● 08.03.23

Gemini version available ♊︎

● Leftover Links 03/08/2023: Tor Browser 12.5.2 and LF Misportrayed as ‘Linux’

Posted in News Roundup at 10:34 am by Dr. Roy Schestowitz

Leftovers

• tl;dr: Adafruit publishes a wide range of writing and video content, including interviews and reporting on the maker market and the wider technology world. This document is intended as a guide to best practices that Adafruit uses, as well as an outline of the ethical standards Adafruit aspires to. While Adafruit is not an independent journalistic institution, Adafruit strives to be a fair, informative, and positive voice within the community.

• Amid the X launch, Yaccarino, who formerly went by @lindayaccs on the social media site, changed her handle to @lindayaX. Clever! But in the shuffle, it seems that no one at the company thought it might be a good idea to make her former username unavailable. Unsurprisingly, as caught by Gizmodo, a troll swooped in almost immediately to take Yaccarino’s old handle and transform it into a parody account.

Science

• If you program using values that represent anything in the real world, you have probably at least heard of the Kalman filter. The filter allows you to take multiple value estimates and process them into a better estimate. For example, if you have a robot that has an idea of where it is via GPS, dead reckoning, and an optical system, Kalman filter can help you better estimate your true position even though all of those sources have some error or noise. As you might expect, a lot of math is involved, but [Pravesh] has an excellent intuitive treatment based around code that even has a collaborative Jupyter notebook for you to follow along.

• To a lot of us, curve tracing seems to be one of those black magic things that only the true wizards understand. But as [DiodeGoneWild] explains, curve tracing really isn’t all that complicated, and it doesn’t even require specialized test instruments — just a transformer, a couple of resistors, and pretty much whatever oscilloscope you can lay your hands on.

Education

• The academic world demands nothing short of excellence, with an unyielding pressure to produce innovative and impactful research outcomes. A growing body of evidence indicates that academic and commercial research suffer from systemic issues that can have far-reaching consequences on researchers, including stress, burnout, and various emotional and physical health challenges. These can have a detrimental effect on the individual researcher, the quality of their research output, and the overall working environment. These challenges are even more pronounced for non-native speakers of English. Non-native English speakers who published an English-language paper report having to overcome much greater hurdles than their native English-speaking counterparts.

Hardware

• The Ethernet maxed out my 500Mbps Internet connection. I was able to quickly transfer files from between the SD card and the drives. All the USB gadgets I plugged in worked. Again, super boring – which is just what I wanted.

Health/Nutrition/Agriculture

• Some Americans are being hit harder than others by the extreme heat wave baking swaths of the country because they can’t get enough to eat or drink.

• But is compulsively checking the news the cause of our anxiety or a symptom of it? There’s some evidence to suggest the latter. The more anxious people are about something, the more inclined they are to seek out information about it, which sets off a vicious cycle because the more news they read, the more anxious they become. This pattern has been studied in Florida among people bracing themselves for Hurricane Irma in 2017. Those who spent more time reading or watching the news beforehand were more likely to believe that they would suffer post-traumatic stress as a result of the storm, which became a self-fulfilling prophecy. Similarly, at the beginning of the pandemic, research in Germany proved what every doom-scroller understands instinctively: the more frequently you check the news, the more time you spend reading and the more sources you consult, the more likely you are to feel depressed and anxious. Negative news can also cause us to catastrophise our personal worries.

• More than 100 medical journals across the world issued a rare joint call on Thursday for urgent action to eliminate nuclear weapons, warning that the threat of nuclear catastrophe was “great and growing”.

• The call comes with Russia repeatedly issuing thinly veiled warnings that Moscow could use nuclear weapons in Ukraine, as well as repeated North Korean missile tests and stalling efforts towards non-proliferation.

• An editorial published in numerous medical journals called on health professionals worldwide to alert citizens and leaders about “the major danger to public health” posed by nuclear weapons.

• Comparing the cognitive abilities of fostered and institutionalized children with those who grew up in home care, researchers found institutionalized children had relatively lower IQs at 18 years of age.

• In this latest research, scientists found a relationship between brain wave patterns and those IQ scores in the same data.

• In a new Viewpoint published in Environmental Science & Technology the researchers argue categorizing plastics, including micro- and nano-sized particles as PBT pollutants would give governments the tools they need to better manage plastic production, use and recycling.

• “We need to wake up the world and understand the risks of these pollutants,” says University of British Columbia (UBC) ocean researcher Dr. Juan José Alava, lead author of the paper that includes researchers from Canada, the United States, Europe, South America and Asia.

• In 2018, the VA’s EHR costs were initially projected to be $10 billion over 10 years but have grown to $50.8 billion over 28 years. These upticks have caused some lawmakers to want to shut down the project.

• There have been several bills introduced to end the program as issues with the EHR system continue. According to the publication, the VA’s Cerner EHR system led to the deaths of four patients, and it has suffered outages at facilities that have implemented it.

• “It has been a nightmare,” House Veterans’ Affairs Chair Mike Bost, R-Ill., told the publication.

Proprietary/Artificial Intelligence (AI)

• As generative AI models that take written prompts and turn them into images or more text continue to mature, computer scientists are looking into making other forms of media using machine learning.

