Shared posts

31 Jan 21:18

Large object crashes through wall of woman's home, narrowly missing her. OHHH YEAH [Scary]

31 Jan 21:17

iPhone 14’s Emergency SOS via satellite Feature Potentially Saved Two Lives Who Got Lost While Taking A Detour

by Omar Sohail

iPhone 14’s Emergency SOS via satellite

Apple’s Emergency SOS via satellite available for the iPhone 14 series proves its usefulness once again when it potentially saved the lives of two women who got lost while attempting to find their way back through a detour. The incident occurred in British Columbia, and it is the first time that Apple’s emergency feature has been used in a province of Canada.

The lack of Apple’s Emergency SOS via satellite feature on the iPhone 14 meant that their detour could have taken hundreds of additional kilometers

A pair of women reportedly got lost on their trip back to Alberta on December 23, according to Times Colonist. iMore reports that an accident had happened on a highway, which for obvious reasons, had to be closed, forcing the two to take a detour through the Holmes Forest Service Road. Unfortunately, the service road that they took was unplowed, and they eventually got stuck.

It was later found that the two women got lost approximately 20 kilometers down the road, with no Wi-Fi or cellular service available, and that is where the iPhone 14’s Emergency SOS via satellite feature came in handy. Dwight Yochim, senior manager with British Columbia Search and Rescue, explains how it all happened below.

“Then it was basically a wall of snow and when they tried to get through it, they got stuck. There's no cell service there but one of them happened to have the new Apple phone that has the SOS in it and activated the SOS and to my knowledge, that's the first use of the SOS in British Columbia.”

iPhone 14’s Emergency SOS via satellite finds two lost people
The two people were 20 kilometers away from Highway 16 / Image Credits - Times Colonist

Yochim also talks about the consequences if any of the two women did not have an iPhone 14 on them. In short, they would have drifted away even further, which would take a long time to find the two travelers.

“If they didn't have this, what would have happened is eventually the family or their work would have said ‘hey, they didn't show up’ and so the search area would have been from wherever they were last seen to where they're supposed to be, and that could have been several hundred kilometres.”

When the iPhone 14 user activated the Emergency SOS via satellite, Yochim explained that the device sent a message to an Apple call centre which then contacted Northern 911, which is a call centre located in Canada. Shortly afterwards, Northern 911 activates a call to emergency services in British Columbia, providing all the necessary information, including the person’s GPS location.

The practicality of having emergency services on the phone is invaluable, which is likely why Qualcomm introduced compatibility with its Snapdragon 8 Gen 2 SoC. As a result, the forthcoming Samsung Galaxy S23 series will get satellite communication capabilities, competing directly with the iPhone 14 in this regard.

The post iPhone 14’s Emergency SOS via satellite Feature Potentially Saved Two Lives Who Got Lost While Taking A Detour by Omar Sohail appeared first on Wccftech.

31 Jan 21:16

"The Last of Us" may not be a work of fiction after all. Duke sucks [Obvious]

31 Jan 21:16

Backblaze Publishes Hard Drive Failure Rates For 2022, Almost 231K Drives Monitored

by Jason R. Wilson

Backblaze, one of the largest data storage cloud companies, has just revealed its yearly hard drive failure report, covering the data drives they use internally and with their partners and customers.

Backblaze reports hard drive failure over close to one decade of use to see the change over time

The company utilizes data drives from HGST, Seagate, Toshiba, and Western Digital, with drive sizes ranging between 4TB to 16TB. At the beginning of 2022, we discussed the life expectancy of HDDs, with Western Digital being the favored company out of the same list as consumers. Backblaze revealed the statistics for the second quarter of 2022 of the 29 different drive models they employed in August. Seagate showed the most noticeable change out of the listed HDDs, but the yearly reviews show the changes over time.

Andrew Klien, the author of the recent analysis and Backblaze's Principal Cloud Storage Evangelist, notes that at the end of last year, the company was managing 235,608 drives, with 4,299 as boot drives and 231,309 as data drives. The boot drives are excluded from the report as consumers more commonly use the data drives. Of the 231,309 drives, 388 were also removed because the company had used them for internal testing or had less than 60 physical units. At the end of the year, 230,921 HDDs were analyzed over 2022 to see the failure rate.

Backblaze Publishes Hard Drive Failure Rates For 2022, Almost 231K Drives Monitored 2

The above chart shows Backblaze's hard drives' failure rates over a year. The company used twenty-nine different models again, with Seagate's 14TB drive (ST14000NM0138) having a failure rate average of 5.7% of the 1,519 drives in use. Interestingly, the Seagate failure rate for those drives had an average failure age (in months) of 24.8. The lowest percentage in hard drive failure was also from Seagate, with their 8TB hard drive (ST8000NM000A) with no losses over last year. There were 79 drives used from that model with the least amount of days in use. Backblaze notes that the 8TB Seagate drives were utilized as spare drives for any of the 8TB drives that did fail.

Two models had the most considerable amount of average days, with one from Seagate (6TB, ST6000DX000) and one from Toshiba (4TB, MD04ABA400V). Both had over 90 months on average and heightened failure rates between the two, even though Toshiba only had 94 drives in use and Seagate had 886. Seagate's impressive eight-year timespan with a less than 1% annual failure rate says a lot for the manufacturer, especially with almost eight times the number of drives.

Backblaze Publishes Hard Drive Failure Rates For 2022, Almost 231K Drives Monitored 3

Over the last three years, the average failure rate rose by 0.44%, which Backblaze attributed to the age of drives early in their report. However, the company breaks down the analysis further to see if that is the case for the increase in average failure rate, starting with drive size and failure.

Backblaze Publishes Hard Drive Failure Rates For 2022, Almost 231K Drives Monitored 4

The drives are split into two categories — one for drives 10TB and under in capacity and those for 12TB and above. The average failure rate in smaller drives increased by 0.85%, while the larger drives saw a 0.20% change. Backblaze notes that small drives account for 44.5% of overall drive failures compared to larger drives.

