Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 18 submissions in the queue.

Log In

Log In

Create Account  |  Retrieve Password


Site News

Join our Folding@Home team:
Main F@H site
Our team page


Funding Goal
For 6-month period:
2022-07-01 to 2022-12-31
(All amounts are estimated)
Base Goal:
$3500.00

Currently:
$438.92

12.5%

Covers transactions:
2022-07-02 10:17:28 ..
2022-10-05 12:33:58 UTC
(SPIDs: [1838..1866])
Last Update:
2022-10-05 14:04:11 UTC --fnord666

Support us: Subscribe Here
and buy SoylentNews Swag


We always have a place for talented people, visit the Get Involved section on the wiki to see how you can make SoylentNews better.

The Best Star Trek

  • The Original Series (TOS) or The Animated Series (TAS)
  • The Next Generation (TNG) or Deep Space 9 (DS9)
  • Voyager (VOY) or Enterprise (ENT)
  • Discovery (DSC) or Picard (PIC)
  • Lower Decks or Prodigy
  • Strange New Worlds
  • Orville
  • Other (please specify in comments)

[ Results | Polls ]
Comments:111 | Votes:113

posted by martyb on Monday April 29, @12:36AM   Printer-friendly

American Airlines keeps mistaking 101-year-old passenger for baby:

A 101-year-old woman keeps getting mistaken for a baby because of an error with an airline's booking system.

The problem occurs because American Airlines' systems apparently cannot compute that Patricia, who did not want to share her surname, was born in 1922, rather than 2022.

The BBC witnessed the latest mix-up, which she and the cabin crew were able to laugh off.

"It was funny that they thought I was only a little child and I'm an old lady!" she said.

But the centenarian says she would like the glitch to be fixed as it has caused her some problems in the past.

For example, on one occasion, airport staff did not have transport ready for her inside the terminal as they were expecting a baby who could be carried.

The glitch the BBC witnessed happened when Patricia was flying between Chicago and Marquette, Michigan - a flight this reporter was also travelling on.

"My daughter made the reservation online for the ticket and the computer at the airport thought my birth date was 2022 and not 1922," she told me.

"The same thing happened last year and they were also expecting a child and not me."

Patricia's seat was booked as an adult ticket.

Patricia was flying with her daughter, Kris.

But it appears the airport computer system is unable to process a birth date so far in the past - so it defaulted to one 100 years later instead.

The former nurse, who flies every year to see family and escape the cold winters, says on both occasions staff at American Airlines were kind and helpful, in spite of the confusion.

American Airlines has not responded to a request for comment.

The centenarian says she would like it to be fixed. On a previous flight, Patricia and her daughter were waiting inside the plane after other passengers had left, as airport staff had not arranged a wheelchair for her.

She says having her real age acknowledged would also be beneficial for Kris.

"I would like them to fix the computer as my poor daughter had to carry all our luggage and apparel almost a mile from one gate to the other," she said.

Next trip

Patricia travelled solo until she was 97, but has been reliant on help from her family since then.

"I have some trouble with my eyesight now so I wouldn't want to do it on my own," she said.

But she is adamant the IT problems will not put her off flying, and says she is looking forward to her next flight in the autumn.

By then she will be 102 - and perhaps by then the airline computers will have caught on to her real age.


Original Submission

posted by janrinok on Sunday April 28, @07:58PM   Printer-friendly
from the how-to-get-your-own-Boeing,-just-wait-near-an-airport-for-falling-parts dept.

Not Boeing again!

An emergency slide falls off a Delta Air Lines plane, forcing pilots to return to JFK in New York:

NEW YORK (AP) — An emergency slide fell off a Delta Air Lines jetliner shortly after takeoff Friday from New York, and pilots who felt a vibration in the plane circled back to land safely at JFK Airport.

Delta said that after takeoff the pilots got an alert about the emergency slide on the plane's right side and heard an unusual sound coming from that area of the Boeing 767 jet, which is listed as having been manufactured in 1990.

The Federal Aviation Administration said the crew reported a vibration.

Pilots declared an emergency so the flight could be be routed quickly back to the airport, and the plane landed and taxied to a gate under its own power, according to the airline.

There were 176 passengers, two pilots and five flight attendants on board the flight, which was scheduled to fly to Los Angeles. Delta said it put passengers on another plane to California.