• Audio is difficult for AI systems, especially music, since the software has to learn to produce coherent patterns over a number of minutes and be creative enough to generating something catchy or pleasant to listen to.

• Spend enough time with ChatGPT and other artificial intelligence chatbots and it doesn’t take long for them to spout falsehoods.

• Described as hallucination, confabulation or just plain making things up, it’s now a problem for every business, organization and high school student trying to get a generative AI system to compose documents and get work done. Some are using it on tasks with the potential for high-stakes consequences, from psychotherapy to researching and writing legal briefs.

• “A vulnerability has been discovered in Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core. This vulnerability impacts all supported versions – releases 11.10, 11.9 and 11.8. Older versions/releases are also at risk. This vulnerability is different from CVE-2023-35078, released on July 23,” the company said.

• “As of now we are only aware of the same limited number of customers impacted by CVE-2023-35078 as being impacted by CVE-2023-35081.”

• The advisory says the vulnerability allows a threat actor to take a variety of actions on a victim device and can be used in conjunction with the first bug to bypass administrator authentication.

• So-called behavioral advertising has repeatedly landed the Facebook and Oculus giant in hot water with privacy watchdogs in Europe. While the Instagram parent continues to argue that these types of ads — and the way the platform processes people’s data for generating advertising personalized to their interests and background — is legal under GDPR, on Tuesday Meta said it will adjust this practice.

Windows TCO

• The recently patched zero-day vulnerability affecting Ivanti’s Endpoint Manager Mobile (EPMM) product has been exploited by an advanced persistent threat (APT) group since at least April 2023.

• His harsh public critique of Microsoft — a relatively rare event for a high-profile corporate figure in cybersecurity — follows criticism from lawmakers and researchers alike after a recent cyberattack affecting U.S. government officials resulted from a Microsoft security lapse.

• As the CEO of Tenable, a firm that helps companies understand and mitigate their cybersecurity vulnerabilities, Yoran said he works with hundreds of companies every year to disclose and patch vulnerabilities. Microsoft, he said, consistently fails to proactively and professionally address vulnerabilities in their products.

• “In Microsoft’s case you have a culture which denies the criticality of vulnerabilities,” Yoran told CyberScoop in an interview.

• The US Securities and Exchange Commission adopted final rules around the disclosure of cybersecurity incidents. There are two basic rules: [...]

• In a move to prevent public companies from delaying news about cyberattacks, the US Security and Exchange Commission has set a four-day deadline to disclose “material cybersecurity incidents.” A US attorney general could potentially delay that disclosure if doing so would lead to “substantial risk to national security or public safety.” Otherwise, the rules will serve as a stiff new guidepost — albeit, one that’s slightly less restrictive than the EU’s GDPR cyberattack deadline of just three days.

• The news comes after Microsoft was criticized by security experts for taking weeks to confirm an attack against Outlook and other online services. “We really have no way to measure the impact [of the attack] if Microsoft doesn’t provide that info,” Jake Williams, a cybersecurity researcher and former NSA hacker, told the AP in June.

Linux Foundation

• Apple teams up with industry leaders to enhance OpenUSD, Pixar’s 3D scene technology. The Alliance for OpenUSD aims to standardise the 3D ecosystem, enabling efficient 3D project development across industries.

Security

• Threat actors are using Google AMP URLs in phishing campaigns as a new detection evasion tactic.

• Firefox 116 was released with patches for 14 CVEs, including nine high-severity vulnerabilities, some of which can lead to remote code execution or sandbox escapes.

• San Francisco startup Socket raises $20 million as investors continue to bet on companies in the open source software security category.

• A Russian government-linked hacking group took aim at dozens of global organizations with a campaign to steal login credentials by engaging users in Microsoft Teams chats pretending to be from technical support, Microsoft researchers said on Wednesday.

• These “highly targeted” social engineering attacks have affected “fewer than 40 unique global organizations” since late May, Microsoft researchers said in a blog, adding that the company was investigating.

• Google’s Project Zero has spent some time studying the Arm memory tagging extension (MTE), support for which was merged into the 5.10 kernel, and posted the results…

• In mid-2022, Project Zero was provided with access to pre-production hardware implementing the ARM MTE specification. This blog post series is based on that review, and includes general conclusions about the effectiveness of MTE as implemented, specifically in the context of preventing the exploitation of memory-safety vulnerabilities.

• Despite its limitations, MTE is still by far the most promising path forward for improving C/C++ software security in 2023. The ability of MTE to detect memory corruption exploitation at the first dangerous access provides a significant improvement in diagnostic and potential security effectiveness. In comparison, most other proposed approaches rely on blocking later stages in the exploitation process, for example various hardware-assisted CFI approaches which aim to block invalid control-flow transfers.

• Security updates have been issued by Debian (bouncycastle), Fedora (firefox), Red Hat (cjose, curl, iperf3, kernel, kernel-rt, kpatch-patch, libeconf, libxml2, mod_auth_openidc:2.3, openssh, and python-requests), SUSE (firefox, jtidy, libredwg, openssl, salt, SUSE Manager Client Tools, and SUSE Manager Salt Bundle), and Ubuntu (firefox).

