Vue normale

Il y a de nouveaux articles disponibles, cliquez pour rafraîchir la page.
Aujourd’hui — 3 juin 2024Flux principal

Cybercriminal Posed as 'Helpful' Stack Overflow User To Recommend Malware Hosted on PyPi

Par : EditorDavid
3 juin 2024 à 07:34
An anonytmous reader shared a recent report from BleepingComputer: Cybercriminals are abusing Stack Overflow in an interesting approach to spreading malware — answering users' questions by promoting a malicious PyPi package that installs Windows information-stealing malware... "We further noticed that a StackOverflow account 'EstAYA G' [was] exploiting the platform's community members seeking debugging help [1, 2, 3] by directing them to install this malicious package as a 'solution' to their issue even though the 'solution' is unrelated to the questions posted by developers," explained Sonatype researcher Ax Sharma in the Sonatype report. Sonatype's researcher "noticed that line 17 was laden with ...a bit too many whitespaces," according to the report, "in turn hiding code much further to the right which would be easy to miss, unless you notice the scroll bar. The command executes a base64-encoded payload..." And then, reports BleepingComputer... When deobfuscated, this command will download an executable named 'runtime.exe' from a remote site and execute it. This executable is actually a Python program converted into an .exe that acts as an information-stealing malware to harvest cookies, passwords, browser history, credit cards, and other data from web browsers. It also appears to search through documents for specific phrases and, if found, steal the data as well. All of this information is then sent back to the attacker, who can sell it on dark web markets or use it to breach further accounts owned by the victim.

Read more of this story at Slashdot.

Law Student Claims Unfair Discipline After He Reported a Data Breach

Par : EditorDavid
3 juin 2024 à 03:36
An anonymous Slashdot reader shared this report from Computer Weekly: A former student at the Inns of Court College of Advocacy (ICCA) says he was hauled over the coals by the college for having acted responsibly and "with integrity" in reporting a security blunder that left sensitive information about students exposed. Bartek Wytrzyszczewski faced misconduct proceedings after alerting the college to a data breach exposing sensitive information on hundreds of past and present ICCA students... The ICCA, which offers training to future barristers, informed data protection regulator the Information Commissioner's Office of a breach "experienced" in August 2023 after Wytrzyszczewski alerted the college that sensitive files on nearly 800 students were accessible to other college users via the ICCA's web portal. The breach saw personal data such as email addresses, phone numbers and academic information — including exam marks and previous institutions attended — accessible to students at the college. Students using the ICCA's web portal were also able to access ID photos, as well as student ID numbers and sensitive data, such as health records, visa status and information as to whether they were pregnant or had children... After the college secured a written undertaking from Wytrzyszczewski not to disclose any of the information he had discovered, it launched misconduct proceedings against him. He had stumbled across the files in error, he said, and viewed a significant number to ensure he could report their contents with accuracy. "The panel cleared Wytrzyszczewski and found it had no jurisdiction to hear the matter," according to the article. But he "said the experience caused him to unenroll from the ICCA's course and restart his training at another provider."

Read more of this story at Slashdot.

AI Researchers Analyze Similarities of Scarlett Johanssson's Voice to OpenAI's 'Sky'

Par : EditorDavid
3 juin 2024 à 01:34
AI models can evaluate how similar voices are to each other. So NPR asked forensic voice experts at Arizona State University to compare the voice and speech patterns of OpenAI's "Sky" to Scarlett Johansson's... The researchers measured Sky, based on audio from demos OpenAI delivered last week, against the voices of around 600 professional actresses. They found that Johansson's voice is more similar to Sky than 98% of the other actresses. Yet she wasn't always the top hit in the multiple AI models that scanned the Sky voice. The researchers found that Sky was also reminiscent of other Hollywood stars, including Anne Hathaway and Keri Russell. The analysis of Sky often rated Hathaway and Russell as being even more similar to the AI than Johansson. The lab study shows that the voices of Sky and Johansson have undeniable commonalities — something many listeners believed, and that now can be supported by statistical evidence, according to Arizona State University computer scientist Visar Berisha, who led the voice analysis in the school's College of Health Solutions and the College of Engineering. "Our analysis shows that the two voices are similar but likely not identical," Berisha said... OpenAI maintains that Sky was not created with Johansson in mind, saying it was never meant to mimic the famous actress. "It's not her voice. It's not supposed to be. I'm sorry for the confusion. Clearly you think it is," Altman said at a conference this week. He said whether one voice is really similar to another will always be the subject of debate.