Image source: Backblaze.

Taking the above graph, Backblaze converts the graph into two tables, with the first showing all drive sizes in average age (in months) and the lifetime average failure rate, or AFR. The second table consolidates the drives further with the older drives listed to show the increase in failure, which is more prominent in change from April 2013 to December 2022.

Image source: Backblaze.

At the end of this part of the analysis, age was the cause of the increase in the failure rate of the company's current hard drives. In 2023, Backblaze anticipates replacing many older drives with larger hard drives, starting with 16TB and higher, which means that their smaller hard drives will be much less in service.

Regarding the manufacturer with the most significant drive failures, Seagate and Toshiba were close to even starting the first quarter of 2020. However, at the end of the fourth quarter of last year, Seagate had the most significant percentage of average failure. Seagate also is the oldest manufacturer that Backblaze utilizes in their drives, so the large quantity makes sense.

Image source: Backblaze.

Does this mean Seagate drives have worsened over the years, and consumers should avoid them? No. Klien notes that several Seagate models are cost-effective and easy to replace over time. But those numbers may change if they use higher drive storage and phase out the older models.

The lifetime failure rate did decrease by 0.01% and 0.02% from the previous quarter. In fact, out of the 226,041 drives analyzed, there was a total of 333,011,602 drive days and an overall 12,722 drive failures.

The post Backblaze Publishes Hard Drive Failure Rates For 2022, Almost 231K Drives Monitored by Jason R. Wilson appeared first on Wccftech.

31 Jan 21:15

GitHub Says Hackers Cloned Code-Signing Certificates in Breached Repository

by msmash
GitHub said unknown intruders gained unauthorized access to some of its code repositories and stole code-signing certificates for two of its desktop applications: Desktop and Atom. From a report: Code-signing certificates place a cryptographic stamp on code to verify it was developed by the listed organization, which in this case is GitHub. If decrypted, the certificates could allow an attacker to sign unofficial versions of the apps that had been maliciously tampered with and pass them off as legitimate updates from GitHub. Current versions of Desktop and Atom are unaffected by the credential theft. "A set of encrypted code signing certificates were exfiltrated; however, the certificates were password-protected and we have no evidence of malicious use," the company wrote in an advisory. "As a preventative measure, we will revoke the exposed certificates used for the GitHub Desktop and Atom applications." The revocations, which will be effective on Thursday, will cause certain versions of the apps to stop working.

Read more of this story at Slashdot.

31 Jan 21:12

You Don't Know Where Your Secrets Are

by info@thehackernews.com (The Hacker News)
Do you know where your secrets are? If not, I can tell you: you are not alone. Hundreds of CISOs, CSOs, and security leaders, whether from small or large companies, don't know either. No matter the organization's size, the certifications, tools, people, and processes: secrets are not visible in 99% of cases. It might sound ridiculous at first: keeping secrets is an obvious first thought when
31 Jan 21:12

Free strategy shooter game Unvanquished v0.54 is out now

by Liam Dawe
Free, open source and full of bugs (the squishable kind) — Unvanquished is a mixture of strategy and an FPS with a new release v0.54 out now.
31 Jan 21:07

GitHub Revokes Code Signing Certificates Following Cyberattack

by Ionut Arghire

Code hosting platform GitHub on Monday announced the revocation of three digital certificates used for the GitHub Desktop and Atom applications.

The three certificates were stolen on December 6, 2022, after an unauthorized third-party used a compromised Personal Access Token (PAT) for a machine account to clone repositories from Atom, GitHub Desktop, and other deprecated GitHub-owned organizations. GitHub revoked the compromised credentials on December 7. 

“After a thorough investigation, we have concluded there was no risk to GitHub.com services as a result of this unauthorized access and no unauthorized changes were made to these projects,” the company says.

According to GitHub, the cloned repositories did not contain customer data, but several encrypted code signing certificates for use via Actions in GitHub Desktop and Atom release workflows were stored in them.

“The certificates were password-protected and we have no evidence of malicious use. As a preventative measure, we will revoke the exposed certificates used for the GitHub Desktop and Atom applications,” GitHub says.

The Microsoft-owned platform explains that the certificate revocation will invalidate some versions of GitHub Desktop for Mac and Atom, but will have no impact on GitHub Desktop for Windows.

Specifically, GitHub Desktop for Mac versions 3.0.2 to 3.1.2 and Atom versions 1.63.0 and 1.63.1 will stop working. GitHub Desktop for Mac users will need to update to the latest release, while Atom users will need to download a previous Atom version (Atom versions 1.63.0-1.63.1 have already been removed from the releases page).

“On Thursday, February 2, 2023, we will revoke the Mac & Windows signing certificates used to sign Desktop app versions 3.0.2-3.1.2 and Atom versions 1.63.0-1.63.1. Once revoked, all versions signed with these certificates will no longer function,” GitHub announced.

Because the stolen certificates do not appear to have been decrypted by the threat actor, they do not pose a risk to the existing GitHub Desktop and Atom installations but, if decrypted, they could allow the attackers to sign unofficial applications and pretend they were released by GitHub.

The impacted certificates include two Digicert certificates for Windows and one Apple Developer ID certificate. One Digicert certificate expired on January 4, while the other will expire on February 1. The Apple Developer ID certificate is valid until 2027.

“On January 4, 2023, we published a new version of the Desktop app. This version is signed with new certificates that were not exposed to the threat actor,” GitHub notes.

Related: Attackers Can Abuse GitHub Codespaces for Malware Delivery

Related: GitHub Introduces Automatic Vulnerability Scanning Feature

Related: GitHub Announces Free Secret Scanning, Mandatory 2FA

The post GitHub Revokes Code Signing Certificates Following Cyberattack appeared first on SecurityWeek.