• Minister of Health and Population Khaled Abdel-Ghaffar confirmed that the security agencies have dealt with the leak of the personal data of 2 million Egyptian patients which are being sold online.

• In statements to the local news website Cairo 24, Abdel-Ghaffar said the leak occurred two months ago, stressing that the authorities will take all necessary measures to protect the privacy of patients.

• The leak was first reported on 23 July by Falcon Feeds, a cyber security firm that tracks data breaches on the dark web.

• The National Information Technology Development Agency (NIDTA) has alerted the public of the activities of cyber criminals targeting important digital infrastructure in the country.

• This was disclosed via a press statement signed by the head of corporate affairs and external relations Mrs. Hadiza Umar this afternoon.

Privacy/Surveillance

• Section 702 allows the National Security Agency to capture emails, text messages and other digital information about foreigners without a warrant. Sometimes information from within the U.S. is collected, like when a resident communicates with a known target overseas. The FBI can access that data for operations like counterintelligence programs.

• The board emphasized that the three previously identified incidents of “intentional misconduct” by FBI personnel are “from among millions of FBI queries of Section 702 information and FBI has addressed the incidents appropriately.” Those incidents — and privacy concerns in general — have prompted Republican and Democratic lawmakers to push back against the Biden administration’s efforts to reauthorize the program.

• “Americans of all political stripes know their Constitutional rights shouldn’t disappear in the digital age,” Wyden says, adding that there is a “deep well of support” for enshrining protections against commercial data grabs by the government “into black-letter law.”

• The extent to which the NSA in particular uses data brokers to obtain location and web-browsing data is unclear, though the agency has previously acknowledged using data from “commercial” sources in connection with cyber defense. Regardless, the NSA’s lawyers have authored extensive guidelines for acquiring commercially available data, particularly when it belongs to US companies or individuals. Some of the rules prescribed by the agency’s lawyers remain classified.

• The size and scope of the government effort to accumulate data revealing the minute details of Americans’ lives are described soberly and at length by the director’s own panel of experts in a newly declassified report. Haines had first tasked her advisers in late 2021 with untangling a web of secretive business arrangements between commercial data brokers and US intelligence community members.

• What that report ended up saying constitutes a nightmare scenario for privacy defenders.

• But even if no one is looking to destroy your life or kill you and your family, there are plenty of good reasons to present different facets of your identity to different people. No one talks to their lover, their boss and their toddler in exactly the same way, or reveals the same facts about their lives to those people. Maintaining different facets to your identity is normal and healthy – and the opposite, presenting the same face to everyone in your life, is a wildly terrible way to live.

• None of this is controversial among social scientists, nor is it hard to grasp. But Zuckerberg stubbornly stuck to this anonymity-breeds-incivility doctrine, even as dictators used the fact that Facebook forced dissidents to use their real names to retain power through the threat (and reality) of arrest and torture: [...]

• But when a friend told me yesterday that it was a good thing I had left Twitter early, I felt bad that I still had that dormant account.

• I deleted it as soon as I got home.😺

• And then today, someone reminded me in the comments about my Reddit account. I deleted it as well.

• This release updates Firefox to 102.14.0esr, including bug fixes, stability improvements and important security updates. We also backported the Android-specific security updates from Firefox 116.

• [US Senator Jeff Merkley films the signage and what happens when he opts out of facial recognition at the TSA checkpoint at Reagan National Airport]Attempts by airlines, airports, and government agencies to make facial recognition mandatory for air travel, while pretending that it is “optional” or based on “consent”, are being challenged in both the United States and the European Union.

• In the US, the Transportation Security Administration continues to tell Congress and the public that it is “testing” facial recognition and that mug shots are optional for air travel.

• But Senators continue to question whether, as the TSA claims, this is really a “field demonstration” or actually a phased rollout,  and whether, “Providing this information is voluntary.”

• As one of the last negotiating sessions to finalize the UN Cybercrime Convention approaches, it’s important to remember that the outcome and implications of the international talks go well beyond the UN meeting rooms in Vienna and New York. Representatives from over 140 countries around the globe with widely divergent law enforcement practices, including Iran, Russia,  Saudi Arabia, China, Brazil, Chile, Switzerland, New Zealand, Kenya, Germany, Canada, the U.S., Peru, and Uruguay, have met over the last year to push their positions on what the draft convention should say about across border police powers, access to private data, judicial oversight of prosecutorial practices, and other thorny issues.

• As we noted in Part I of this post about the zero draft of the draft convention now on the table, the final text will result in the rewriting of criminal and surveillance laws around the world, as Member States work into their legal frameworks the agreed upon requirements, authorizations, and protections. Millions of people, including those often in the crosshairs of governments for defending human rights and advocating for free expression, will be affected. That’s why we and our international allies have been fighting for users to ensure the draft convention includes robust human rights protections.

• Going into the sixth negotiating session, which begins August 21 in New York, the outcome of the talks remains uncertain. A variety of issues are still unresolved, and the finalization of the intricate text faces approaching deadlines. The foundational principle of the negotiations—“nothing is agreed until everything is agreed upon”—underscores the complexity and delicate nature of these discussions. Every element of the draft convention is interrelated, and the resolution of one aspect hinges on the consonance of all other areas of the text.