Read more of this story at Slashdot.

Male Birth Control Gel Continues to Show Promise

Par : EditorDavid
2 juin 2024 à 23:38
Gizmodo reports there's been progress on a male birth-control gel "being developed with the help of several organizations, including the U.S. government's National Institute of Child Health and Human Development, part of the larger NIH." It's now being tested in a larger-scale Phase IIB trial, which involves around 400 couples. [Five milliliters of gel — about a teaspon — is applied to each shoulder blade once a day, reports NBC News.] That trial is still ongoing, but researchers have already begun to pore through some of the available data, which has provided encouraging results. In the summer of 2022, for instance, Diana Blithe, chief of the NICHD's Contraceptive Development Program, reported that the NES/T gel's efficacy rate so far appeared to be on par or even better than contraceptive hormonal options for women... The findings are still preliminary, and it will take more time for the full Phase II data to be collected and analyzed. But Blithe and her team have been encouraged by everything they've seen to date. In the team's early assessments, the gel appears to be both effective and safe, with minimal side effects for men taking it... Blithe and her colleagues are set to meet with the FDA next year about the steps needed to begin a larger Phase III trial and are still seeking a commercial partner to help bring the NES/T gel to the market. Initial findings also showed that the contraceptive worked faster than expected, Blithe said, according to NBC News. They add that at least three other companies are also working on male birth control: Also at the Boston conference on Sunday, YourChoice Therapeutics said a very small trial in the U.K. — just 16 men — showed that its nonhormonal pill, YCT-529, was safe and free of side effects. The San Francisco company's nonhormonal pill works by blocking the vitamin A receptor important for male fertility.YourChoice is planning a larger trial, according to CEO Akash Bakshi.

Read more of this story at Slashdot.

Hier — 2 juin 2024Flux principal

8BitDo's Reimagining of IBM's Model-M Keyboard Draws Reactions Online

Par : EditorDavid
2 juin 2024 à 22:38
"Few computer keyboards are as iconic, as influential, or as beige as the IBM Model-M," writes the blog OMG Ubuntu adding that it's "no surprise then that it's been given a modern reimagining by 8BitDo." Following on from their Nintendo NES and Famicom and Commodore 64 homages, 8BitDo has unveiled its latest retro-inspired mechanical keyboard. This one pays tribute to a true computing classic: the IBM Model-M keyboard. Lest anyone familiar with the real thing get too excited I'll mention up front that 8BitDo's Keyboard-M is a mechanical keyboard, using Kailh Box V2 white switches (swappable, of course) and not the buckling spring mechanism synonymous with the original. On Linux you can enable a buckling spring sound effect for every key press though, should you buy this and want the clatter to accompany it...! Like 8BitDo's other retro keyboards you can use this over Bluetooth, 2.4G wireless (USB adapter sits underneath), or wired. It has a built-in rechargeable 2000mAh Li-on battery that's good for 200 hours between charges. "It certainly looks the business," writes the Verge, "especially with the slick new wireless numpad / calculator combo pad 8BitDo will sell alongside it for another $44.99." And Ars Technica adds that "The M Edition's color scheme, chunkier build, and typeface selection, including on the Tab key with arrows and elsewhere, are nods to IBM's Model M," (noting that the Model M first succeeded the Model F keyboard in 1985). "Of course, the keyboard's naming, and the IBM behemoth and floppy disks strategically placed in marketing images, are notes of that, too..." "The M Edition also comes with the detachable A and B "Super Buttons" that connect to the keyboard via a 3.5 mm jack and are programmable without software." "The paint job is pretty faithful to the original," notes Windows Central, "with a combination of gray and white throughout, right down to the accurately recreated LED status panel in the right-hand corner. There are even two key caps with an IBM-inspired blue font on them. It's just tremendous." Ars Technica offers this advice to unconvinced purists: If you want a real Model M, there's a market of found and restored models available online and in thrift stores and electronics stores. For a modern spin, like USB ports and Mac support, Unicomp also makes new Model M keyboards that are truer to the original IBM design, particularly in their use of buckling spring switches.