31 Jan 21:07

Microsoft’s Verified Publisher Status Abused in Email Theft Campaign

by Eduard Kovacs

Microsoft and cybersecurity firm Proofpoint on Tuesday warned organizations that use cloud services about a recent campaign that involved malicious OAuth applications and abuse of Microsoft’s ‘verified publisher’ status.

The campaign mainly targeted Microsoft customers in Ireland and the UK. The tech giant has taken steps to disrupt the operation and it has published an article on how users can protect against these threats, which the company calls ‘consent phishing’.

In a consent phishing attack, a threat actor attempts to trick a targeted user into granting permissions to their malicious cloud applications. Once they have obtained the required permissions, the malicious apps can gain access to legitimate cloud services and user data. 

In a campaign uncovered by Proofpoint in December 2022, hackers created malicious OAuth apps and then obtained a ‘verified publisher’ status in an effort to increase their chances of tricking users.

According to Microsoft, the attackers impersonated legitimate companies when enrolling in the Microsoft Cloud Partner Program (MCPP). 

“The actor used fraudulent partner accounts to add a verified publisher to OAuth app registrations they created in Azure AD,” Microsoft explained. 

This made it more likely for targeted users to grant permissions to the malicious applications. These permissions included reading emails, changing email settings, and accessing files and other user data, such as calendar and meeting information.

Microsoft’s investigation showed that the attackers used the malicious OAuth applications to exfiltrate emails. 

According to Proofpoint, the attackers used three malicious apps created by three different publishers. They all used the same malicious infrastructure and targeted the same organizations. 

“The potential impact to organizations includes compromised user accounts, data exfiltration, brand abuse of impersonated organizations, business email compromise (BEC) fraud, and mailbox abuse,” Proofpoint said. “The attack was less likely to be detected than traditional targeted phishing or brute force attacks. Organizations typically have weaker defense-in-depth controls against threat actors using verified OAuth apps.”

According to Proofpoint, the campaign ran until December 27. The security firm observed attacks against financial and marketing staff, as well as executives and managers. 

Microsoft said it became aware of the campaign on December 15. The company has disabled all fraudulent applications and alerted affected customers. 

Microsoft recently also dismantled a campaign that leveraged a network of single-tenant OAuth applications for the distribution of spam

Related: GitHub Warns of Private Repositories Downloaded Using Stolen OAuth Tokens

Related: CircleCI Hacked via Malware on Employee Laptop

Related: Okta Source Code Stolen by Hackers

The post Microsoft’s Verified Publisher Status Abused in Email Theft Campaign appeared first on SecurityWeek.

31 Jan 21:06

Cyber Insights 2023: Attack Surface Management

by Kevin Townsend

About SecurityWeek Cyber Insights | At the end of 2022, SecurityWeek liaised with more than 300 cybersecurity experts from over 100 different organizations to gain insight into the security issues of today – and how these issues might evolve during 2023 and beyond. The result is more than a dozen features on subjects ranging from AI, quantum encryption, and attack surface management to venture capital, regulations, and criminal gangs.

Cyber Insights | 2023

SecurityWeek Cyber Insights 2023 | Attack Surface Management – Attack surface management (ASM) is an approach for delivering cybersecurity. IBM describes the attack surface as “the sum of vulnerabilities, pathways or methods – sometimes called attack vectors – that hackers can use to gain unauthorized access to the network or sensitive data, or to carry out a cyberattack.”

ASM requires “the continuous discovery, analysis, remediation and monitoring of the cybersecurity vulnerabilities and potential attack vectors that make up an organization’s attack surface. Unlike other cybersecurity disciplines, ASM is conducted entirely from a hacker’s perspective, rather than the perspective of the defender. It identifies targets and assesses risks based on the opportunities they present to a malicious attacker.”

ASM is consequently predicated on total visibility of assets, vulnerabilities, and exploits.

Demise of the perimeter and growth of complexity

Attack surface management is not a new concept, notes Mark Stamford, founder and CEO at OccamSec. “As long as there has been a thing to attack, there has been an attack surface to manage (for example, the walls of a castle and the people in it).” The castle is a good analogy. If you can see the wall, you can attack it. You can batter it down, you can employ the original Trojan Horse to gain access through the front door, you can find a forgotten and unprotected entrance, or you can persuade an insider to leave a side gate unlocked.

For the defender, relying on the wall and being aware of any weak areas is not enough. People are also part of the attack surface, and the defender needs to have total visibility of the entirety of the attack surface and how it could be exploited. But the wall is a perimeter, and we no longer have perimeters to defend – or at least every single asset held anywhere in the world has its own perimeter.

“The attack surface,” continued Stamford, “is anything tied to an organization that could be a vector to get to a target. What this means in practice is all your applications that face the Internet, all the services (beyond applications) that are reachable, cloud-based systems, SaaS solutions you use (depending on what the bad guys’ target is), third parties/supply chain, mobile devices, IOT, and your employees. All of that and more is your attack surface and all of it needs to somehow be monitored for exposures and dealt with.”

The need for ASM, like other current approaches to cybersecurity (such as zero trust, which itself can be viewed as part of ASM), comes from the demise of a major defensible perimeter. Migration to the cloud, expanding business transformation, and remote working all add complexity to the modern infrastructure. If anything touches the internet, it can be attacked. Even the addition of new security controls that send data to and from the cloud add to the attack surface.

“The adoption of multi-cloud and hybrid cloud will continue to rise in 2023,” comments Aditi Mukherjee, director of product marketing management at Lacework. “As enterprises continue their cloud migration and digital transformation, they will realize that traditional approaches with siloed tools, rules-based policies, and disparate security data actually introduce more security risks, creating an expanded attack surface for bad actors.”