Delta said the plane was removed from service for evaluation and it was cooperating with investigators and supporting efforts to find the slide.

"As nothing is more important than the safety of our customers and people, Delta flight crews enacted their extensive training and followed procedures to return to JFK," the airline said in a statement.


Original Submission

posted by hubie on Sunday April 28, @03:17PM   Printer-friendly

Arthur T Knackerbracket has processed the following story:

Meta's shares tumbled after company boss Mark Zuckerberg said the quiet bit out loud: it will take a while before AI bets start paying back the huge financial investments it is making.

At first glance, results for the first calendar quarter of 2024 looked promising. Revenue was up 27 percent year-on-year to $36.5 billion, operating profit almost doubled, climbing 91 percent to $13.8 billion, and operating margin jumped from 25 percent to 38 percent.

Analysts would also normally have looked kindly upon the 10 percent drop in headcount, down to 69,329 by March 31, 2024.

However, an otherwise rosy set of results was blighted first by the admission that Meta expects losses from its VR division, Reality Labs, to continue increasing – the operating loss was $3.8 billion for Q1 – and capital expenditure for 2024 is to increase from between $30-$37 billion to $35-$40 billion "as we continue to accelerate our infrastructure investments to support our artificial intelligence (AI) roadmap."

[...] It was not what analysts wanted to hear, and the company's stock was pummeled in after-hours trading. Having closed at $493.50, it stood at $424.56 at the time of writing, a fall of more than 14 percent.

Other companies in the tech sector have bet big on AI, and the hype around the technology has become relentless. Microsoft, for example, has poured billions into OpenAI and crowbarred the technology into many of its products, and is trying to convince customers of the value.

[...] That said, Meta does have a particular set of problems. The CEO pointed out that it usually takes a while for the company to monetize a new product, which is fair enough until considering the ongoing losses from Meta's Reality Labs division, which is responsible for the Quest VR headset line.

The Metaverse gamble has yet to pay off. The drop in value after the results could be an early sign that investors are unwilling to wait too long for AI revenues to come close to promises.


Original Submission

posted by hubie on Sunday April 28, @10:34AM   Printer-friendly

Arthur T Knackerbracket has processed the following story:

TSMC Readies Lower-Cost 4nm Manufacturing Tech: Up To 8.5% Cheaper

TSMC has unveiled its new 4 nm-class production technology, N4C, a new fabrication process set to enhance the company's 5nm-class production nodes by offering significant cost reductions and optimizing design efficiency.  

"We are not done with our 5nm and 4nm [technologies]," said Kevin Zhang, Vice President of Business Development at TSMC, at the company's North American Technology Symposium 2024, where the new process was revealed. "From N5 to N4, we have achieved 4% density improvement optical shrink, and we continue to enhance the transistor performance. Now we bring in N4C to our 4 nm technology portfolio. N4C allows our customers to reduce their costs by remove some of the masks and to also improve on the original IP design like a standard cell and SRAM to further reduce the overall product level cost of ownership." 

[...] The introduction of N4C is strategically important for TSMC as it provides a way for customers to significantly lower their production costs for a 4nm-class node, which may drive the adoption of this process technology among customers looking for relatively low costs. The new node promises a well-adjusted combination of power, performance, and area (PPA), making it an attractive option for many of TSMC's clients. 

Given the high costs associated with 3nm-class technologies and their relatively limited advantages over nodes like N4P in terms of performance and transistor density, N4C is positioned to be a popular choice.  

TSMC expects to start producing chips using the N4C technology in 2025. With six years of experience in 5 nm-class fabrication processes by then, the company anticipates that N4C will achieve good yields and maintain lower costs, reinforcing its appeal as a cost-effective manufacturing solution in the semiconductor industry. In fact, by 2025, many of the fab tools at 5nm-capable fabs will be depreciated, so N4C and similar nodes may actually be cost-effective.

Arthur T Knackerbracket has processed the following story:

TSMC Preps Cheaper 4nm N4C Process For 2025, Aiming For 8.5% Cost Reduction

While the bulk of attention on TSMC is aimed at its leading-edge nodes, such as N3E and N2, loads of chips will continue to be made using more mature and proven process technologies for years to come. Which is why TSMC has continued to refine its existing nodes, including its current-generation 5nm-class offerings. To that end, at its North American Technology Symposium 2024, the company introduced a new, optimized 5nm-class node: N4C.