Read more of this story at Slashdot.

Ozempic-Like Drugs Could Lower Sales of Junk Food

Par : EditorDavid
2 juin 2024 à 20:10
Will appetite-suppressing drugs hurt the sugar industry? Executives from Walmart warned that Ozempic and Zepbound "are impacting food sales," reports Bloomberg, "and multiple analyst surveys have showed that less-hungry customers are spending fewer dollars at grocery stores and restaurants." The drugs, which cut cravings, will result in a decline in calorie consumption in the US of 1.5% to 2.5% by 2035, with a drop of as much as 5% in the consumption of sweets such as baked goods, confectionery and soda, Morgan Stanley analysts including Pamela Kaufman said in a report last month. Morgan Stanley forecast about a 10th of the US population will be on the so-called GLP-1 medications — originally designed to treat diabetes but being used by many as a powerful weight-loss tool — by 2035... Even with tight supplies and sky-high prices limiting uptake of the medications, sales of GLP-1 drugs for both obesity and diabetes already exceeded $19 billion in 2023. The global obesity market alone could top $100 billion by the end of the decade, Goldman Sachs Group Inc. estimates, while Bloomberg Intelligence forecasts $80 billion of sales. More than 60% of US consumers taking the drugs said they had cut back on sweet treats like candy, ice cream and baked goods, and many said they had either significantly — or entirely — stopped eating those products, according to Morgan Stanley.

Read more of this story at Slashdot.

Is the New 'Recall' Feature in Windows a Security and Privacy Nightmare?

Par : EditorDavid
2 juin 2024 à 19:03
Slashdot reader storagedude shares a provocative post from the cybersecurity news blog of Cyble Inc. (a Ycombinator-backed company promising "AI-powered actionable threat intelligence"). The post delves into concerns that the new "Recall" feature planned for Windows (on upcoming Copilot+ PCs) is "a security and privacy nightmare." Copilot Recall will be enabled by default and will capture frequent screenshots, or "snapshots," of a user's activity and store them in a local database tied to the user account. The potential for exposure of personal and sensitive data through the new feature has alarmed security and privacy advocates and even sparked a UK inquiry into the issue. In a long Mastodon thread on the new feature, Windows security researcher Kevin Beaumont wrote, "I'm not being hyperbolic when I say this is the dumbest cybersecurity move in a decade. Good luck to my parents safely using their PC." In a blog post on Recall security and privacy, Microsoft said that processing and storage are done only on the local device and encrypted, but even Microsoft's own explanations raise concerns: "Note that Recall does not perform content moderation. It will not hide information such as passwords or financial account numbers. That data may be in snapshots that are stored on your device, especially when sites do not follow standard internet protocols like cloaking password entry." Security and privacy advocates take issue with assertions that the data is stored securely on the local device. If someone has a user's password or if a court orders that data be turned over for legal or law enforcement purposes, the amount of data exposed could be much greater with Recall than would otherwise be exposed... And hackers, malware and infostealers will have access to vastly more data than they would without Recall. Beaumont said the screenshots are stored in a SQLite database, "and you can access it as the user including programmatically. It 100% does not need physical access and can be stolen.... Recall enables threat actors to automate scraping everything you've ever looked at within seconds." Beaumont's LinkedIn profile and blog say that starting in 2020 he worked at Microsoft for nearly a year as a senior threat intelligence analyst. And now Beaumont's Mastodon post is also raising other concerns (according to Cyble's blog post): "Sensitive data deleted by users will still be saved in Recall screenshots... 'If you or a friend use disappearing messages in WhatsApp, Signal etc, it is recorded regardless.'" "Beaumont also questioned Microsoft's assertion that all this is done locally." The blog post also notes that Leslie Carhart, Director of Incident Response at Dragos, had this reaction to Beaumont's post. "The outrage and disbelief are warranted."

