● 08.05.23

Gemini version available ♊︎

● Leftover Links 05/08/2023: Rust Holes and More Layoffs

Posted in News Roundup at 3:47 am by Dr. Roy Schestowitz

Leftovers

• Character study of the GoToSocial sloth, a future new member, when I’ll be drawing the group of mascots of the Fediverse.

Education

• When the Bellevue School District (BSD) opened its newest, state of the art elementary school on pristine wetlands and powered by geothermal energy in 2018, at a cost of $49 million, its principal did a welcoming dance in a video to show off the school.

• As she led the camera through the Microsoft Showcase school, showing classrooms that could be converted to learning pods for smaller or larger groups, she also pointed to teachers in a large group, waiting to teach kids.

• Today, however, issues of equity are dampening the shining reputation of the school—and raising questions about the district’s commitment to fairness.

Hardware

• The directorate-general of trade on Thursday said the government said the ban would also extend to all-in-one PCs and ultra-small form factor PCs and servers.

• A new regulation in India will require companies to obtain a license before importing personal computers, tablets and certain other electronics. India’s Ministry of Commerce and Industry announced the new rule today. It’s effective immediately, but an exception will reportedly be made for electronics that have already been ordered.

• The sudden licensing imposition has caught tech firms off guard.

• Apple Inc. beat modest Wall Street expectations for sales and profits in its fiscal third quarter, with strong iPhone sales in China helping compensate for a global decline in the smartphone market, but its third consecutive quarter of declining revenues was the longest losing streak the company has had since 2016.

Proprietary/Artificial Intelligence (AI)

• ChatGPT was released just nine months ago, and we are still learning how it will affect our daily lives, our careers, and even our systems of self-governance.

• But when it comes to how AI may threaten our democracy, much of the public conversation lacks imagination. People talk about the danger of campaigns that attack opponents with fake images (or fake audio or video) because we already have decades of experience dealing with doctored images.

Security

• Threat actors have been observed using Amazon Web Services ( AWS ) ‘s System Manager (SSM) agent as a Remote Access Trojan (RAT) on Linux and Windows machines.

• This is a cross-post of the official security advisory. The official advisory contains a signed version with our PGP key, as well.

• The Rust Security Response WG was notified that Cargo did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user.

• The Essence of Confidential Computing At its core, confidential computing addresses the vital need of safeguarding data while it is in use. SUSE and IBM work together to deliver advanced technical capabilities, like confidential computing. IBM Z® and LinuxONE systems provide key hardware capabilities for the trusted execution environment.

• The list of LOLBAS files – legitimate binaries and scripts present in Windows that can be abused for malicious purposes…

• Last week, my spam trap caught an e-mail with LNK attachment, which turned out to be quite interesting.

• Microsoft claims it has completely fixed a critical security issue in its Azure cloud platform, found in March by researchers from security firm Tenable, who then told Microsoft about it. Tenable chief executive and chairman Amit Yoran had claimed in a blog post on Wednesday that it took more than 90 days for Microsoft to effect a partial fix.

• This is a classic problem: One day, you create an account on a website (ex: an online shop), and later, this website is compromised. All credentials are collected and shared by the attacker. To reduce this risk, a best practice is to avoid password re-use (as well as to not use your corporate email address for non-business-related stuff).

• Exploitation of the Ivanti EPMM flaw CVE-2023-35078 is picking up as a new critical vulnerability tracked as CVE-2023-35082 is disclosed.

• Five Eyes government agencies have published a list of the software vulnerabilities that were most frequently exploited in malicious attacks in 2022.

• CISA disclosed 670 ICS vulnerabilities in the first half of 2023, but roughly one-third have no patches or mitigations from the vendor.

• Security updates have been issued by CentOS (bind and kernel), Debian (cjose, firefox-esr, ntpsec, and python-django), Fedora (chromium, firefox, librsvg2, and webkitgtk), Red Hat (firefox), Scientific Linux (firefox and openssh), SUSE (go1.20, ImageMagick, javapackages-tools, javassist, mysql-connector-java, protobuf, python-python-gflags, kernel, openssl-1_1, pipewire, python-pip, and xtrans), and Ubuntu (cargo, rust-cargo, cpio, poppler, and xmltooling).