[...] "This is a very significant enhancement, we are working with our customer, basically to extract more value from their 4 nm investment," Zhang said.

TSMC expects to start volume production of N4C chips some time next year. And with TSMC having produced 5nm-class for nearly half a decade at that point, N4C should be able to hit the ground running in terms of volume and yields.


Original Submission

posted by hubie on Sunday April 28, @05:49AM   Printer-friendly

https://apnews.com/article/ai-artificial-intelligence-principal-audio-maryland-baltimore-county-pikesville-853ed171369bcbb888eb54f55195cb9c

Athletic director used AI to frame principal with racist remarks in fake audio clip, police say
A high school athletic director in Maryland has been accused of using artificial intelligence to impersonate a principal on an audio recording that included racist and antisemitic comments, authorities said Thursday.

Scott Shellenberger, the Baltimore County state's attorney, said the case appears to be one of the first of its kind nationwide involving artificial intelligence that his office was able to find.

A professor from the University of Colorado-Denver told police that it "contained traces of AI-generated content with human editing after the fact, which added background noises for realism," court records stated.

A second opinion from a professor at the University of California-Berkley told police that "multiple recordings were spliced together," according to the records.

A Baltimore County detective found that Darien had used Large Language Models, such as OpenAI and Bingchat, which can "tell users what steps to take to create synthetic media," court documents stated.


Original Submission

posted by hubie on Sunday April 28, @01:07AM   Printer-friendly
from the the-advantage-of-an-old-school-hand-crank dept.

Over at his personal blog, Kevin Norman describes how he has modified his motorized standing desk to raise and lower on its own according to a schedule. His post DeskOps: Commanding My Desk with HTTP - How I Brought Hysteresis Problems to the Desk Where I Solve Hysteresis Problems goes into a fair amount of detail about how he went about wiring it up and the problems which arose and how he fixed them. The active part uses an ESP-32 based microcontroller to change the desk's height using the I²C protocol.

For those not familiar with hardware, I2C is the scheme by which most circuits use for inter-chip communication. In my desk controller, there is a microcontroller which writes data to a LCD driver chip, which in turn lights the correct segments on a 3 digit segmented LCD. How would I capture the data though? Easy, I thought! All I had do to was hook up to the same two pins the data sheet reported as being the i2c pins along with the grounds of the standing desk controller and my esp32, and I could then "sniff" the data that was being sent across the i2c bus, decode it, and then use that for something useful.

So away I went! I soldered two wires directly to the pins on the chip that were marked as the data pins (I am deeply sorry to anybody offended by my soldering job!), and soldered a third wire to a ground point on the board. I then connected those wires to an ESP32, and then went looking for somebody elses code to try to sniff the i2c data to see if this was even possible.

He even designed and 3D-printed an enclosure for this modification. It played a surprising role in this.


Original Submission

posted by mrpg on Saturday April 27, @08:20PM   Printer-friendly
from the AI-overlords dept.

You can now buy a flame-throwing robot dog for under $10,000

If you've been wondering when you'll be able to order the flame-throwing robot that Ohio-based Throwflame first announced last summer, that day has finally arrived. The Thermonator, what Throwflame bills as "the first-ever flamethrower-wielding robot dog" is now available for purchase. The price? $9,420.

Thermonator is a quadruped robot with an ARC flamethrower mounted to its back, fueled by gasoline or napalm. It features a one-hour battery, a 30-foot flame-throwing range, and Wi-Fi and Bluetooth connectivity for remote control through a smartphone.

[...] Flamethrowers are not specifically regulated in 48 US states, although general product liability and criminal laws may still apply to their use and sale. They are not considered firearms by federal agencies. Specific restrictions exist in Maryland, where flamethrowers require a Federal Firearms License to own, and California, where the range of flamethrowers cannot exceed 10 feet.


Original Submission

posted by mrpg on Saturday April 27, @03:45PM   Printer-friendly
from the weakest-link dept.

Broadband lobby groups prepare lawsuit, calling rules a "net fatality"

The Federal Communications Commission voted 3–2 to impose net neutrality rules today, restoring the common-carrier regulatory framework enforced during the Obama era and then abandoned while Trump was president.