Read more of this story at Slashdot.

College-Level Minecraft-Based CS Courses Approved for US High School Students

Par : EditorDavid
2 juin 2024 à 17:52
Long-time Slashdot reader theodp writes: "This is truly game-changing news!" exclaims Minecraft Education's Laylah Bulman in a LinkedIn post targeting high school CS educators. "We're thrilled to announce that the AP Computer Science Principles with Minecraft and MakeCode Curriculum has officially been approved by The College Board! And we are offering free professional learning for our inaugural cohort this summer...! "Minecraft's highly engaging environment makes complex coding concepts relatable and fun, fostering a deeper understanding and encouraging broader participation. Ready to empower your students? Don't miss this opportunity!" Recent Edsurge articles (sponsored by Minecraft Education) touted how Minecraft has found its way into computer science and other curricula in New York City and Broward County (Florida), two of the nation's largest school districts... Microsoft-backed nonprofit Code.org has also pushed Minecraft-themed CS tutorials into the nation's classrooms via its wildly-popular annual Hour of Code events since 2015, a year after Microsoft paid $2.5B to buy Minecraft. ("The best way to introduce anyone to STEM or get their curiosity going on, it's Minecraft," declared Microsoft CEO Satya Nadella at the time). Minecraft-related learning initiatives have also received millions of dollars in grants from the U.S. Department of Education and the National Science Foundation.

Read more of this story at Slashdot.

A Simple Fix Could Double the Size of the U.S. Electricity Grid

Par : EditorDavid
2 juin 2024 à 16:34
"There is one big thing holding the United States back from a pollution-free electricity grid running on wind, solar and battery power," writes the Washington Post. "Not enough power lines... the nation's sagging, out-of-date power lines are being overwhelmed — slowing the transition to clean energy and the fight against climate change." But experts say that there is a remarkably simple fix: installing new wires on the high-voltage lines that already carry power hundreds of miles across the United States. Just upgrading those wires, new reports show, could double the amount of power that can flow through America's electricity grid... Most of America's lines are wired with a technology that has been around since the early 1900s — a core steel wire surrounded by strands of aluminum. When those old wires heat up — whether from power passing through them or warm outdoor temperatures — they sag. Too much sag in a transmission line can be dangerous, causing fires or outages. As a result, grid operators have to be careful not to allow too much power through the lines. But a couple of decades ago, engineers designed a new type of wire: a core made of carbon fiber, surrounded by trapezoidal pieces of aluminum. Those new, carbon-fiber wires don't sag as much in the heat. That means that they can take up to double the amount of power as the old lines. According to the recent study from researchers at UC-Berkeley and GridLab, replacing these older steel wires could provide up to 80 percent of the new transmission needed on the electricity grid — without building anything new. It could also cost half as much as building an entirely new line and avoid the headaches of trying to get every state, city and even landowner along the route to agree to a new project... If stringing new lines is so easy — and cheap — why hasn't it been done already? Part of the problem, experts say, is that utilities profit more from big infrastructure projects. Routine maintenance or larger-scale upgrades of the electricity grid don't help utilities make a lot of cash compared with building new transmission lines... Duncan Callaway, a professor of energy and resources at UC-Berkeley and one of the authors of the recent study, said that many transmission engineers are not used to thinking of rewiring as one of their tools. "But it's a much faster way," he said. Some changes are already underway to encourage this approach. For a long time, utilities had to undergo lengthy environmental reviews if they were rewiring a line longer than 20 miles. Earlier this month, the Federal Energy Regulatory Commission announced that those would no longer be necessary if utilities are simply replacing wires.