• This is, of course, not Meta’s choice. They sidestepped the GDPR using Terms of Service trickery for as long as they could. Later, Meta bypassed legal constraints by arguing that the personalization of content and advertising was necessary to provide an agreed-upon service to users. When this became untenable, they circumvented the consent requirement by asserting that the company had a legitimate interest in showing targeted ads.

• While we welcome this shift, the company deserves few accolades

• But as they write in today’s announcement, recent court interpretations of the GDPR, as well as the incoming Digital Markets Act (DMA), have forced their hand.

• For several years, the government was able to route around the Fourth Amendment by turning cell service providers into proxy tracking devices. Thanks to the Third Party Doctrine, location data generated by cell phones wasn’t given an expectation of privacy.

Defence/Aggression

• Today we are talking about the Senegalese government blocking access to Tik Tok, of all apps. That’s a crazy sentence right there. The ridiculous app with the dance [sic] videos is somehow a threat to the stability of Senegal. Um, okay.

• There has to be more to the story. Let’s track back to how they got there.

• “Nine years ago, the IS [Islamic State] committed a genocide against the Yazidi people in Shengal [Sinjar]. The Yazidis themselves define this as the 74th genocide committed against them. Regrettably, thousands of Yazidis lost their lives or were taken captive, thus suffering unimaginably. We would like to once again honor the memory of those who lost their lives during the genocide and express that we share the pain of the Yazidi people. With great disgust we condemn the fascist IS gangs, these enemies of humanity, as well as their collaborators who committed the genocide. We would also like to renew our promise that as the Kurdish Freedom Movement we will stand by the people of Shengal in general and by the Yazidi people until the end. We will hold all those responsible for the suffering and the genocide to account.

• Since 12 December 2022, Azerbaijan and its ally, Turkey, have blockaded the Armenian Republic of Artsakh (Nagorno-Karabakh) in an attempt to possess the region by forcing the Armenians to flee their native land. This blockade of the 120,000 Armenian Christians is reaching a critical juncture. Food and medicine are running out, and starvation is beginning to set in. Currently, there is no fuel — which has led to a complete transportation shutdown. The Armenians of Artsakh are thus being forced into submission to Azerbaijan through a policy of starvation.

• Luis Moreno Ocampo, the founding prosecutor of the International Criminal Court (ICC), has called the ongoing Azeri blockade against Artsakh “Armenian genocide 2023.”

• Azerbaijan has a long history of ethnic cleansing Artsakh’s indigenous Armenian population.

• The most telling measure of that dynamic inside the GOP is that Trump remains the party’s central figure. Each time GOP voters and leaders have had the opportunity to move away from him—whether in the shock immediately after January 6, or the widespread disappointment over the poor performance of his handpicked candidates during the 2022 election—the party has sped past the off-ramp.

• Improvised munitions are not a direct replacement for the factory-made sort. But they have advantages. For one thing, they are cheap. Emanuel Zmudzinski, a Wild Bees volunteer in Lodz, Poland, makes the components—a nose cone, body and tail fin—for a 27cm-tall model called the Big Egg for less than €3.50 ($3.85), not including the explosive contents, on a 3D printer that cost around $1,200. With no need to retool production lines, candy bombs can be readily produced in different sizes. That helps drone operators make the best use of a given model’s payload capacity.

• The toppling of Mr Bazoum, who assumed office in 2021 in Niger’s first ever democratic transfer of power, has triggered an unprecedented crisis. The immediate worry is that it may ignite a regional war. Even if that danger is averted in the next few days, the putsch will almost certainly deal a crushing blow to efforts to fight the world’s most dangerous jihadist insurgency, which has claimed tens of thousands of lives in the three core countries in the Sahel: Burkina Faso, Mali and Niger.

• One of history’s biggest non-nuclear explosions rocked Beirut on August 4, 2020, destroying swathes of the Lebanese capital, killing more than 220 people and injuring at least 6,500.

• Three years on, the probe into the traumatic disaster caused by a huge pile of poorly-stored fertiliser remains bogged down in legal and political wrangling, to the dismay of victims’ families.

• “I really don’t think that’s a valid argument,” he said. “As the indictment says, they’re not attacking his First Amendment right. He can say whatever he wants. He can even lie. He can even tell people that the election was stolen when he knew better.”

• “But that does not protect you from entering into a conspiracy,” he continued. “All conspiracies involve speech, and all fraud involves speech. So, you know, free speech doesn’t give you the right to engage in a fraudulent conspiracy.”

• Advocates have long made a safety argument – that the absence of a license hasn’t kept unauthorized immigrants off the road, so it’s better to have them certified. At the same time, some other states are home to powerful opposition to the idea of allowing these licenses, arguing they reward illegal immigration and could undermine national security.

• “The fastest and most effective way to resolve this recruiting crisis is to change how we recruit,” wrote Joe Plenzler, a retired Marine lieutenant colonel. Plenzler called for something in between an all-volunteer force and a fully conscripted force. The US draft was abolished in 1973 after years of conscripted Americans being killed in the Vietnam War.

• “We should have our military recruiters sign up new troops for 11 months out of the year, and then have the Selective Service draft the delta between the military’s needs and the total number recruited,” he wrote.