The rules prohibit Internet service providers from blocking and throttling lawful content and ban paid prioritization. Cable and telecom companies plan to fight the rules in court, but they lost a similar battle during the Obama era when judges upheld the FCC's ability to regulate ISPs as common carriers under Title II of the Communications Act.

[...] FCC Republicans blasted the Democratic majority today. "The Internet in America has thrived in the absence of 1930s, command-and-control regulations by the government," Commissioner Brendan Carr said.

Carr, who spoke for more than half an hour, described how the FCC's net neutrality decisions were allegedly swayed by President Obama in 2015 and by President Biden this year. "The FCC has never been able to come up with a credible reason or policy rationale for Title II. It is all just shifting sands, and that is because the agency is doing what it's been told to do by the executive branch," Carr said.

Carr also blamed judges for giving the FCC too much power.

[...] In the weeks before the vote, some consumer advocates criticized what they see as a loophole in the rules that would let ISPs give faster speeds to certain types of applications as long as application providers don't have to pay for special treatment. They say the FCC should explicitly prohibit ISPs from speeding up applications instead of only enforcing a no-throttling rule that forbids slowing applications down. Others say the rules are just as strong as those enforced during the Obama era.

[...] Reinstating Title II also gives the FCC more authority to monitor Internet service outages, the agency said.


Original Submission

posted by janrinok on Saturday April 27, @10:59AM   Printer-friendly

https://www.multicians.org/shell.html

CTSS was developed during 1963 and 64. I was at MIT on the computer center staff at that time. After having written dozens of commands for CTSS, I reached the stage where I felt that commands should be usable as building blocks for writing more commands, just like subroutine libraries. Hence, I wrote "RUNCOM", a sort of shell driving the execution of command scripts, with argument substitution. The tool became instantly most popular, as it became possible to go home in the evening while leaving behind long runcoms executing overnight. It was quite neat for boring and repetitive tasks such as renaming, moving, updating, compiling, etc. whole directories of files for system and application maintenance and monitoring.

In the same vein, I also felt that commands should be usable as library subroutines, or vice versa. This stemmed from my practice (unique at the time) of writing CTSS commands in MAD (Michigan Algorithm Decoder), a simplified Algol-like language. It was much faster and the code was more maintainable than the IBM 7094 assembly code. Since I needed MAD friendly subroutine calls to access CTSS primitives, I wrote in assembly code a battery of interface subroutines, which very often mimicked CTSS basic command functions. Or I wanted to make commands out of subroutines which handled common chores. I felt it was an awkward duplication of effort. However, I did not go further in the context of CTSS.

Then in 64 came the Multics design time, in which I was not much involved, because I had made it clear I wanted to return to France in mid 65. However, this idea of using commands somehow like a programming language was still in the back of my mind. Christopher Strachey, a British scientist, had visited MIT about that time, and his macro-generator design appeared to me a very solid base for a command language, in particular the techniques for quoting and passing arguments. Without being invited on the subject, I wrote a paper explaining how the Multics command language could be designed with this objective. And I coined the word "shell" to name it.


Original Submission

posted by janrinok on Saturday April 27, @06:13AM   Printer-friendly
from the let's-go-build-that-railway,-all-218-miles-of-it dept.

"After years of promises and years of lip service, we finally have all the funding needed, all the approvals, all the permits, all the union workers, and there's only one thing left to do now to get this party started.

We need to build it. And that starts today."

U.S. Sen. Catherine Cortez Masto, D-Nev., April 22, Las Vegas.

It looks like America is going to get its first real high-speed rail train.

On Monday, April 22, U.S. Transportation Secretary Pete Buttigieg officially opened the start of the works for the Brightline West High-Speed Rail Project. The 218-mile rail line will operate between Las Vegas, Nevada, and Rancho Cucamonga, California, and will be a fully electric, zero-emission system.

The high-speed train should average an 186 miles an hour speed, bringing the overland travel time between Las Vegas and Los Angeles down from 4 to 2 hours. To do so, 195 miles (315 km) of new track needs to be laid down to exacting standards, on the mid-shoulder of Interstate 15. There will be stations in Las Vegas, Victor Valley, Hesperia and Rancho Cucamonga, California. The line should be fully operational by 2028, in time for the Olympic Games.

