Dan Goodin reports via Ars Technica: A maximum severity vulnerability that allows hackers to hijack GitLab accounts with no user interaction required is now under active exploitation, federal government officials warned as data showed that thousands of users had yet to install a patch released in January. A change GitLab implemented in May 2023 made it possible for users to initiate password changes through links sent to secondary email addresses. The move was designed to permit resets when users didn't have access to the email address used to establish the account. In January, GitLab disclosed that the feature allowed attackers to send reset emails to accounts they controlled and from there click on the embedded link and take over the account. While exploits required no user interaction, hijackings worked only against accounts that weren't configured to use multi-factor authentication. Even with MFA, accounts remained vulnerable to password resets. The vulnerability, tracked as CVE-2023-7028, carries a severity rating of 10 out of a possible 10. The vulnerability, classified as an improper access control flaw, could pose a grave threat. GitLab software typically has access to multiple development environments belonging to users. With the ability to access them and surreptitiously introduce changes, attackers could sabotage projects or plant backdoors that could infect anyone using software built in the compromised environment. An example of a similar supply chain attack is the one that hit SolarWinds in 2021, infecting more than 18,000 of its customers. Other recent examples of supply chain attacks are here, here, and here. These sorts of attacks are powerful. By hacking a single, carefully selected target, attackers gain the means to infect thousands of downstream users, often without requiring them to take any action at all. According to Internet scans performed by security organization Shadowserver, more than 2,100 IP addresses showed they were hosting one or more vulnerable GitLab instances. In order to protect your system, you should enable MFA and install the latest patch. "GitLab users should also remember that patching does nothing to secure systems that have already been breached through exploits," notes Goodin.

Read more of this story at Slashdot.

An anonymous reader quotes a report from TechCrunch: Microsoft has changed its policy to ban U.S. police departments from using generative AI through the Azure OpenAI Service, the company's fully managed, enterprise-focused wrapper around OpenAI technologies. Language added Wednesday to the terms of service for Azure OpenAI Service prohibits integrations with Azure OpenAI Service from being used "by or for" police departments in the U.S., including integrations with OpenAI's text- and speech-analyzing models. A separate new bullet point covers "any law enforcement globally," and explicitly bars the use of "real-time facial recognition technology" on mobile cameras, like body cameras and dashcams, to attempt to identify a person in "uncontrolled, in-the-wild" environments. [...] The new terms leave wiggle room for Microsoft. The complete ban on Azure OpenAI Service usage pertains only to U.S., not international, police. And it doesn't cover facial recognition performed with stationary cameras in controlled environments, like a back office (although the terms prohibit any use of facial recognition by U.S. police). That tracks with Microsoft's and close partner OpenAI's recent approach to AI-related law enforcement and defense contracts. Last week, taser company Axon announced a new tool that uses AI built on OpenAI's GPT-4 Turbo model to transcribe audio from body cameras and automatically turn it into a police report. It's unclear if Microsoft's updated policy is in response to Axon's product launch.

Read more of this story at Slashdot.

Ecobee, the company that pioneered smart thermostats with its Ecobee Smart in 2008, has announced it will end online support for the device and its commercial counterpart, the Ecobee Energy Management System, on July 31, 2024. The move will disable internet-dependent features such as web portal control, smart integrations, and weather-related functionality, while basic HVAC control and scheduling will remain operational.

Read more of this story at Slashdot.