• Pence shot back Wednesday: “The American people deserve to know that President Trump and his advisers didn’t just ask me to pause. They asked me to reject votes, return votes, essentially to overturn the election.”

• Unidentified human remains have been found in the search for four army crew who are presumed dead following a helicopter crash off the Queensland coast.

• A MRH-90 Taipan chopper crashed off the north Queensland coast during the multinational Exercise Talisman Sabre last week.

• Niger, like many other African countries, is poverty-stricken: poor but rich in uranium. It is a landlocked country that lies in the Sahel, the arid region south of the Sahara that has faced growing insecurity amid the worsening effects of climate change.

• Mossad director David Barnea secretly visited Washington nearly two weeks ago for talks with senior White House and CIA officials about the Biden administration’s efforts to reach an agreement with Saudi Arabia that would include normalization between the kingdom and Israel, two U.S. sources told Axios.

• And I don’t just mean, oh we love the Brad Pitt movies and the whimsical images of Sunset Blvd (which by the way is way less whimsical in real life). No, I mean that Swedes really love the whole propagandized packaged-with-a-bloody-bow-on-top United States. There are more than a few cowboy-themed bars and restaurants in Stockholm. Hell, there’s even a TGI Friday’s. Some stores aim to peddle only American goods, which ultimately means they sell pop-tarts and peanut butter. Younger Swedes will adopt US slang, folding it into their Swedish sentences as awkwardly as one might try to fit a TGI Friday’s into a cobblestone and tree-lined promenade. They love Obama and hate Trump. And they will look on in disbelief as I slide out my soapbox and pull at their lofty misconceptions through a depressively realistic listing of all the American ills: no free healthcare, no free daycare, no vacation time (even unpaid), no free college, income inequality worse than imperial Rome, starvation wage jobs, absurd rent and housing prices, and the largest and most violent imperialist military the world has ever seen.

War in Ukraine

• The United States Senate, adopting a bill on defense spending for 2024, has approved the allocation of 228 million US dollars, or 208 million euros, for the strengthening of security cooperation with Latvia, Lithuania and Estonia, the Latvian Ministry of Defense confirmed August 1.

Transparency/Investigative Reporting

• The MPs called the U.S. secretary of state’s remarks that Julian Assange threatened U.S. national security “nonsense” and said the U.S. is only bent on revenge, reports Joe Lauria.

Environment

• “When you dump a huge amount of water onto a surface, even if you’re dumping it onto soil, there’s only so much the soil can absorb,” he said. The rest runs off, meaning a local watershed is capturing only a fraction of all of the rain that fell, Ford said. He points to the St. Louis region as an example, which is close to the anniversary of historic rainfall last year.

• The floods have spread since Typhoon Doksuri swept into southern China on Friday. The remnants of the typhoon have started drifting into northeast China after breaking a 140-year rainfall record in Beijing and dumping more than a year’s rain in Hebei province earlier this week.

• The Chennai meeting came days after energy ministers from the group — which represents more than 80 percent of global GDP and CO2 emissions — failed to agree on a roadmap to cut fossil fuels from the global energy mix during talks in Goa.

• That was seen as a blow to mitigation efforts, even as climate experts blame record global temperatures for exacerbating floods, storms and heatwaves.

• Major oil producers fear the impact of drastic mitigation on their economies, and Russia and Saudi Arabia were blamed for the lack of progress in Goa.

• Images of tourists fleeing from fires on the Greek island of Rhodesand wildfires raging out of control in Sicily have dominated the headlines in European media, raising questions about whether the Mediterranean regon will remain a popular destination for summer vacations.

• A TalkTV presenter co-hosts a YouTube show with the leader of a climate science denial group, on which he has called climate change a “paganistic religion” and said rising CO2 emissions will make the world “more green”.

• Andre Walker is a regular presenter at TalkTV – the channel launched by News UK in April 2022 – hosting several current affairs shows a week, including prime time fixtures “That Was the Woke that Was” and “Saturday Night Talkaway”.

Energy/Transportation

• When I think about why this might be the case, the word that immediately comes to mind is “slow”. But that’s not quite the exact reason. I think it’s because the experience of a long train journey is that it feels slow. Not as in it feels like it’s taking too long, instead, it feels slow because the journey is more relaxed.

• This may be just me. But when I get on a train, whether I’m trying to get somewhere urgently like a morning commute or a long journey where there isn’t really any rush, it’s like I’ve given myself an allocated amount of time to do whatever I want.

• Iran simply does not have enough natural gas, or a strong enough power grid, to keep all the lights on despite sitting on the second-largest reserves of natural [sic] gas in the world.

• And, as skeptical residents pointed out, much of Iran experiences blistering heat every year, especially in the south, which has already endured debilitating temperatures this summer.

• This is not the first instance of this vulnerability; last year we disclosed a series of these same types of issues, which we dubbed Frozen Heart vulnerabilities. These vulnerabilities, as we detailed in our earlier blog series, resulted from a mistake in the original bulletproofs paper. The mistake was in the paper for over four years before it was corrected last year in response to our disclosure.

• Since posting that blog series, Trail of Bits has continued research with Paul Grubbs (University of Michigan) and Quang Dao (Carnegie Mellon University) to review more codebases and proof systems for this issue, resulting in a paper recently accepted for publication at IEEE S&P 2023. The vulnerability in Incognito Chain was identified during this research.