Funding, to the tune of 12 billion dollar, comes half from private industry, and half from the Federal Government ($6.5 billion in grants and financing). An estimated 35,000 jobs, including 10,000 direct union construction jobs, and 1,000 permanent jobs once the line is operational, are associated with the project initiated by Brightline, a company which already runs a train service between Miami and Orlando.

"Today answers the question that has been asked too often, likely," Buttigieg said during the groundbreaking ceremony.

"The question whether America can still build massive, forward-looking engineering marvels that make people's lives better for generations ... and this is just the start."


Original Submission

posted by janrinok on Saturday April 27, @01:28AM   Printer-friendly

The specific process by which Google enshittified its search (24 Apr 2024)

https://pluralistic.net/2024/04/24/naming-names/#prabhakar-raghavan

All digital businesses have the technical capacity to enshittify: the ability to change the underlying functions of the business from moment to moment and user to user, allowing for the rapid transfer of value between business customers, end users and shareholders:

Which raises an important question: why do companies enshittify at a specific moment, after refraining from enshittifying before? After all, a company always has the potential to benefit by treating its business customers and end users worse, by giving them a worse deal. If you charge more for your product and pay your suppliers less, that leaves more money on the table for your investors.

Of course, it's not that simple. While cheating, price-gouging, and degrading your product can produce gains, these tactics also threaten losses. You might lose customers to a rival, or get punished by a regulator, or face mass resignations from your employees who really believe in your product.

Companies choose not to enshittify their products...until they choose to do so. One theory to explain this is that companies are engaged in a process of continuous assessment, gathering data about their competitive risks, their regulators' mettle, their employees' boldness. When these assessments indicate that the conditions are favorable to enshittification, the CEO walks over to the big "enshittification" lever on the wall and yanks it all the way to MAX.

The Men Who Killed Google Search

https://www.wheresyoured.at/the-men-who-killed-google/

The story begins on February 5th 2019, when Ben Gomes, Google's head of search, had a problem. Jerry Dischler, then the VP and General Manager of Ads at Google, and Shiv Venkataraman, then the VP of Engineering, Search and Ads on Google properties, had called a "code yellow" for search revenue due to, and I quote, "steady weakness in the daily numbers" and a likeliness that it would end the quarter significantly behind.

For those unfamiliar with Google's internal scientology-esque jargon, let me explain. A "code yellow" isn't, as you might think, a crisis of moderate severity. The yellow, according to Steven Levy's tell-all book about Google, refers to — and I promise that I'm not making this up — the color of a tank top that former VP of Engineering Wayne Rosing used to wear during his time at the company. It's essentially the equivalent of DEFCON 1 and activates, as Levy explained, a war room-like situation where workers are pulled from their desks and into a conference room where they tackle the problem as a top priority. Any other projects or concerns are sidelined.

In emails released as part of the Department of Justice's antitrust case against Google, Dischler laid out several contributing factors — search query growth was "significantly behind forecast," the "timing" of revenue launches was significantly behind, and a vague worry that "several advertiser-specific and sector weaknesses" existed in search.

Anyway, a few days beforehand on February 1 2019, Kristen Gil, then Google's VP Business Finance Officer, had emailed Shashi Thakur, then Google's VP of Engineering, Search and Discover, saying that the ads team had been considering a "code yellow" to "close the search gap [it was] seeing," vaguely referring to how critical that growth was to an unnamed "company plan." To be clear, this email was in response to Thakur stating that there is "nothing" that the search team could do to operate at the fidelity of growth that ads had demanded.

Shashi forwarded the email to Gomes, asking if there was any way to discuss this with Sundar Pichai, Google's CEO, and declaring that there was no way he'd sign up to a "high fidelity" business metric for daily active users on search. Thakur also said something that I've been thinking about constantly since I read these emails: that there was a good reason that Google's founders separated search from ads.

On February 2, 2019, just one day later, Thakur and Gomes shared their anxieties with Nick Fox, a Vice President of Search and Google Assistant, entering a multiple-day-long debate about Google's sudden lust for growth. The thread is a dark window into the world of growth-focused tech, where Thakur listed the multiple points of disconnection between the ads and search teams, discussing how the search team wasn't able to finely optimize engagement on Google without "hacking engagement," a term that means effectively tricking users into spending more time on a site, and that doing so would lead them to "abandon work on efficient journeys." In one email, Fox adds that there was a "pretty big disconnect between what finance and ads want" and what search was doing.