Read more of this story at Slashdot.

Did the US Government Ignore a Chance to Make TikTok Safer?

Par : EditorDavid
2 juin 2024 à 15:34
"To save itself, TikTok in 2022 offered the U.S. government an extraordinary deal," reports the Washington Post. The video app, owned by a Chinese company, said it would let federal officials pick its U.S. operation's board of directors, would give the government veto power over each new hire and would pay an American company that contracts with the Defense Department to monitor its source code, according to a copy of the company's proposal. It even offered to give federal officials a kill switch that would shut the app down in the United States if they felt it remained a threat. The Biden administration, however, went its own way. Officials declined the proposal, forfeiting potential influence over one of the world's most popular apps in favor of a blunter option: a forced-sale law signed last month by President Biden that could lead to TikTok's nationwide ban. The government has never publicly explained why it rejected TikTok's proposal, opting instead for a potentially protracted constitutional battle that many expect to end up before the Supreme Court... But the extent to which the United States evaluated or disregarded TikTok's proposal, known as Project Texas, is likely to be a core point of dispute in court, where TikTok and its owner, ByteDance, are challenging the sale-or-ban law as an "unconstitutional assertion of power." The episode raises questions over whether the government, when presented with a way to address its concerns, chose instead to back an effort that would see the company sold to an American buyer, even though some of the issues officials have warned about — the opaque influence of its recommendation algorithm, the privacy of user data — probably would still be unresolved under new ownership... A senior Biden administration official said in a statement that the administration "determined more than a year ago that the solution proposed by the parties at the time would be insufficient to address the serious national security risks presented. While we have consistently engaged with the company about our concerns and potential solutions, it became clear that divestment from its foreign ownership was and remains necessary." "Since federal officials announced an investigation into TikTok in 2019, the app's user base has doubled to more than 170 million U.S. accounts," according to the article. It also includes this assessment from Anupam Chander, a Georgetown University law professor who researches international tech policy. "The government had a complete absence of faith in [its] ability to regulate technology platforms, because there might be some vulnerability that might exist somewhere down the line."

Read more of this story at Slashdot.

There's a Program to Cancel Some Private US Student Loans. Most Don't Know About It.

Par : EditorDavid
2 juin 2024 à 14:34
The New York Times reports on a program to forgive U.S. student loans from private lenders — a kind of private parallel to a federal program which "allows those who were seriously misled by their schools to have their federal student loans eliminated." The problem? Eight U.S. senators complain the loan discharge process remains "burdensome and confusing" — and most students don't even know it exists. Navient, a large owner of private student loan debt, has created, but not publicized, a program that allows borrowers to apply to have their loans forgiven.... A nonprofit group of lawyers has stepped in ease the process: On Thursday, the Project on Predatory Student Lending, an advocacy group in Boston, published Navient's application form and an instruction guide for borrowers with private loans who are seeking relief on the grounds that their school lied to them... For nearly a decade, in the early 2000s, Navient — then known as Sallie Mae — struck deals with for-profit schools to issue private loans to their students. Lawsuits from state attorneys general later accused Navient of making those loans knowing that most would never be repaid. Many schools indemnified Navient for the private loans, agreeing to defray the company's loss if the loans defaulted. In 2022, Navient settled with 40 state attorneys general and canceled $1.7 billion in debt on those private loans — but only for borrowers who had already defaulted. Because those debts were unlikely to ever be repaid, the deal cost Navient only $50 million, the company said in regulatory filings. Borrowers who had kept paying their bills... remained stuck. But a pressure campaign from lawmakers, federal regulators and lawyers representing borrowers prompted the company to create the "school misconduct discharge." Navient began sending a 12-page application form this year to some borrowers who complained about their private loans. The document lists dozens of types of impropriety by schools — such as inflating job placement rates and graduates' earnings, or misrepresenting their educational programs — and asks borrowers to choose which apply to their experience. Applicants are required to submit documentation for their claims... [Navient's CEO, David Yowan] told investors on a conference call in January that Navient had put $35 million in reserve for losses on school misconduct claims. He cited "new regulatory expectations" as the reason. Navient has not disclosed how much of its $16.6 billion private student loan portfolio consists of loans that could be eligible for the debt cancellation program.

