology. In contrast, BMW USA released a statement in July saying that if a U.S.-market vehicle is ordered with heated seats from the factory, that option will remain functional throughout the life of the vehicle.

[…]

In 2019, BMW announced it would charge customers $80 per year for wireless Apple CarPlay. After considerable public backlash, BMW walked back the decision and instead offered the technology for free. BMW is wading into mostly uncharted waters here. The court of public opinion forced BMW to reverse a subscription in the past. If people decide these newer subscriptions are as egregious as the old ones, will they force BMW back again? Or will they instead stick to automakers who sell features outright?

Source: We Found Subscription Menus in Our BMW Test Car. Is That Bad?

If the hardware is there, then you bought it and should be allowed to have it. If it’s externally processed data (eg an updated database of streets and traffic cameras) then a subscription is fine.

John Deere signs right to repair agreement

As farming has become more technology-driven, Deere has increasingly injected software into its products with all of its tractors and harvesters now including an autopilot feature as standard.

There is also the John Deere Operations Center, which “instantly captures vital operational data to boost transparency and increase productivity for your business.”

Within a matter of years, the company envisages having 1.5 million machines and half a billion acres of land connected to the cloud service, which will “collect and store crop data, including millions of images of weeds that can be targeted by herbicide.”

Deere also estimates that software fees will make up 10 percent of the company’s revenues by the end of the decade, with Bernstein analysts pegging the average gross margin for farming software at 85 percent, compared to 25 percent for equipment sales.

Just like other commercial software vendors, however, Deere exercises close control and restricts what can be done with its products. This led farm labor advocacy groups to file a complaint to the US Federal Trade Commission last year, claiming that Deere unlawfully refused to provide the software and technical data necessary to repair its machinery.

“Deere is the dominant force in the $68 billion US agricultural equipment market, controlling over 50 per cent of the market for large tractors and combines,” said Fairmark Partners, the groups’ attorneys, in a preface to the complaint [PDF].

“For many farmers and ranchers, they effectively have no choice but to purchase their equipment from Deere. Not satisfied with dominating just the market for equipment, Deere has sought to leverage its power in that market to monopolize the market for repairs of that equipment, to the detriment of farmers, ranchers, and independent repair providers.”

[…]

The MoU, which can be read here [PDF], was signed yesterday at the 2023 AFBF Convention in San Juan, Puerto Rico, and seems to be a commitment by Deere to improve farmers’ access and choice when it comes to repairs.

[…]

Duvall said on a podcast about the matter that the MoU is the result of several years’ work. “As you use equipment, we all know at some point in time, there’s going to be problems with it. And we did have problems with having the opportunity to repair our equipment where we wanted to, or even repair it on the farm,” he added.

“It ensures that our farmers can repair their equipment and have access to the diagnostic tools and product guides so that they can find the problems and find solutions for them. And this is the beginning of a process that we think is going to be real healthy for our farmers and for the company because what it does is it sets up an opportunity for our farmers to really work with John Deere on a personal basis.”

[…]

Source: John Deere signs right to repair agreement • The Register

But… still gives John Deere access to their data for free?

This may also have something to do with the security of John Deere machines being so incredibly piss poor, mainly due to really bad update hygiene