When Gomes pushed back on the multiple requests for growth, Fox added that all three of them were responsible for search, that search was "the revenue engine of the company," and that bartering with the ads and finance teams was potentially "the new reality of their jobs."

On February 6th 2019, Gomes said that he believed that search was "getting too close to the money," and ended his email by saying that he was "concerned that growth is all that Google was thinking about."

[Ed's Comment: This is only the beginning of the story. Go to the link if you wish to read more.--JR]


Original Submission #1Original Submission #2

posted by janrinok on Friday April 26, @08:46PM   Printer-friendly

https://www.technologyreview.com/2024/04/24/1091740/chinese-keyboard-app-security-encryption/

Almost all keyboard apps used by Chinese people around the world share a security loophole that makes it possible to spy on what users are typing.

The vulnerability, which allows the keystroke data that these apps send to the cloud to be intercepted, has existed for years and could have been exploited by cybercriminals and state surveillance groups, according to researchers at the Citizen Lab, a technology and security research lab affiliated with the University of Toronto.

These apps help users type Chinese characters more efficiently and are ubiquitous on devices used by Chinese people. The four most popular apps—built by major internet companies like Baidu, Tencent, and iFlytek—basically account for all the typing methods that Chinese people use. Researchers also looked into the keyboard apps that come preinstalled on Android phones sold in China.

What they discovered was shocking. Almost every third-party app and every Android phone with preinstalled keyboards failed to protect users by properly encrypting the content they typed. A smartphone made by Huawei was the only device where no such security vulnerability was found.

In August 2023, the same researchers found that Sogou, one of the most popular keyboard apps, did not use Transport Layer Security (TLS) when transmitting keystroke data to its cloud server for better typing predictions. Without TLS, a widely adopted international cryptographic protocol that protects users from a known encryption loophole, keystrokes can be collected and then decrypted by third parties.

"Because we had so much luck looking at this one, we figured maybe this generalizes to the others, and they suffer from the same kinds of problems for the same reason that the one did," says Jeffrey Knockel, a senior research associate at the Citizen Lab, "and as it turns out, we were unfortunately right."

Even though Sogou fixed the issue after it was made public last year, some Sogou keyboards preinstalled on phones are not updated to the latest version, so they are still subject to eavesdropping.

This new finding shows that the vulnerability is far more widespread than previously believed.

[...] "The scale of this was really shocking to us," says Wang. "And also, these are completely different manufacturers making very similar mistakes independently of one another, which is just absolutely shocking as well."

The massive scale of the problem is compounded by the fact that these vulnerabilities aren't hard to exploit. "You don't need huge supercomputers crunching numbers to crack this. You don't need to collect terabytes of data to crack it," says Knockel. "If you're just a person who wants to target another person on your Wi-Fi, you could do that once you understand the vulnerability."

[...] One potential cause of the loopholes' ubiquity is that most of these keyboard apps were developed in the 2000s, before the TLS protocol was commonly adopted in software development. Even though the apps have been through numerous rounds of updates since then, inertia could have prevented developers from adopting a safer alternative.

The report points out that language barriers and different tech ecosystems prevent English- and Chinese-speaking security researchers from sharing information that could fix issues like this more quickly. For example, because Google's Play store is blocked in China, most Chinese apps are not available in Google Play, where Western researchers often go for apps to analyze.

Sometimes all it takes is a little additional effort. After two emails about the issue to iFlytek were met with silence, the Citizen Lab researchers changed the email title to Chinese and added a one-line summary in Chinese to the English text. Just three days later, they received an email from iFlytek, saying that the problem had been resolved.


Original Submission

posted by janrinok on Friday April 26, @04:03PM   Printer-friendly
from the feature-not-a-bug dept.

A GitHub flaw, or possibly a design decision, is being abused by threat actors to distribute malware using URLs associated with Microsoft repositories, making the files appear trustworthy:

While most of the malware activity has been based around the Microsoft GitHub URLs, this "flaw" could be abused with any public repository on GitHub, allowing threat actors to create very convincing lures.

Yesterday, McAfee released a report on a new LUA malware loader distributed through what appeared to be a legitimate Microsoft GitHub repositories for the "C++ Library Manager for Windows, Linux, and MacOS," known as vcpkg, and the STL library.