An anonymous reader shares a column: When Apple CEO Tim Cook and a bunch of his deputies take the virtual stage next week to announce new iPads, they're going to spend a lot of time talking about specs. If the rumors are true, we're going to get new iPad Pros with OLED screens and thinner bodies, new Airs with faster chips and a correctly placed front camera, and a couple of new accessories. Before they even launch, I feel confident telling you these are the best iPads ever. But after all these years, I still don't know how to tell you whether you should want an iPad. Or what you'd want to do with it. This has been true forever, of course. The iPad is the jack-of-all-trades in Apple's lineup, a terrific device in many ways that still feels increasingly redundant now that so many people have big phones and long-lasting laptops. Apple seems to have spent the last decade-plus enamored with the idea of the iPad as a shapeshifter -- a device that can be exactly what you need at any given time. The company loves that the iPad's use case is hard to pin down, that it means different things to different people. It's a fun, good, ambitious idea: The One Gadget To Rule Them All. The way to make that happen, though, is not to upgrade the chips or move the buttons or redesign the rounded corners. It's to focus less on the iPad itself and more on the things you attach to it. [...] The iPad is a screen and a processor, and everything else should be an add-on for whenever you need it. Give the gamers a controller and an external GPU. Give the music lovers a speaker dock, and give the smart home fanatics a bunch of buttons that connect to various devices. The photographers need lenses; the spreadsheeters need a keyboard with function keys. The Pencil and the Magic Keyboard are a start, but Apple needs to do much more. The company needs to spend less time worrying about the iPad itself -- a device famous for how long it lasts and that hardly anyone is using to its full potential -- and more time on how to make it more than just a tablet. (Plus, bonus for Apple: it's going to be a lot easier to get people to buy accessories than to convince them to upgrade their iPad when they don't need to.)

Read more of this story at Slashdot.

The FBI cut its warrantless searches of American data in half in 2023, according to a government report released on Tuesday. From a report: According to the Office of the Director of National Intelligence's annual transparency report, the FBI conducted 57,094 searches of "US person" data under Section 702 of the Foreign Intelligence Surveillance Act last year -- a 52 percent decrease from 2022. In a press briefing, a senior FBI official said that the drop was due to reforms the agency implemented in 2021 and 2022, The Record reports. Despite the drop in overall searches of Americans' data, the report also notes that the number of foreign targets whose data could be searched in the Section 702 database rose to 268,590, a 9 percent increase from the previous year. The number of "probable cause" targets also increased significantly, from 417 in 2022 to 759 in 2023. Of those, 57 percent are estimated to be "US persons," which includes US citizens and permanent residents.

Read more of this story at Slashdot.

Google is making its last attempt to fight back against a historic effort by the US Department of Justice to break the tech giant's grip on online search, as the most significant antitrust trial in 25 years comes to a close in Washington. From a report: A federal court in Washington began hearing closing arguments on Thursday after a 10-week trial in which the DoJ accused Alphabet, the parent company of Google, of suppressing search rivals by paying tens of billions annually for anti-competitive agreements with wireless carriers, browser developers and device manufacturers. During the hearing on Thursday, John Schmidtlein, a lawyer from Williams & Connolly representing Google, sought to push back on claims that it had hindered rivals' efforts to gain a foothold in online search, and argued that users had plenty of alternatives. Unsealed court documents revealed this week that Alphabet paid Apple $20bn in 2022 alone to be the default search engine for its iPhone and Safari browser on its other devices. "Google winning agreements because it has a better product is not a harm to the competitive process, even if it gives it scale to improve its product," Schmidtlein told the court. A lawyer for the government, Kenneth Dintzer, told the court that Google's "anti-competitive conduct harms competition and is self perpetuating." Defaults "are a powerful way to drive searches, otherwise Google wouldn't pay billions of dollars for them," he added. Amit Mehta, the judge hearing the case, noted that search "today looks a lot different than it didâ 10 to 15 years ago. He pushed back on the DoJ's contention that the quality of search had suffered due to the lack of competition, although he also noted that only two "substantial competitors" had entered the search market in the past decade. "Doesn't that tell us all we need to know in terms of barriers of entry," he asked.

Read more of this story at Slashdot.