But ASM goes beyond the cloud alone. “The traditional attack surfaces are physical, digital and social,” explains Sam Curry, CSO Cybereason; “but digital really needs to be broken down into subdomains for classical environments and networks, legacy data centers, cloud infrastructure and the aggregate software-as-a-service topography.” 

He doesn’t believe ASM will provide a complete answer, but is a solid doctrine for minimizing the exposure in each domain, giving least options and succor to attackers. “There are also key existing and emerging control planes around identity, application governance and data-centrism that need to be strongly protected and managed in a similar manner, even before thinking of the advanced techniques around obfuscation and deception.”

All security strategies, he says, should think about both reducing complexity in each attack surface and control plane, about gaining leverage in each, about reducing vulnerabilities and exposure in each and about how to bring the full security game to bear in each.

Attack surfaces will get more complex and more distributed throughout 2023; and effective ASM will be more complicated.

Management is the key word in ASM

The complexity of the modern infrastructure makes the complete elimination of threats an impossible task. ASM is not about the elimination of all threats, but the reduction of threat to an acceptable level. It’s a question of risk management.

“The idea behind attack surface management is to ‘reduce’ the ‘area’ available to attackers to exploit. The more you ‘reduce the attack surface’ the more you limit and minimize attackers’ opportunities to cause harm,” says Christopher Budd, senior manager of threat research at Sophos.

He believes that ASM will be more challenging in 2023 because of the attackers’ increasingly aggressive and successful misuse of legitimate files and utilities in their attacks – living off the land – making the detection of a malicious presence challenging. “We can expect this trend to continue to evolve in 2023, making it more important that defenders update their detection and prevention tactics to counter this particularly challenging tactic,” he says.

Part of reducing risk comes from understanding what vulnerabilities exist within the infrastructure, and which of them are exploitable. Omer Gafni, VP surface at Pentera, reminds us that ASM looks at threats from the attacker’s perspective. To effectively reduce risk, you need to understand not only what vulnerabilities exist, but also which are exploitable and serve the hackers’ end goals.

“With the number of annual reported vulnerabilities now exceeding 20,000 per year, companies cannot remediate every alert, and need to become more surgical with their remediation strategies,” he says. “To achieve this, we will start to see a shift from a focus on vulnerability to exploitability. Companies will start to put a major emphasis on understanding which targets are most impactful from the hacker’s perspective, and therefore the most exploitable targets.”

CISA’s Known Exploited Vulnerabilities Catalog (the KEV list) can help here. Focusing remediation on exploited vulnerabilities is a key part of ASM, and the catalog is described by many as ‘CISA’s must patch list’. This list will continue to grow through 2023.

Pentesting and red teaming are also effective ways of locating exploitable vulnerabilities, but in the past, they have not been used effectively. “One of the most frustrating things as a pentester is when you return to organizations a year later and see the same issues as before,” says Ed Williams, director of Trustwave SpiderLabs EMEA. “There is no value to this for the clients. They are not maturing. In fact, they are regressing.”

But he expects an improvement – perhaps encouraged by the growing acceptance of ASM – in 2023. “I expect an unprecedented appreciation for how pentesting effectively exposes gaps in security, and this in turn will help to reinforce the importance of those all-important security basics. In 2023 I implore organizations to work with pentesters for the best, year on year result.”

Chad Peterson, MD at NetSPI, believes the nature and effectiveness of pentesting will evolve over 2023, “The attack surface has become more fluid, so you have to be able to scan for new assets and entry points continuously,” he says. “In 2023, organizations will combine traditional pentesting, which in many cases will still be required for regulatory needs, with the proactive approach of more continuous assessment of their attack surface. The result will be better awareness of the attack surface and more comprehensive traditional pentesting as there is more information about the true attack surface.”

Sample problem areas

SaaS

Ben Johnson, CTO and co-founder of Obsidian, chooses SaaS. “2023 will be the year of SSPM [SaaS security posture management] and securing SaaS,” he says. “But for that to happen, we must continue educating organizations on the risks of SaaS. In doing so, organizations must ensure their left-of-boom teams (vulnerability management and GRC) are able to reduce SaaS risk while ensuring their right-of-boom teams (security operations, incident response, threat hunting) have continuous threat management capabilities.” 

SaaS security has given organizations the ability to scale applied security, not just awareness. “Now is the time to distribute security hardening and operations to go with the distributed technology and distributed responsibility. As we know, the pandemic sped up the hybrid work model, and organizations that prioritized endpoint or public cloud security over the past couple years are now ready to secure SaaS and the modern workflow.”

The browser

Jonathan Lee, senior product manager at Menlo Security, focuses on the browser, which is possibly the biggest single threat surface. This is where users spend most of their time. “Vendors are now looking at ways to add security controls directly inside the browser,” he said. “Traditionally, this was done either as a separate endpoint agent or at the network edge, using a firewall or secure web gateway.”

The big players, Google and Microsoft, are also in on the act, providing built-in controls inside Chrome and Edge to secure at a browser level rather than the network edge, he added. “But browser attacks are increasing, with attackers exploiting new and old vulnerabilities, and developing new attack methods like HTTP smuggling. Remote browser isolation is becoming one of the key principles of zero trust security where no device or user – not even the browser – can be trusted.”

Noticeably, 2022 has already seen investor interest in startups developing secure browser technology – such as Red Access and LayerX.

The user

Ed Williams highlights a failure in using and accounting for the user – and uses ransomware as an example. “Cyber threats, including ransomware, will never be prevented by implementing shiny new products and solutions unless the underlying security issues are addressed. Therefore, in 2023,” he added, “I hope organizations shift their mindset away from feeling as though they need the latest tempting tech, and instead focus on consistently achieving the human-centric security basics. These basics include patching, strong passwords, and a detailed security policy.”

Visibility

If ‘management’ is the key word in ASM, ‘visibility’ is the key enabler. You can only manage what you can see. “In 2023, organizations should embrace the mindset of empowering their teams with visibility into assets and relationships and overcoming data silos between AppSec, infrastructure, and data security teams,” suggests Erkang Zheng, founder and CEO at JupiterOne.