The URLs for the malware installers, shown below, clearly indicate that they belong to the Microsoft repo, but we could not find any reference to the files in the project's source code.

Finding it strange that a Microsoft repo would be distributing malware since February, BleepingComputer looked into it and found that the files are not part of vcpkg but were uploaded as part of a comment left on a commit or issue in the project.

[...] As the file's URL contains the name of the repository the comment was created in, and as almost every software company uses GitHub, this flaw can allow threat actors to develop extraordinarily crafty and trustworthy lures.

For example, a threat actor could upload a malware executable in NVIDIA's driver installer repo that pretends to be a new driver fixing issues in a popular game. Or a threat actor could upload a file in a comment to the Google Chromium source code and pretend it's a new test version of the web browser.

Originally spotted on Schneier on Security.

Recently: xz-style Attacks Continue to Target Open-Source Maintainers


Original Submission

posted by janrinok on Friday April 26, @11:14AM   Printer-friendly
from the its-no-longer-raining-cats-and-dogs dept.

FAA to require reentry vehicles licensed before launch

[....] In a notice published in the Federal Register April 17, the FAA's Office of Commercial Space Transportation announced it will no longer approve the launch of spacecraft designed to reenter unless they already have a reentry license. The office said that it will, going forward, check that a spacecraft designed to return to Earth has a reentry license as part of the standard payload review process.

[....] "Unlike typical payloads designed to operate in outer space, a reentry vehicle has primary components that are designed to withstand reentry substantially intact and therefore have a near-guaranteed ground impact as a result of either a controlled reentry or a random reentry,"

[....] "Therefore, it is crucial to evaluate the safety of the reentry prior to launch," the agency concluded in the notice. "This way, the FAA is able to work with the reentry operator to meet the required risk and other criteria."

The notice did not state what prompted the change. However, it comes after Varda Space Industries launched its first spacecraft in June 2023 but did not get a reentry license for it until February after months of effort and an earlier, rejected reentry license application. Varda's capsule safely landed at the Utah Test and Training Range a week after receiving the license.

[....] Commercial spacecraft reentries remain rare. The FAA currently lists only two active reentry licenses, one for Varda and the other for SpaceX's Dragon spacecraft. However, the FAA expects demand for those licenses to increase as more companies seek to return cargo or crew from space.

Catch a falling space junk, put it in your pocket, savor radioactive decay.


Original Submission

posted by hubie on Friday April 26, @06:30AM   Printer-friendly
from the in-the-Moog-for-some-Pi dept.

Gearnews has an article about use of Raspberry Pi microcomputers in digital signal processing (DSP) systems, observing that digital synthesizers are essentially computers in specialized housings. In addition to the complex software, there is a lot of work in making an enclosure with useful controls and displays. Increasingly manufacturers are building their synthesizers around the Raspberry Pi:

The biggest synthesizer manufacturer to make use of the Raspberry Pi is Korg. The Japanese synth company's Wavestate, Modwave and Opsix digital synths all make use of the Raspberry Pi Compute Module. (They're in the module versions too.)

In an article on the Raspberry Pi home page, Korg's Andy Leary sites price and manufacturing scale as the main reason Korg decided on these components. He also liked that it was ready to go as is, providing CPU, RAM and storage in a single package. "That part of the work is already done," he said in the article. "It's like any other component; we don't have to lay out the board, build it and test it."

The software for each instrument is, of course, custom. The Raspberry Pi, however, generates the sound. "Not everyone understands that Raspberry Pi is actually making the sound," said Korg's Dan Philips in the same piece. "We use the CM3 because it's very powerful, which makes it possible to create deep, compelling instruments."

These used to be designed with off-the-shelf parts from Motorola and Texas Instruments. However around 20 years ago, according to a Raspberry Pi link about Korg synthesizers, Linux entered synthesizer production scene.

Previously:
(2024) Berlin's Techno Scene Added to UNESCO Cultural Heritage List
(2021) The Yamaha DX7 Synthesizer's Clever Exponential Circuit, Reverse-Engineered
(2019) Moog Brings Back its Legendary Model 10 'Compact' Modular Synth
(2014) History of the Synthesizer - 50 Years


Original Submission