Apple is tweaking how it applies a new fee that can apply to iOS developers in the European Union as it continues to configure its approach to the bloc's Digital Markets Act (DMA): Developers of free apps will be able to avoid the fee entirely under changes it announced Thursday, which apply from today, while other developers earning under a certain revenue threshold will get longer before they have to pay Apple the fee. From a report: The so-called "core technology fee" remains opt in for iOS developers in the region, as Apple continues to offer its standard business terms, but those wanting to take up new entitlements the DMA has required Apple to offer -- such as allowing sideloading of apps, third party app stores, and support for alternative payment tech than Apple's own -- must agree to the set of business terms that include the CTF (as Apple calls it). The fee remains under scrutiny in the region where the Commission, which enforces the DMA on Apple and other gatekeepers -- and opened its first investigations including on Apple in March -- is actively exploring whether the mechanism is enabling the iPhone maker to avoid its obligations to open up the App Store to competition, such as from third party app stores. But so far the EU hasn't prevented Apple from charging a fee.

Read more of this story at Slashdot.

Microsoft is fully rolling out passkey support for all consumer accounts today. From a report: After enabling them in Windows 11 last year, Microsoft account owners can also now generate passkeys across Windows, Android, and iOS. This makes it effortless to sign in to a Microsoft account without having to type a password in every time.

Read more of this story at Slashdot.

Alphabet paid Apple $20 billion in 2022 for Google to be the default search engine in the Safari browser, according to newly unsealed court documents in the Justice Department's antitrust lawsuit against Google. From a report: The deal between the two tech giants is at the heart of the landmark case, in which antitrust enforcers allege Google has illegally monopolized the market for online search and related advertising. The Justice Department and Google will offer closing arguments in the case Thursday and Friday, with a decision expected later this year. Google and Apple had hoped to shield the payment amount from public disclosure. At the trial last fall, Apple executives testified that Google paid "billions," without specifying a number. A Google witness later accidentally disclosed that Google pays 36% of the revenue it earns from search ads to Apple. Court documents filed late Tuesday ahead of the closing arguments mark the first public confirmation of the figures by Apple's senior vice president of services, Eddy Cue. Such numbers aren't disclosed by either company in their securities filings. The documents also revealed the importance of the payments to Apple's bottom line. For instance, in 2020, Google's payments to Apple constituted 17.5% of the iPhone maker's operating income.

Read more of this story at Slashdot.

Huawei, the Chinese telecommunications giant blacklisted by the US, is secretly funding cutting-edge research at American universities including Harvard through an independent Washington-based foundation. From a report: Huawei is the sole funder of a research competition that has awarded millions of dollars since its inception in 2022 and attracted hundreds of proposals from scientists around the world, including those at top US universities that have banned their researchers from working with the company, according to documents and people familiar with the matter. The competition is administered by the Optica Foundation, an arm of the nonprofit professional society Optica, whose members' research on light underpins technologies such as communications, biomedical diagnostics and lasers. The foundation "shall not be required to designate Huawei as the funding source or program sponsor" of the competition and "the existence and content of this Agreement and the relationship between the Parties shall also be considered Confidential Information," says a nonpublic document reviewed by Bloomberg. The findings reveal one strategy Shenzhen, China-based Huawei is using to remain at the forefront of funding international research despite a web of US restrictions imposed over the past several years in response to concerns that its technology could be used by Beijing as a spy tool.

Read more of this story at Slashdot.