Read more of this story at Slashdot.

Are We Closer to a Cure for Diabetes?

Par : EditorDavid
2 juin 2024 à 11:34
"Chinese scientists develop cure for diabetes," reads the headline from the world's second-most widely read English-language newspaper. ("Insulin patient becomes medicine-free in just 3 months.") The researchers' results were published earlier in May in Cell Discovery, and are now getting some serious scrutiny from the press. The Economic Times cites a University of British Columbia professor's assessment that the study "represents an important advance in the field of cell therapy for diabetes," in an article calling it a "breakthrough" that "marks a significant advancement in cell therapy for diabetes." Chinese scientists have successfully cured a patient's diabetes using a groundbreaking cell therapy... According to a South China Morning Post report, the patient underwent the cell transplant in July 2021. Remarkably, within eleven weeks, he no longer required external insulin. Over the next year, he gradually reduced and ultimately stopped taking oral medication for blood sugar control. "Follow-up examinations showed that the patient's pancreatic islet function was effectively restored," said Yin, one of the lead researchers. The patient has now been insulin-free for 33 months... The new therapy involves programming the patient's peripheral blood mononuclear cells, transforming them into "seed cells" to recreate pancreatic islet tissue in an artificial environment. Their article calls it "a significant medical milestone" — noting that 140 million people in China have diabetes (according to figures from the International Diabetes Federation). Thanks to long-time Slashdot reader AmiMoJo for sharing the news.

Read more of this story at Slashdot.

China Successfully Lands Probe on the Moon's Far Side, Starts Collecting Samples

Par : EditorDavid
2 juin 2024 à 07:34
China's Chang'e-6 probe successfully lands on far side of the moon China's moon probe has "successfully touched down on the far side of the moon," CNN reports, in "a significant step for the ambitious mission that could advance the country's aspirations of putting astronauts on the moon" by 2030. The mission's ultimate goal is to return to Earth the first samples from the moon's far side, CNN reports. And China's lunar lander "is now expected to use a drill and a mechanical arm to gather up to 2 kilograms of moon dust and rocks from the basin, a crater formed some 4 billion years ago." To complete its mission, the lander will need to robotically stow those samples in an ascent vehicle that made the landing with it. The ascent vehicle will then return to lunar orbit, where it will dock with and transfer the samples to a re-entry capsule, according to mission information provided by the China National Space Administration. The re-entry capsule and orbiter will then travel back to Earth's orbit and separate, allowing the re-entry capsule to make its expected return later this month to the Siziwang Banner Landing Site in China's rural Inner Mongolia region. The mission began with its launch on May 3 — and is expected to last 53 days. The landing marks the second time a mission has successfully reached the far side of the moon. China first completed that historic feat in 2019 with its Chang'e-4 probe... The technically complex mission is made more challenging due to where it is being conducted. The far side of the moon is out of range of normal communications, which means Chang'e-6 must also rely on a satellite that was launched into lunar orbit in March, the Queqiao-2.

Read more of this story at Slashdot.

Could AI Replace CEOs?