• Onwuchekwa Nnanna Kalu, 39, a Nigerian National from Rivers State, Nigeria, pleaded guilty today to stealing $1.25 million from an investment firm located in Boston, through a business email compromise (“BEC”) scam. The plea was announced by U.S. Attorney Matthew M. Graves and Acting Special Agent in Charge David Geist, of the FBI Washington Field Office’s Criminal and Cyber Division.

• Nnanna Kalu pleaded guilty in the District of Columbia to one count of wire fraud. U.S. District Court Judge Randolph D. Moss scheduled a sentencing hearing for November 29, 2023. Kalu was arrested in 2022 and has been detained by the Court as a risk of flight.

• A news release issued by the Colorado Department of Higher Education is notifying the public of a “data incident.”

• KKTV 11 News is working to learn more about the situation, but the release reads as follows:

• The Colorado Department of Higher Education (“CDHE”) is providing notice of a cybersecurity incident that may involve the personal information of certain individuals. CDHE is providing information about the measures it has taken in response to the incident, and steps impacted individuals may take to protect themselves against possible misuse of information.

Privacy/Surveillance

• The legislation is also terrible on free speech and poses global risks.

Defence/Aggression

• Singaporean authorities executed Mohamed Shalleh Bin Abdul Latiff, a 39-year-old former delivery driver, Thursday for trafficking 54.04 grams of diamorphine, a controlled drug, which is four times the amount required to trigger the mandatory death penalty under Singapore’s Misuse of Drugs Act. Shalleh is the second person executed by the country in the last week.

• The U.S. military is considering putting armed personnel on commercial ships traveling through the Strait of Hormuz, in what would be an unheard of action aimed at stopping Iran from seizing and harassing civilian vessels. That’s what five American officials told The Associated Press on Thursday. If implemented, it would be an extraordinary step by the Pentagon as it grapples with a renewed effort by Iran to harass and seize ships traveling in the strait, through which 20% of all the world’s crude oil passes. Iran’s mission to the United Nations did not immediately respond to a request for comment from the AP about the U.S. proposal.

War in Ukraine

• Lithuania’s Defence Ministry will use 243 million euros raised from the so-called solidarity tax on banks to fund military infrastructure projects.

Environment

• A small city in China’s Hebei province, where some 130,000 people have been hit by torrential flooding, illustrates the plight of residents in the region around Beijing, which recorded its heaviest rainfall in at least 140 years after Typhoon Doksuri swept through.

• The heat wave that just won’t quit is bringing dangerously hot conditions from the Southern Plains to parts of the Mississippi River Valley, Gulf Coast, and increasingly, the Southwest, through the weekend.

• The big picture: Heat alerts are in effect for about 70 million people from Georgia to Kansas, as well as an area in Arizona and southeastern California.

Finance

• Popular bug bounty program HackerOne is laying off 12% of its workforce, CEO Mårten Mickos told employees earlier this week.

• There have been many rumors about conflicts of interest in the Debian Google Summer of Code and Outreachy internships. The only case where evidence has appeared is the former leader himself, the very person who started rumors about other mentors and I included.

• Yet conflicts of interest can come in many forms. One of the most bizarre cases I’ve seen was a pensions industry meeting in the UK.

• Representatives of pension administrators and government officials gathered in the town of Swindon. Rishi Sunak, who has recently become Prime Minister, attended the meeting in his former role as local authorities minister.

• One reason to be optimistic that U.S. inflation can fall without a recession: Many smaller nations that did move earlier than the Federal Reserve to hike interest rates have done exactly that.

• Why it matters: The unusual dynamics of a post-pandemic global economy appear to be making a so-called “immaculate disinflation” — one with minimal pain — more plausible than it once seemed based on the historical record.