He recalls the words of John Lambert: “Defenders think in lists. Attackers think in graphs. As long as this is true, attackers will win.” Attackers will win, especially if cybersecurity defenders cannot quickly understand graph-based relationships between data, networks, and user accounts in their own networks to limit the blast radius when they are under attack.

“Contextual intelligence is likely necessary to win in a threat vector where organizations face more complex, destructive, and irreversible threats than ever before,” he says. “This visibility and understanding are the primary benefits of attack surface management technologies and practices, along with secondary benefits such as compliance and evidence automation.”

Marcus Fowler, CEO of Darktrace Federal, has no doubt that ASM will be a top priority for organizations in 2023. The problem is the attack surface is never static; it’s constantly evolving with the level of risk changing daily. “Tracking down the full extent of the attack surface is not something that can be left to human resources. It requires real-time data from an AI engine taking a hacker’s approach,” he says. He believes that most organizations currently miss as much as 50% of their true attack surface. 

“That’s where seeing AI take on the key ASM functions of discovery, assessment and prioritization, risk prevention and integration can expose the true level of exposed risk,” he added. “Only the automation and scalability of AI can provide the up-to-date, continuous copy of the internet that CISOs need to get a grip on the attack surface. Paired with AI’s unique understanding of an organization’s digital estate, you get an outside-in, inside-out risk management program that will be vital for the CISOs of tomorrow.”

Part of ASM is external attack surface management (EASM). Microsoft defines the external attack surface as “the entire area of an organization or system that is susceptible to an attack from an external source.” We should note that this excludes malicious or naive insiders, who should also be considered as part of a full ASM approach to cybersecurity. Nevertheless, there will be a growing number of EASM support systems released by security vendors during 2023. CrowdStrike, for example, announced in September 2022 that it would be buying EASM company Reposify, with an expectation to close during CrowdStrike’s fiscal third quarter.

“In response to evolving attack tactics and an expanded attack surface,” comments Karin Shopen, VP of cybersecurity solutions and services at Fortinet, “we expect a shift in the tools CISOs consider in 2023. When it comes to attack surface management, CISOs will shift from one-time assessments to constant and continuous early evaluation of their organization’s external attack surface. EASM solutions, which help provide organizations with an adversary’s view of their attack surface, will be at the top of their lists, as will machine learning and the use of seasoned threat hunters that offer takedown services.”

Furthermore, she added, “CISOs and security teams will more closely evaluate EASM solutions based on their ability to not only detect but prioritize and remediate threats using machine learning to help resource-depleted SOC teams.”

Chris Morales, CISO at Netenrich, describes his own approach. “I have one priority for 2023 – to be data driven for risk making decisions,” he says. “My commitment starting fiscal year 2023 is to be data driven with quantitative risk management practices. That means providing the business units with a dashboard and trending metrics to the state of assets, vulnerabilities and threats that comprise their attack surface. From this we can continually score threat likelihood and business impact to make informed decisions on where to best focus resources.”

It isn’t simple, but worth the effort. “Making this happen requires a tightly integrated security stack that shares data into a single aggregated data lake to threat model and answer questions.”

The concept is supported by Shira Shamban, CEO at Solvo. “In 2023, we are going to see a data-centric approach to cybersecurity emerge and grow,” she says. “At its core, cybersecurity is a problem of managing all the data, assets, and sensitive resources an organization has, and determining how to protect it. This sensitive data can often include PII, PHI or IP. This is the top concern for CISOs and security practitioners, so security approaches and products will begin to put data at the center, rather than focusing solely on the environments the data is in.”

The way forward in 2023

Attack surface management is nothing short of a complete methodology for providing effective cybersecurity. It doesn’t seek to protect everything, but concentrates on those areas of the IT infrastructure that can be attacked. There is no product that can provide ASM, but a growing number of products that can help. It requires complete visibility of all assets, and detailed knowledge of exploits so that assets can be protected. It is, like zero trust, a journey – one that is gaining traction and will gain more traction in 2023.

Mark Stamford describes the problem and offers his own route for the journey. “ASM tools produce a lot of noise that can send a security group down an endless number of rabbit holes. In the rush to simplify the problem everything gets reported on and all kinds of vulnerability data gets included. There’s usually some shoddy logic applied which seems to state if you have a lot of stuff facing the Internet you are more at risk, which piles further pressure on the security group. I’ve seen ASM tools which report on old SSL certs, low level vulnerabilities, all kinds of stuff that really, poses little to no risk.”

The route he proposes is to start by discovering all the assets, organizations, devices, and people that could create a problem. Then assess which could have a harmful impact. “A web server hosting some static pages in AWS, that connect to nothing, may cause a headache, but is probably not going to lead to a breach,” he says. “On the flip side, your Internet accessible financial system is a key component.”

Next assess how everything is connected – could an attacker get from A to B and cause an impact. “Draw a circle around that and start looking at how you protect it.” But importantly, “Accept that you don’t need to protect everything and move from there.”

The real problem, he concludes, is that data is everywhere. “This really does expand the attack surface, so you have to use a logical, risk-based approach which considers the context of your business – how you achieve what you are trying to achieve – and then protect it.”

About SecurityWeek Cyber Insights | At the end of 2022, SecurityWeek liaised with more than 300 cybersecurity experts from over 100 different organizations to gain insight into the security issues of today – and how these issues might evolve during 2023 and beyond. The result is more than a dozen features on subjects ranging from AI, quantum encryption, and attack surface management to venture capital, regulations, and criminal gangs.

Cyber Insights | 2023

Related: The Rise of Continuous Attack Surface Management

Related: Investors Bet on Cyberpion in Attack Surface Management Space

Related: IBM to Acquire Randori for Attack Surface Management Tech

Related: Attack Surface Management Play Censys Scores $35M Investment

The post Cyber Insights 2023: Attack Surface Management appeared first on SecurityWeek.