Wildlife/Nature

• Dutch elm disease (DED) is a fungal disease caused by a member of the sac fungi (Ascomycota) affecting elm trees, and is spread by elm bark beetles. “They hibernate beneath the foliage of dying or diseased trees until the temperature is appropriate,” Jürisoo said. The first symptom of infection is usually an upper branch of the tree starting to wither and yellow in summer. “But nobody is concerned if a few branches dry up.” This morbidity then spreads throughout the tree, with further dieback. Eventually, the roots die, starved of nutrients from the leaves.

Overpopulation

• In 2021, Iranian authorities approved new legislation that imposes further restrictions on abortions, bans the free distribution of contraceptives by the public health-care system, and provides added state benefits to families with more children.

Finance

• As soon as Lisa Casteel learned her 78-year-old mother had agreed to sell her Kansas City home to a “We Buy Ugly Houses” franchise for far below its market value, she contacted the buyer to halt the deal.

• In her letter to the company, she invoked a Kansas state law that grants three days to cancel certain sales agreements. She believed it would protect her mother and any other vulnerable homeowners entangled by questionable real estate deals. Her mother had no other place to live and had recently been showing signs of dementia, she said.

• HackerOne, a widely known bug bounty and penetration testing platform, is cutting up to 12% of its workforce as the global economic slowdown continues to impact the tech community.

• The San Francisco-based startup announced its layoffs on Wednesday, TechCrunch learned and confirmed with the startup. The decision will impact the startup’s employees worldwide, including those in the U.S., Canada, the U.K., Netherlands and other countries, HackerOne CEO Marten Mickos said in an email to employees, which was also posted to the company’s blog.

• “This comes as disappointing news, as we’ve all built strong connections with our fellow Hackeronies. These actions are necessary to be successful long-term,” said Mickos. “We’ve designed this reduction in force as a one-time event. We don’t claim to have perfect visibility into our future financial performance or the macroeconomic climate, but we unequivocally wanted to take a single action and move forward with confidence.”

• Sales and customer success employees were let go in Ireland Wednesday, “as part of an ongoing effort to ensure we always have the right resources in place,” a spokesperson said. The cuts are separate from the companywide reduction announced in January, the spokesperson said. About 50 roles were impacted.

• Salesforce’s plans for reducing headcount by about 8,000 people by the end of fiscal 2024 are the company’s largest ever. The spokesperson declined to comment on whether any other countries or divisions will see additional headcount reductions.

• Let’s not get this out of proportion. According to the most-used list of tech job layoffs, so far this year about 11,500 have gone in the UK, all but about 500 in London, the rest in Birmingham, Bristol, and Edinburgh.

• The developer behind The Callisto Protocol, Striking Distance Studios, has laid off 32 employees from its staff. Questions began after several LinkedIn posts appeared, and the layoffs were later confirmed by the studio.

• In a statement to IGN, Striking Distance Studios said, “Striking Distance Studios and KRAFTON have implemented strategic changes that realign the studio’s priorities to better position its current and future projects for success.”

• The developer continued, “Unfortunately, these changes have impacted 32 employees. Honoring the invaluable contributions of each departing team member with material support in the form of outplacement services and meaningful severance packages is our top priority during this difficult moment.”

AstroTurf/Lobbying/Politics

• For months, supporters of Bill C-18, the Online News Act, assured the government that Meta and Google were bluffing when they warned that a bill based on mandated payments for links was unworkable and they would comply with it by removing links to news from their platforms. However, what has been readily apparent for months became reality yesterday: Meta is now actively blocking news links and sharing on its Facebook and Instagram platforms. The announcement does not reference Threads, but it would not surprise if news links are ultimately blocked on that platform as well. The company says that the blocking will take several weeks to fully roll out to all users, suggesting that it has learned from the over-blocking mistakes made in Australia and is proceeding more cautiously in Canada. By the end of the month, the world’s largest social media platform will become a news desert in Canada, with links to all news – both Canadian and foreign – blocked on the platform.

• As the General Data Protection Regulation (GDPR) sets the global standards for data protection law around the world, the DSA and DMA are arguably the most important pieces of digital legislation on regulating platforms in the last years. regulating platforms (the eCommerce Directive). The DSA has been called the “constitution for the [Internet],” while the DMA represents the European landmark attempt to rein in digital market abuses. EDRi has been working extensively alongside European Union (EU) policymakers in both regulations to ensure a human rights-centric regulation and reaffirm the open [Internet] as a public good. This includes the implementation and enforceability of both pieces of legislation.

• I write to request that your agencies take action to hold Microsoft responsible for its negligent cybersecurity practices, which enabled a successful Chinese espionage campaign against the United States government.

• In a letter published on Thursday and first reported by the Wall Street Journal, U.S. Senator Ron Wyden (D-OR) asked the Justice Department, Federal Trade Commission and Cybersecurity and Infrastructure Security Agency (CISA) to investigate whether the security practices of Microsoft allowed alleged Chinese government hackers to breach the email accounts of several officials – including U.S. Commerce Secretary Gina Raimondo, U.S. Ambassador to China Nicholas Burns and Assistant Secretary of State for East Asia Daniel Kritenbrink — ahead of their trip to China last month.