Joshua Dean, a former quality auditor at Boeing supplier Spirit AeroSystems and one of the first whistleblowers to allege Spirit leadership had ignored manufacturing defects on the 737 MAX, died Tuesday morning after a struggle with a sudden, fast-spreading infection. Seattle Times: Known as Josh, Dean lived in Wichita, Kan., where Spirit is based. He was 45, had been in good health and was noted for having a healthy lifestyle. He died after two weeks in critical condition, his aunt Carol Parsons said. Dean had given a deposition in a Spirit shareholder lawsuit and also filed a complaint with the Federal Aviation Administration alleging "serious and gross misconduct by senior quality management of the 737 production line" at Spirit. Spirit fired Dean in April 2023, and he had filed a complaint with the Department of Labor alleging his termination was in retaliation for raising concerns related to aviation safety. Parsons said Dean became ill and went to the hospital because he was having trouble breathing just over two weeks ago. He was intubated and developed pneumonia and then a serious bacterial infection, MRSA. His condition deteriorated rapidly, and he was airlifted from Wichita to a hospital in Oklahoma City, Parsons said. There he was put on an ECMO machine, which circulates and oxygenates a patient's blood outside the body, taking over heart and lung function when a patient's organs don't work on their own.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Reuters: Microsoft said on Thursday it will invest $2.2 billion over the next four years in Malaysia to expand cloud and artificial intelligence (AI) services in the company's latest push to promote its generative AI technology in Asia. The investment, the largest in Microsoft's 32-year history in Malaysia, will include building cloud and AI infrastructure, creating AI-skilling opportunities for 200,000 people, and supporting the country's developers, the company said. Microsoft will also work with the Malaysian government to establish a national AI Centre of Excellence and enhance the nation's cybersecurity capabilities, the company said in a statement. Prime Minister Anwar Ibrahim, who met Nadella on Thursday, said the investment supported Malaysia's efforts in developing its AI capabilities. Microsoft is trying to expand its support for the development of AI globally. Nadella this week announced a $1.7 billion investment in neighboring Indonesia and said Microsoft would open its first regional data centre in Thailand. "We want to make sure we have world class infrastructure right here in the country so that every organization and start-up can benefit," Microsoft Chief Executive Satya Nadella said during a visit to Kuala Lumpur.

Read more of this story at Slashdot.

The Google Phone app is rolling out "Audio Emoji" to some users as part of an incoming update in the beta channel, version 128. As 9to5Google reports, they are "essentially stock sound effects attached to one of six different emoji." The list includes: clapping (applause), laughing, party, crying (trombone), poop, and sting (ba dum tss). From the report: When you, as the caller, select one of these "Audio Emoji," the Google Phone app will play a fun animation while a sound effect plays for a couple of seconds. The sound effect is heard on both ends of the phone call. There does seem to be a limit on how often you can use these sound effects, as there's a bit of a "cooldown" in between that prevents you from playing sounds back to back. That's probably for the best in the case of some of these.

Read more of this story at Slashdot.

A new battery from Energizer comes with "color alert technology" to alert parents if their child has swallowed one. When the coin lithium battery comes into contact with saliva, it activates a blue dye "so parents and caregivers know that medical attention could be required," reports the New York Times. The battery also features more secure packaging and a nontoxic bitter coating. From the report: The new coin lithium battery features more secure packaging, a nontoxic bitter coating to discourage swallowing and "color alert technology" that activates a blue dye when the battery comes into contact with moisture, like saliva, so parents and caregivers know that medical attention could be required. The new battery was announced in a video last week by Energizer and Trista Hamsmith, whose 18-month-old daughter died after swallowing a button battery from a remote control. Ms. Hamsmith founded a nonprofit organization focused on children's safety, successfully advocated for legislation, known as Reese's Law, that requires a secure compartment of the batteries in products that use them as well as stronger warning labels on all packaging, and is now working to make the batteries themselves safer. Ingested coin or button batteries result in thousands of emergency hospital visits each year, according to the U.S. Consumer Product Safety Commission, which notes that "the consequences of a child swallowing a battery can be immediate, devastating and deadly." "A button cell battery can burn through a child's throat or esophagus in as little as two hours if swallowed," according to the agency. Secure packaging and bitter coatings for batteries have long existed, but "the massive breakthrough here is the color alert technology, which helps give caretakers that indicator that something has happened," Jeff Roth, the global category leader for batteries at Energizer, said in an interview on Wednesday. "The most significant part about this is getting help early in the process," he said. "That's really what the color alert technology allows the family to do."