31 Jan 21:04

James Gunn Explains How The DC Universe Will Be Different From The MCU

by Witney Seibold

For many decades, Marvel Comics and DC Comics have battled for dominance over the superhero comic book market. Each consisted of its own massive canon of superhero characters, occasionally printed massive, company-wide crossover events, and both produced multiple recognizable characters that have become a near-permanent part of the pop consciousness. Marvel Comics proudly oversaw the likes of Captain America, Spider-Man, the Incredible Hulk, the Fantastic Four, the X-Men, and, uh, Armless Tiger Man. DC Comics oversaw Batman, Wonder Woman, The Flash, Superman, and, uh, Matter-Eater Lad. 

The heated debates overheard in comic book stores could never be reconciled, as many comic book readers tended to be loyal to one company or the other, but rarely both. Such debates frequently included detailed arguments as to how the universes differed. 

Most of the time, the debate came down to one crucial difference: Marvel Comics were set in the "real world," and DC Comics were set in a fantasy world. Spider-Man, for instance, lived in New York City and often had to worry about practical things like paying bills and dating. Nothing came easy to Spider-Man. He was relatable. Superman, meanwhile, lived in Metropolis, an imaginary city where Supermen more naturally fit. Everything came easy to Superman. He was aspirational.

/Film's own Jenna Busch recently attended the DC Presentation, a press event wherein James Gunn and Peter Safran, the co-chairs and co-CEOs of DC Studios announced their plans for new DC Comics-based movies and TV shows, and Gunn reiterated the old Marvel/DC argument succinctly, pointing out that his new DC Universe and the old Marvel Cinematic Universe will also bear similar differences (not to employ an oxymoron). 

The DCU Goes MCU?

At the press event, James Gunn wanted to assuage fears that his DC Universe and the MCU were going to be different entities. They were both to be massive, interconnected superhero-based media franchises that sported a similar tone throughout each chapter, each one overseen by a captain-like showrunner, but, Gunn explained, the tone would be markedly different. It may help that Gunn has already directed feature films in both series (four "Guardians of the Galaxy" projects for the MCU, and two "Suicide Squad" projects for the old DCEU). He said: 

"A lot of people think it's gonna be Marvel 2.0, and definitely I learned a lot of stuff at Marvel, you know. I think that we have a lot of differences. I think that one of the reasons why I love DC is it really is another universe, it's an alternate world."

The MCU, if one recalls its origins, began in a real world without superheroes, and slowly added them one at a time, until a hundred of them could form their own ersatz military force. DC Comics, Gunn says, is a universe where superheroes will naturally fit. There won't be a need to slowly introduce people into the world if it feels like Superman already belongs there. Gunn added:

"You know in Marvel, generally, it's New York, Chicago, San Francisco, and then every place else in the world is a fictional universe for some reason. Here at the DCU we have, you know, Metropolis and Gotham and Themyscira and Atlantis and Bialya, and all of that is sort of another fictional universe and this is the world that we're creating. We're coming into a world where superheroes exist and have existed for some time in one form or another, and that's the universe."

Planning It From The Start

Gunn also points out a distinct advantage his new DCU will have over the MCU and any previous superhero media: they have a plan. Even the MCU didn't start out as the MCU, with "Iron Man" and "The Incredible Hulk" being released prior to Disney's acquisition of Marvel in 2009, and prior to plans for an interconnected universe being put into motion. Eventually, a plan came together, but fans of the MCU can point to films like "Iron Man 2" and "Avengers: Age of Ultron" as being exposition-heavy and perhaps too focused on setting up events in future movies. 

With that in mind, and with the now-moribund DCEU discarded, Gunn can plan out his universe more carefully. He said: 

"[W]e are telling a big huge central story that is like [the MCU] ... except for I think that we're a lot more planned out than Marvel from the beginning because we've gotten a group of writers together to work that story out completely. But we're also creating a universe that is like, you know, 'Star Wars.' Where there's different times, different places, different things. Or like 'Game of Thrones,' where characters are a little bit more morally complex."

Superheroes, as the moniker implies, can't be too complex, else they would just be violent people who solve problems with fists. If there are irredeemable supervillains in the world, however, then their violence is morally justified. Moral greys, however, are appreciated. "Star Wars," meanwhile, has — for decades — gotten a lot of mileage out of revisiting old areas of its timeline and filling them in with backstory and detail. It seems the DCU will skip around a lot. 

No films in the DCU series have yet been made. The time has now come to wait.

Read this next: Every DC Movie Made Prior To The DCEU Ranked From Worst To Best

The post James Gunn Explains How The DC Universe Will Be Different From The MCU appeared first on /Film.

31 Jan 21:04

James Gunn Says The Flash Is One Of The Best Superhero Movies He's Ever Seen, Ezra Miller's Future Up In The Air

by Joe Roberts

The time has finally come for DC Studios Co-Chairmen and CEOs James Gunn and Peter Safran to reveal their plans for DC going forward. /Film writer Jenna Busch attended a press event where the pair unveiled a whole new slate of DC movies and TV shows for the coming years, including new Superman and Supergirl movies and a True Detective-style Green Lantern show. And while it's far from the hard reboot many long-suffering DC fans were hoping for, Gunn and Safran's plan for a "long-term interconnected story" will mark a major shift for DC Studios.

"Chapter 1" of the new DC will be known as "Gods and Monsters," and will kick off with the Gunn-penned "Superman: Legacy," currently set for a July 11th, 2025 release. In the meantime, Gunn and Safran will have to navigate their way through vestiges of the Snyderverse and former DC Films President Walter Hamada's lingering influence. There are still four big movies left over from the pre-Gunn and Safran days, which Warner CEO David Zaslav has, as yet, not unceremoniously axed. But perhaps the most anticipated is the long-gestating Flash movie.