• “Government emails were stolen because Microsoft committed another error,” Wyden said. “Holding Microsoft responsible for its negligence will require a whole-of-government effort.”

• They said this kind of assault on democracy in America couldn’t happen. But it did. The idea Donald Trump would become president in 2016 was laughed at. It couldn’t happen in America. But it did. Brexit, an act of insanity, happened! Electors voted for all of this. Democracy is complex, fragile, and vulnerable and progressives are often complacent in its defence and sometimes compliant in its undoing.

• Many see this agreement as a change in China’s lending policy. The Chinese may be incorporating some aspects of Russia’s notion of the Global South, which promotes an economic future that relaxes basic notions of trade liberalism.

• Previously, the Allahabad High Court instructed the ASI not to begin the survey of the Gyanvapi mosque in Varanasi, as the matter was still under hearing after the Supreme Court postponed a detailed scientific survey by the ASI until 5 pm on July 26. The purpose of the survey was to determine if the mosque, located adjacent to the Kashi Vishwanath temple, was built on top of a temple.

• The court was responding to a plea against a district court order that directed the ASI to conduct the controversial survey.

Misinformation/Disinformation/Propaganda

• Last year, news was the third most popular type of content viewed, behind how-to videos and videos from the general public. Although news is up by four percentage points in the 2023 report, news had previously topped the list in 2021.

Censorship/Free Speech

• Just published, through our normal blind review process.

• Kagarlitsky’s arrest is a politically-motivated attack against one of the most vocal critics of Russian President Vladimir Putin’s full-scale invasion of Ukraine. It is also part of a broader campaign to clamp down on anti-war dissidents in Russia.

• As part of building its case against him, Federal Security Service (FSB) agents raided and interrogated at least three others associated with Rabkor (Worker Correspondent), an online leftist media platform Kagarlitsky edits.

• The organizer has stated that her goal is to show that religion [sic] is also part of politics.

• The ministry said it would not comment further “on the threat to the diplomatic service or what security measures are being taken, as this risks counteracting the purpose of the measures.”

• Turkish Justice Minister Yilmaz Tunc condemned the attack in a post on messaging platform X, formerly known as Twitter.

• Some unfortunate news. AZ Central reported yesterday that James Larkin, who was a free speech pioneer who built an alt-weekly newspaper empire, and then spun out the controversial classifieds ads site Backpage, died by suicide, one week before his latest trial.

• The gears of justice turn slowly, but they do turn. Late last year we discussed a delightful gentleman named Roland Macher, who goes by “Spanky”, because of course he does. Spanky was a restaurant owner and real estate businessman who found himself in prison for over 2 years because paying your taxes is hard or annoying or something. Either way, he didn’t do it. In jail, he wrote a book about how others should do business and called it Slumlord Millionaire. Some time after that, Netflix released a series called Dirty Money, focusing on bad people doing bad business. One episode that centered on possible real life replicant Jared Kushner was also titled Slumlord Millionaire. And because of that, Spanky sued, representing himself.

Freedom of Information / Freedom of the Press

• In Iran, two journalists have been sentenced to several years in prison for their reporting on the “Jin, Jiyan, Azadî” revolt. A revolutionary court in Tehran sentenced Nasim Sultanbeigi and Saeedeh Shafiei to four years in prison, said the Shargh newspaper, citing family members.

• Citing the “mind-boggling” scale of local media traffic in the UK, the report’s authors claimed that there is a path to sustainable revenue models, but that it will require a “transformation” from “its manufacturing past… to its digital service era”.

• And the report also predicted that “industrial print” will enter “its final phase” in the next three to five years – meaning media businesses will have no choice but to transform themselves into digital outfits.

• Police in Baden-Württemberg have struck a new blow against old suspects. The public prosecutor’s office wants to investigate who put the archive of the website, which was banned in 2017, online.

• Freiburg police on Wednesday carried out house searches at the homes of five people suspected of continuing to run Indymedia Linksunten. The website, popular with leftists, was banned by then-Federal Interior Minister Thomas de Maizière (CDU) on August 25, 2017. The occasion was the G20 summit in Hamburg that same year. According to the minister, the [Internet] platform played a significant role in the militant protests in the city.

Civil Rights/Policing

• Hundreds of Haitians have marched through the capital, Port-au-Prince, in protest at the reported abduction of an American nurse and her daughter. Alix Dorsainvil was working for El Roi Haiti, a nonprofit Christian ministry, when she and her daughter were seized by gunmen on Thursday, the organization said. El Roi Haiti, which runs a school and ministry in Port-au-Prince, said the two were taken from its campus. Witnesses said armed men burst into the clinic where she was working and seized her. Dorsainvil disappeared on the same day that the U.S. State Department issued a “do not travel advisory” in the country and ordered nonemergency personnel to leave Haiti amid growing security concerns.

• A US federal judge ruled on Monday that Idaho cannot enforce a ban on out-of-state abortion referrals, saying that such a prohibition would violate doctors’ First Amendment right to free speech. The block on enforcement will remain in effect while a lawsuit challenging a March letter from Idaho’s Attorney General Raúl Labrador continues.