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica: A controversial bill that would require all new cars to be fitted with AM radios looks set to become a law in the near future. Yesterday, Senator Edward Markey (D-Mass) revealed that the "AM Radio for Every Vehicle Act" now has the support of 60 US Senators, as well as 246 co-sponsors in the House of Representatives, making its passage an almost sure thing. Should that happen, the National Highway Traffic Safety Administration would be required to ensure that all new cars sold in the US had AM radios at no extra cost. "Democrats and Republicans are tuning in to the millions of listeners, thousands of broadcasters, and countless emergency management officials who depend on AM radio in their vehicles. AM radio is a lifeline for people in every corner of the United States to get news, sports, and local updates in times of emergencies. Our commonsense bill makes sure this fundamental, essential tool doesn't get lost on the dial. With a filibuster-proof supermajority in the Senate, Congress should quickly take it up and pass it," said Sen. Markey and his co-sponsor Sen. Ted Cruz (R-Texas). About 82 million people still listen to AM radio, according to the National Association of Broadcasters, which as you can imagine was rather pleased with the congressional support for its industry. "Broadcasters are grateful for the overwhelming bipartisan support for the AM Radio for Every Vehicle Act in both chambers of Congress," said NAB president and CEO Curtis LeGeyt. "This majority endorsement reaffirms lawmakers' recognition of the essential service AM radio provides to the American people, particularly in emergency situations. NAB thanks the 307 members of Congress who are reinforcing the importance of maintaining universal access to this crucial public communications medium." "Requiring the installation of analog AM radios in automobiles is an unnecessary action that would impact EV range, efficiency and affordability at a critical moment of accelerating adoption," said Albert Gore, executive director of ZETA, a clean vehicle advocacy group that opposes the AM radio requirement. "Mandating AM radio would do little to expand drivers' ability to receive emergency alerts. At a time when we are more connected than ever, we encourage Congress to allow manufacturers to innovate and produce designs that meet consumer preference, rather than pushing a specific communications technology," Gore said in a statement.

Read more of this story at Slashdot.

New submitter berghem shares a report from The Guardian: For the first time, researchers have formally shown that exposure to toxic PFAS increases the likelihood of death by cardiovascular disease, adding a new level of concern to the controversial chemicals' wide use. The findings are especially significant because proving an association with death by chemical exposure is difficult, but researchers were able to establish it by reviewing death records from northern Italy's Veneto region, where many residents for decades drank water highly contaminated with PFAS, also called "forever chemicals." Records further showed an increased likelihood of death from several cancers, but stopped short of establishing a formal association because of other factors. [...] Veneto's drinking water was widely contaminated by a PFAS-production plant between 1985 and 2018. Researchers first found an excess of about 4,000 deaths during this period, or about one every three days. Part of the region was supplied with water from a different source, giving researchers the opportunity to compare records for tens of thousands of people who drank contaminated water and lived near those who did not. Though PFAS can affect the cardiovascular system in different ways, it is largely a problem because it produces stubbornly high and dangerous levels of cholesterol. The levels are difficult to control because they aren't caused by dietary or lifestyle choices that can be addressed with adjustments, but hormonal changes that affect the metabolism and the body's ability to control plaque in arteries. The study's authors suspect that post-traumatic stress disorder caused by the environmental disaster, which upended lives across the region, may also be contributing to circulatory disease. The evidence of a jump in kidney cancer was also "very clear," [said Annibale Biggeri, the peer-reviewed study's lead author, and a researcher with the University of Padua]. In the study's first five years, 16 cases were recorded, while 65 were recorded in the last five years. It also found elevated levels of testicular cancer during some time periods. The records "showed clearly" that earlier life exposures led to higher levels of mortality, except for women who have multiple children. Previous research has found levels were higher in women with only one child. The chemicals accumulate in placentas and are passed on to children during pregnancy, which reduces levels in the body. Mortality levels among women who were of child-bearing age were generally lower, but increased in older women. The chemicals will be passed down to children for generations, said Laura Facciolo, a Veneto resident who drank contaminated water. She said the findings underscore the need to ban PFAS, and the disaster's injustice. The findings have been published in the journal Environmental Health.