Currently set for a June 16, 2023 release "The Flash" was supposed to debut after "Justice League" way back in 2017 but has been plagued by a series of setbacks and ongoing off-screen problems with its star, Ezra Miller. Miller entered treatment in 2022 following a few run-ins with the law and some very serious grooming accusations. All of which left a large question mark looming over "The Flash" for some time. Now, with its release date finally approaching, director Andy Muschietti can at least rest safe in the knowledge that James Gunn is a big fan of his film.

'One Of The Best Superhero Movies I've Seen'

While "The Flash" hasn't had the easiest production, it has at least tested very well with audiences, and sources close to /Film have had incredibly kind things to say about the movie — Miller's troubles notwithstanding. But while its star's future remains in question, "The Flash" seems to have really impressed Gunn, who at the press event praised it as "f****** amazing," adding, "It's truly one of the best superhero movies I've ever seen. Andy Muschietti did an amazing job. And I'm really excited for everybody to see it."

Peter Safran clarified that both he and Gunn have "had input" on the film but that there was "nothing [they] had to do," suggesting the movie was pretty much ready to go when the new Co-Chairmen and CEOs stepped into their DC Studios roles late last year. According to Gunn, both he and Safran are, "very close with Andy and Barbara [Muschietti, producer]" and that the director would be "doing some more stuff" for DC going forward.

Miller's future, however, is less certain. Asked about his place in the DCU going forward, Safran said:

"Let's see what happens. Ezra is fully committed to recovering right now. And we talk to them, we're in constant contact. But when the time is right we'll have the conversation with them and decide what's best for both them personally and also for us."

At this point, the accusations against Miller are serious enough that no one would blame Warner Bros. and DC Studios for parting ways with him. But the reality is that both will likely wait to see how "The Flash" performs at the box office before making any major decisions. That's showbiz, baby.

Michael Keaton's Batman Will Be A One And Done For Now

One (sort of) casualty of all this appears to be Michael Keaton's Batman, who is set to appear in "The Flash" as part of an alternate timeline visited by Miller's Barry Allen. Keaton hasn't suited up since 1992's "Batman Returns" and was at one point rumored to be taking on a kind of Tony Stark-esque mentorship role for the DCU going forward. But with Gunn and Safran coming on board and preparing to make major changes, all those big plans seem to have been scrapped.

When asked about Keaton's Batman during the press event, Gunn said, "The main thing that we're focusing on right now is creating the universe that people can kind of put their feet into," suggesting Keaton could show up in the future as part of a yet to be devised multiverse storyline, but that he wouldn't be a main part of the "Gods and Monsters" chapter.

Gunn also confirmed what we all knew by clarifying that both Henry Cavill and Ben Affleck were definitely not going to be back any time soon as Superman or Batman respectively. Affleck's Dark Knight was also supposed to be showing up in "The Flash" but it's unclear whether those scenes have been cut to accommodate Gunn and Safran's plans.

The Future Of The Flash

It's kind of bittersweet to hear Gunn confirm what we've all suspected — that "The Flash" is great. At one point, it was going to be a seminal moment in DC's cinematic saga. Now, the big reset seems to be coming with 2025's "Superman: Legacy," leaving "The Flash" as a bit of an anomaly on the road to constructing the new future of DC on film.

Which is a shame because it sounds like the film is genuinely great. Gunn is an unabashed comic book fan so his thinking the film is "f****** amazing" doesn't necessarily mean it is actually "f****** amazing." But the man knows a thing or two about superhero movies, and coupled with the excellent audience scores we've been hearing about, and the fact that Zaslav has allowed this $200 million blockbuster to go ahead during a time when he's looking for every tax break he can get, suggests we could indeed have, "one of the best superhero movies" on our hands.

But for what? Gunn is clearly very excited about his upcoming films and TV shows, none of which, aside from maybe the Supergirl movie, seem to have much to do with the events or characters in "The Flash." If the movie hits and is a breakout success, you might see some of that change, because, as we all know, in show business the business comes first. But for now it's all a bit weird to hear constant praise for a film designed as a momentous event in DC movie history that will seemingly have very little to do with DC movie narratives going forward. For now, we'll have to wait for those all-important box office figures to roll in.

Read this next: What These DC Villains Really Look Like Under The Makeup

The post James Gunn Says The Flash is One of the Best Superhero Movies He's Ever Seen, Ezra Miller's Future Up in the Air appeared first on /Film.

31 Jan 21:03

James Gunn's The Suicide Squad Will Be A 'Rough Memory' For The New DC Universe

by Jeremy Mathai

Have you heard the news? Big changes are afoot over at Warner Bros. and their shiny new DC Universe. Led by DC Studios co-chairs and co-CEOS James Gunn and Peter Safran, the creative duo officially unveiled their new plans for the most famous superheroes in the world ... and many lesser-known ones, as well. But it's not fully an "Out with the old, in with the new" kind of deal, however. As much as this shakeup might resemble a reboot of sorts, the reality is slightly more complicated as the new regime has to deal with the leftovers they've inherited from an admittedly messy era of live-action DC.

Questions abound over the status of familiar faces like Ben Affleck, Gal Gadot, Jason Momoa, and obviously all the drama surrounding Henry Cavill ... to say nothing of the characters that James Gunn himself introduced as director and writer of "The Suicide Squad," before he took over DC Studios in a leadership capacity. Well, Gunn is well aware of the optics surrounding this fresh (re)start and the questions that fans will inevitably have about just how much of a clean slate this will really be. In that spirit, he directly addressed how "The Suicide Squad" fits into the grand scheme of things and when audiences can expect the new direction of the DC Universe to really begin to kick in.

/Film's Jenna Busch attended the buzzy press event and reported Gunn's intriguing comments that "The Suicide Squad" exists as a "rough memory" of what previously occurred in the universe. Read on for all the details below!