Par : EditorDavid
2 juin 2024 à 03:34
'"As AI programs shake up the office, potentially making millions of jobs obsolete, one group of perpetually stressed workers seems especially vulnerable..." writes the New York Times. "The chief executive is increasingly imperiled by A.I." These employees analyze new markets and discern trends, both tasks a computer could do more efficiently. They spend much of their time communicating with colleagues, a laborious activity that is being automated with voice and image generators. Sometimes they must make difficult decisions — and who is better at being dispassionate than a machine? Finally, these jobs are very well paid, which means the cost savings of eliminating them is considerable... This is not just a prediction. A few successful companies have begun to publicly experiment with the notion of an A.I. leader, even if at the moment it might largely be a branding exercise... [The article gives the example of the Chinese online game company NetDragon Websoft, which has 5,000 employees, and the upscale Polish rum company Dictador.] Chief executives themselves seem enthusiastic about the prospect — or maybe just fatalistic. EdX, the online learning platform created by administrators at Harvard and M.I.T. that is now a part of publicly traded 2U Inc., surveyed hundreds of chief executives and other executives last summer about the issue. Respondents were invited to take part and given what edX called "a small monetary incentive" to do so. The response was striking. Nearly half — 47 percent — of the executives surveyed said they believed "most" or "all" of the chief executive role should be completely automated or replaced by A.I. Even executives believe executives are superfluous in the late digital age... The pandemic prepared people for this. Many office workers worked from home in 2020, and quite a few still do, at least several days a week. Communication with colleagues and executives is done through machines. It's just a small step to communicating with a machine that doesn't have a person at the other end of it. "Some people like the social aspects of having a human boss," said Phoebe V. Moore, professor of management and the futures of work at the University of Essex Business School. "But after Covid, many are also fine with not having one." The article also notes that a 2017 survey of 1,000 British workers found 42% saying they'd be "comfortable" taking orders from a computer.

Read more of this story at Slashdot.

Boeing Starliner Launched Scrubbed Until at Least Wednesday After Redundant Computer Issue

Par : EditorDavid
2 juin 2024 à 01:34
"The seemingly star-cross Boeing Starliner — within minutes of its long-delayed blastoff on the spacecraft's first piloted test flight — was grounded again Saturday," writes CBS News, "when one of three redundant computers managing the countdown from the base of the launch pad ran into a problem, triggering a last-minute scrub." More details from NPR: With 3:50 left in the countdown, the rocket's computer initiated a hold. The next launch attempt won't happen until at least Wednesday, NASA said. An issue with one of the three redundant computer systems at the base of the launch pad that are responsible for initiating the launch sequence prompted the automatic halt, said Tory Bruno, the head of United Launch Alliance, the government contractor trying to launch the Starliner. "We do require all three systems to be running — triple redundancy," ULA President and CEO Bruno said at a Saturday afternoon press briefing. "Those three big computers do a health check. ... Two came up normally. The third one came up, but it was slow to come up, and that tripped a red line that created an automatic hold." ULA engineers don't know why the computer halted, and will troubleshoot ground support equipment overnight, NASA said in an update on Saturday evening.

Read more of this story at Slashdot.

À partir d’avant-hierFlux principal

Federal Agency Warns (Patched) Critical Linux Vulnerability Being Actively Exploited

Par : EditorDavid
1 juin 2024 à 22:34
"The US Cybersecurity and Infrastructure Security Agency has added a critical security bug in Linux to its list of vulnerabilities known to be actively exploited in the wild," reported Ars Technica on Friday. "The vulnerability, tracked as CVE-2024-1086 and carrying a severity rating of 7.8 out of a possible 10, allows people who have already gained a foothold inside an affected system to escalate their system privileges." It's the result of a use-after-free error, a class of vulnerability that occurs in software written in the C and C++ languages when a process continues to access a memory location after it has been freed or deallocated. Use-after-free vulnerabilities can result in remote code or privilege escalation. The vulnerability, which affects Linux kernel versions 5.14 through 6.6, resides in the NF_tables, a kernel component enabling the Netfilter, which in turn facilitates a variety of network operations... It was patched in January, but as the CISA advisory indicates, some production systems have yet to install it. At the time this Ars post went live, there were no known details about the active exploitation. A deep-dive write-up of the vulnerability reveals that these exploits provide "a very powerful double-free primitive when the correct code paths are hit." Double-free vulnerabilities are a subclass of use-after-free errors...