Read more of this story at Slashdot.

According to CNBC, Google is laying off at least 200 employees from its "Core" teams and moving some roles to India and Mexico. From the report: The Core unit is responsible for building the technical foundation behind the company's flagship products and for protecting users' online safety, according to Google's website. Core teams include key technical units from information technology, its Python developer team, technical infrastructure, security foundation, app platforms, core developers, and various engineering roles. At least 50 of the positions eliminated were in engineering at the company's offices in Sunnyvale, California, filings show. Many Core teams will hire corresponding roles in Mexico and India, according to internal documents viewed by CNBC. Asim Husain, vice president of Google Developer Ecosystem, announced news of the layoffs to his team in an email last week. He also spoke at a town hall and told employees that this was the biggest planned reduction for his team this year, an internal document shows. "We intend to maintain our current global footprint while also expanding in high-growth global workforce locations so that we can operate closer to our partners and developer communities," Husain wrote in the email. [...] "Announcements of this sort may leave many of you feeling uncertain or frustrated," Husain wrote in the email to developers. He added that his message to developers is that the changes "are in service of our broader goals" as a company. The teams involved in the reorganization have been key to the company's developer tools, an area Google is streamlining as it incorporates more artificial intelligence into the products.

Read more of this story at Slashdot.

Unity has appointed Matthew Bromberg, former CEO of Zynga, as its new CEO, president and board member. "Filling a role that has been temporarily filled by former Red Hat CEO Jim Whitehurst, Bromberg will formally join Unity as CEO on May 15," reports VentureBeat. "Whitehurst will serve as executive chair of the Unity board, and Roelof Botha will transition from chairman to lead independent board member." From the report: Bromberg fills a slot vacated by John Riccitiello, who resigned last fall after a pricing debacle that left game developers extremely angry at Unity. They calmed down after Unity walked back major parts of the price increase. It's an important time for Unity as it is about to ship Unity 6, the latest version of its game engine, in competition with Epic Games' Unreal Engine 5.4. Whitehurst will also return to Silver Lake, one of Unity's two largest shareholders, where he had previously been a senior advisor and will now join as a managing director leading both operating and investment team initiatives. Bromberg brings over 20 years of experience across the gaming industry, having previously served as Chief Operating Officer of leading mobile game developer and publisher Zynga, where he played a key role in the company's turnaround, and was responsible for Zynga's game studios globally, while also overseeing product development and design, technology, data, and analytics. Bromberg also held multiple leadership roles at Electronic Arts, where he helped scale the company's mobile division and led teams on four continents that built popular games across all major genres.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica: The Federal Communications Commission chair today made a final plea to Congress, asking for money to continue a broadband-affordability program that gave out its last round of $30 discounts to people with low incomes in April. The Affordable Connectivity Program (ACP) has lowered monthly Internet bills for people who qualify for benefits, but Congress allowed funding to run out. People may receive up to $14 in May if their ISP opted into offering a partial discount during the program's final month. After that there will be no financial help for the 23 million households enrolled in the program. "Additional funding from Congress is the only near-term solution for keeping the ACP going," FCC Chairwoman Jessica Rosenworcel wrote in a letter to members of Congress today. "If additional funding is not promptly appropriated, the one in six households nationwide that rely on this program will face rising bills and increasing disconnection. In fact, according to our survey of ACP beneficiaries, 77 percent of participating households report that losing this benefit would disrupt their service by making them change their plan or lead to them dropping Internet service entirely." The ACP started with $14.2 billion allocated by Congress in late 2021. The $30 monthly ACP benefit replaced the previous $50 monthly subsidy from the Emergency Broadband Benefit Program.

Read more of this story at Slashdot.