• “It is a reminder that unfortunately, in too many communities, there is still lead in service lines,” El-Sayed said. “The main thing I’m hoping folks understand is that for pregnant people or children, we recommend people only drink tap water if it’s been run through a lead filter and that’s why we’re passing those filters out.”

• There is no safe level of lead in drinking water.”

• The survey highlighted gender bias in the business world as 97 per cent of the founders interviewed acknowledged that they were treated differently from their male counterparts. Most women founders interviewed have rated their funding experience as average, giving it a four out of 10.

• A 78-year-old Indian-American, Anil Varshney, has filed a lawsuit against a US firm, claiming that he was fired for speaking to his dying relative over a phone call in Hindi.

• The lawsuit has been filed against Parsons Corporation and also mentions US Defense Secretary Llyod J. Austin. It needs to be noted that Varshney had been working for the firm since 2002 and had even received accolades for his work.

• The lawsuit, filed in the Northern District of Alabama, claims that Varshney’s video call with his brother-in-law took place in an empty cubicle at the Huntsville office, lasting only about two minutes. However, Parsons accused him of committing a security violation by using the Facetime application at a classified worksite, leading to his termination. Varshney maintains that there was no policy prohibiting such calls, and he was wrongfully targeted.

• Furthermore, the lawsuit asserts that this unjust termination had significant consequences, as it blacklisted him from future work with the United States Missile Defense Agency. Varshney had been associated with the federal agency since 2002 and continued his employment at Parsons alongside it until 2022, achieving what the lawsuit describes as the American Dream.

• For years, we’ve pointed out that the FBI is more interested in easy wins than actually securing the nation. And for years, the FBI has maddeningly refused to take our harsh criticism into consideration. It has done its own thing, because of course it has. Who could possibly stop it? A mass violators of rights both domestic and foreign isn’t going to stop doing what it likes to do just because these actions are wrong.

Internet Policy/Net Neutrality

• While Elon Musk’s Starlink low Earth orbit (LEO) broadband technology is too expensive and capacity-constrained to seriously put a dent in US broadband problems, it’s helpful in low connectivity situations like disasters, select parts of rural America, or the war in Ukraine. But Musk’s growing power over the fledgling LEO satellite sector has started to worry global military leaders, according to the New York Times.

Digital Restrictions (DRM)

• Using a free browser is now more important than ever. We’ve written recently on this topic, but the issue we wrote about there was minor compared to the gross injustice Google is now attempting to force down the throats of web users around the world. The so-called “Web Environment Integrity” (WEI) is the worst stunt we’ve seen from them in some time. Beginning its life as an innocuous, if worrying, policy document posted to Microsoft GitHub, Google has now fast-tracked its development into their Chromium browser. At its current rate of progress, WEI will be upon us in no time.

• The grand old enshittification curve strikes again. Remember, as stated by Cory Doctorow, the process of enshittification entails these steps:

Monopolies

• Cory Doctorow, author, digital rights advocate, and co-editor of the blog Boing Boing, has launched a Kickstarter campaign for his next book, called The Internet Con: How To Seize the Means of Computation. “The book presents an array of policy solutions aimed at dismantling the monopolistic power of Big Tech, making the internet a more open and user-focused space,” writes Boing Boing’s Mark Frauenfelder. “Key among these solutions is the concept of interoperability, which would allow users to take their apps, data, and content with them when they decide to leave a service, thus reducing the power of tech platforms.”

• Microsoft is making a minor concession that allows customers with specific licenses to run Office wares in an AWS cloud – a week after Europe’s competition regulators decided to officially probe its biz policies and practices.

• The licensing tweak, first noticed by analyst Directions on Microsoft (DoM), in part reverses a licensing change made in 2019 that meant customers with perpetual licenses would need to buy fresh licenses to run those applications on AWS, Google Cloud or Alibaba infrastructure.

Copyrights

• I was reading Baldur’s recent piece about the transition taking place in open source — which I took notes on — and this excerpt talking about large language models (LLMs) stood out to me:

• Why give somebody credit for the lines of code you’ve adapted for your own project when you can get a language model to whitewash it and let you claim it as your own?

• “The days of Destiny 2 cheaters being free to engage in a wholesale assault on the Destiny 2 game and its community without fear of consequences are over.” That’s Bungie’s opening gambit in a brand-new lawsuit filed in a U.S. court this week. Alleging copyright infringement, DMCA violations, and civil RICO violations, among others, the complaint targets up to 50 developers, marketers, customer support staff, and sellers of Destiny 2 cheating software, Ring-1.

• 9anime.to, one of the world’s largest piracy sites, has suddenly rebranded to Aniwave.to. The unexpected change comes as a surprise to the streaming portal’s millions of users. According to the operators, the switch is motivated by site-blocking efforts and DMCA issues, but could there be more to the story?

• This is not a surprise, because the company made it clear it planned to do exactly this, but Meta has now begun the process of stopping links to news sources from appearing in Canada, something that Canadian Heritage Minister Pablo Rodriguez insisted would never happen. The company says it will take a few weeks to roll out fully, but in the meantime, Meta explains what this will actually look like.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages. Permalink  Send this to a friend

----------

➮ Sharing is caring. Content is available under CC-BY-SA.