Read more of this story at Slashdot.

How Facial Recognition Tech Is Being Used In London By Shops - and Police

Par : EditorDavid
1 juin 2024 à 21:34
"Within less than a minute, I'm approached by a store worker who comes up to me and says, 'You're a thief, you need to leave the store'." That's a quote from the BBC by a wrongly accused customer who was flagged by a facial-recognition system called Facewatch. "She says after her bag was searched she was led out of the shop, and told she was banned from all stores using the technology." Facewatch later wrote to her and acknowledged it had made an error — but declined to comment on the incident in the BBC's report: [Facewatch] did say its technology helped to prevent crime and protect frontline workers. Home Bargains, too, declined to comment. It's not just retailers who are turning to the technology... [I]n east London, we joined the police as they positioned a modified white van on the high street. Cameras attached to its roof captured thousands of images of people's faces. If they matched people on a police watchlist, officers would speak to them and potentially arrest them... On the day we were filming, the Metropolitan Police said they made six arrests with the assistance of the tech... The BBC spoke to several people approached by the police who confirmed that they had been correctly identified by the system — 192 arrests have been made so far this year as a result of it. Lindsey Chiswick, director of intelligence for the Met, told the BBC that "It takes less than a second for the technology to create a biometric image of a person's face, assess it against the bespoke watchlist and automatically delete it when there is no match." "That is the correct and acceptable way to do it," writes long-time Slashdot reader Baron_Yam, "without infringing unnecessarily on the freedoms of the average citizen. Just tell me they have appropriate rules, effective oversight, and a penalty system with teeth to catch and punish the inevitable violators." But one critic of the tech complains to the BBC that everyone scanned automatically joins "a digital police line-up," while the article adds that others "liken the process to a supermarket checkout — where your face becomes a bar code." And "The error count is much higher once someone is actually flagged. One in 40 alerts so far this year has been a false positive..." Thanks to Slashdot reader Bruce66423 for sharing the article.

Read more of this story at Slashdot.

Vehicle Electrification Could Require 55% More Copper Mines in the Next 30 Years

Par : EditorDavid
1 juin 2024 à 20:34
Long-time Slashdot reader schwit1 shares the announcement of a new report from the International Energy Forum: The seemingly universal presumption persists that the copper needed for the green transition will somehow be available... This paper addresses this issue by projecting copper supply and demand from 2018 to 2050 and placing both in the historical context of copper mine output... Just to meet business-as-usual trends, 115% more copper must be mined in the next 30 years than has been mined historically until now. To electrify the global vehicle fleet requires bringing into production 55% more new mines than would otherwise be needed... Our main purpose... is to communicate the magnitude of the copper mining challenge to the broader public that is less familiar with upstream resource issues. "On the other hand, hybrid electric vehicle manufacture would require negligible extra copper mining..." the report points out. Wikipedia describes the non-profit as a 73-country organization promoting dialogue about the world's energy needs. The group's announcement ends with a hope that the report "will promote discussion and formulation of alternative policies to be certain the developing world can catch up with the developed world while global initiatives advance with the green energy transition."

Read more of this story at Slashdot.

Connecteur 12V-2x6 sur des Radeon RX 7900 XT(X) : une première signée ASRock !

ASRock va présenter lors du Computex 2024 la semaine prochaine une nouvelle gamme de cartes graphiques AMD Radeon qui sort de l'ordinaire et pas que d'une seule manière. Leurs petits noms seront les ASRock Radeon RX 7900 XT WS et ASRock Radeon RX 7900 XTX WS. En quoi des RX 7900 XT(X) peuvent encore...

❌
❌