• What they’re saying: “There are other economies we can also look to to get some sense of what’s likely to happen in the U.S. — other economies that were actually a lot faster in tightening monetary policy,” Jan Hatzius, chief economist at Goldman Sachs, said on a call with reporters last month.

• After massive layoffs earlier this year, technology giants have found one more item to slash: marketing budgets.

• Several large advertising companies reported a sharp cutback in spending from US tech and telecom companies, which had recently become some of the largest marketers in the world.

• According to news outlets, including CBC News, the company plans to cut approximately 6,000 jobs. 4,000 roles will be eliminated at Telus’ main business, with the remaining 2,000 affecting Telus International.

• President and CEO Darren Entwistle claimed that the reduction is being made with “a very heavy heart” and was prompted by the “evolving regulatory, competitive and macroeconomic environment.”

• “Against the backdrop of rapid transformation in our industry and the ways in which our customers want to engage with us, today we are announcing a significant investment in an extensive efficiency and effectiveness initiative across Telus,” Entwistle said in a news release obtained by CBC News.

• Employees overwhelmingly love the option to work from home. More than nine in 10 prefer it exclusively or as a hybrid arrangement, a Gallup study shows.

• Employers, on the other hand, don’t appear fully on board, as many are calling employees back into the office.

• In some ways, employers’ resistance to remote work is a mystery. After all, eliminating commutes gives the average U.S. employee almost one extra hour to work each day, according to research from the University of Chicago’s Becker Friedman Institute. Plus, staff forced to work in-office are more likely to experience burnout and low engagement, per Gallup.

AstroTurf/Lobbying/Politics

• Many political leaders are happy to show their softer, funnier side on these infotainment shows to engage the youth.

Censorship/Free Speech

Freedom of Information / Freedom of the Press

• Hong Kong pro-democracy media tycoon Jimmy Lai has been ordered to cover the costs of two legal challenges linked to his high-profile national security trial , after a local court ruled that his litigation conduct was “unreasonable.”

Monopolies

Patents

• Panasonic filed the claims at the end of July. A UPC search website run by patent attorney Joeri Beetz shows seven claims are now pending at the court of first instance. According to JUVE Patent information, Panasonic has filed the cases at the local divisions in Mannheim and Munich.

• Information for PCT applicants on the steps for entering the European phase will be available on the EPO website

• Unified is pleased to announce PATROLL crowdsourcing contest winners, Ekta Aswal and Dinesh Swamy, who split a cash award of $2,000 for their prior art submissions on U.S. Patent 8,836,784, owned by Monument Peak Ventures, an NPE and Dominion Harbor entity. The ‘784 patent generally relates to automotive imaging systems employing digital cameras that automatically transmits digital images in response to detecting an exception event.

• As with many other jurisdictions the fight over Novartis’ contested Fingolimod-patent (EP 2 959 894) (the “patent-in-suit”) is raging on in Denmark. Two recent cases from June and July yielded positive results for the patent proprietor in cases against Viatris and Zentiva respectively.

• The Brazilian PTO (BRPTO) released, on July 20, 2023, the report “5G Technology: Patent overview in the World and in Brazil”, with an overview of 5G Standard Essential Patent (SEP) applications.

Trademarks

• Here are three recent decisions under the mere descriptiveness prong of Section 2(e)(1): one opposition and two ex parte appeals. How do you think they came out? Answers will be found in the first comment.

*

• With Elon Musk’s rebranding of the app, is Twitter’s name really retired? What about tweets? We unravel the terminology puzzle.

Copyrights

• Google has said it will wait until the law is in place — expected by the end of the year — before it starts removing links to Canadian news from its platform.

• Andy Stone, a spokesman for Meta, said in a tweet on Wednesday: “As we’ve always said, the law is based on a fundamentally flawed premise. And, regrettably, the only way we can reasonably comply is to end news availability in Canada.”

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages. Permalink  Send this to a friend

----------

➮ Sharing is caring. Content is available under CC-BY-SA.