The Continuity Conundrum

How exactly is anyone supposed to reconcile multiple interconnecting and sometimes-contradictory eras of DC films in recent years? The Zack Snyder saga may have officially wrapped up with the release of "Zack Snyder's Justice League," but many of his well-received cast of actors have continued on in their roles under new management. But we also have Todd Phillips' "Joker" and Matt Reeves' new "The Batman" to contend with, along with other holdovers such as Margot Robbie's Harley Quinn. What's a pair like Gunn and Peter Safran to do? Well, the answer is to treat the pesky question of continuity with a sliding scale, apparently.

As we know, "Superman: Legacy" will serve as the official start of Gunn and Safran's DC slate, but that doesn't necessarily mean that they're discarding everything that came before. According to Gunn, it helps to think of it in terms of memory:

"Some things are like a rough memory of what happens in the DCU. But once we hit 'Superman,' anything can be changed."

So what to make of this comment? It certainly seems as if "The Suicide Squad" (and other well-received hits) will exist in a sort of hazy continuity that, presumably, Gunn will pick and choose from to dictate what counts and what doesn't. But once the new "Superman" movie hits (with a crucial assist from "The Flash", which will set the stage for the upcoming creative reset in a big way), that will mark the concrete beginning of the new DC Universe continuity. Gunn promises that everything will make much more sense after we see "Superman: Legacy" for ourselves, so we're in wait-and-see mode for the time being.

"Superman: Legacy" is slated to hit theaters remarkably soon: on July 11, 2025.

Read this next: Joker's Wild: Ranking The Cinematic Versions Of The Clown Prince Of Crime

The post James Gunn's The Suicide Squad Will be a 'Rough Memory' for the New DC Universe appeared first on /Film.

31 Jan 21:03

The New DC Universe Slate Is Weird As Heck, And That's For The Best

by Erin Brady

When you think of DC Comics, what comes to mind? Batman, Superman, Wonder Woman, perhaps Aquaman or The Flash. That's to be expected, as they are largely considered the marquee characters of the brand. You probably wouldn't put characters like Booster Gold, G.I. Robot, or arguably even Swamp Thing next to them, if you even know who they are.

However, as we have learned from the newly-announced DC Universe slate, both classic and overlooked characters will be getting their time to shine on-screen. Co-CEOs and co-heads of DC Studios, James Gunn and Peter Safran, seem eager to explore the weirder side of the esteemed comic property with these new titles. Among the newly-revealed projects in development are a "Swamp Thing" feature film, a movie centering around the anti-hero team The Authority, and an animated series focusing on the Creature Commandos. Even legacy characters are getting a new spin, with Green Lantern Corps members Hal Jordan and John Stewart getting a "True Detective"-styled show called "Lanterns" and Wonder Woman receiving a prequel series called "Paradise Lost."

It would be easy to write off these projects as being too strange for general audiences, but that might not be the case. Rather, the DC Universe can distinguish itself from its Marvel counterpart by truly embracing the unique weirdness of comic book storytelling.

In Order To Survive, You Must Take Risks

When looking at the upcoming slate of Marvel Cinematic Universe titles, you might find a lot of the same names repeated over and over. Furthermore, the same storylines are arguably being represented to audiences in different packages. Instead of Thanos trying to conquer the galaxy, we'll have Kang trying to conquer the multiverse. It's getting repetitive and predictable, and it's possible no amount of so-called fresh voices behind the camera will be able to change this.

These new titles being produced for DC, however, are far from repetitive and predictable. We're sure that The Authority wasn't anywhere on your DCU bingo cards, and that's exciting. From the sounds of it, audiences aren't going to be watching the same movie with the same characters over and over again. We can't say any of this for certain, as so many details on these projects are being kept under lock and key. However, the current DCU slate really does seem to be honing in on how strange, weird, and unpredictable comic books can be.

By trying to distance themselves from their inherently weird origins, many post-"Endgame" comic book movies have become indistinguishable from each other. Writers and directors shouldn't be ashamed of these comic books, so the idea that DC Studios is embracing these different characters and stories moving forward could finally make them a force for Marvel to reckon with. All of this is to say that it's a really, really good time to be a Swamp Thing fan.

Read this next: 9 Filmmakers Who Should Be Given Free Rein In The MCU

The post The New DC Universe Slate is Weird as Heck, and That's For The Best appeared first on /Film.

31 Jan 21:02

25 of the Horniest TV Shows Ever Made

by Ross Johnson

Filmmakers understood the power of sex long before TV did—or at least, they actually made effective use of it much more quickly. The early days of the television medium were largely about all-ages programming. Families might have any number of children, but no obvious way in which they had come into being, given the…

Read more...

31 Jan 21:01

On this day in history, in 1606, Guy Fawkes took a "You can't fire me, I quit" approach to his pending execution [Vintage]

31 Jan 20:59

Biden To End US COVID-19 Emergency Declarations on May 11

by msmash
President Joe Biden plans to end two national emergency declarations over the COVID-19 pandemic on May 11, which will trigger a restructuring of the federal response to the deadly coronavirus and will end most federal support for COVID-19 vaccinations, testing, and hospital care. From a report: The plan was revealed in a statement to Congress opposing House Republicans' efforts to end the emergency declarations immediately. "An abrupt end to the emergency declarations would create wide-ranging chaos and uncertainty throughout the health care system -- for states, for hospitals and doctors' offices, and, most importantly, for tens of millions of Americans," the Office of Management and Budget wrote in a Statement of Administration Policy.

Read more of this story at Slashdot.

31 Jan 20:21

Huge Capacity HDDs Shine In Latest Storage Reliability Report But There's A Caveat

by msmash
Hot Hardware reports: When it comes to mechanical hard disk drive (HDDs), you'd be very hard pressed to find any data on failure rates reported by any of the major players, such as Western Digital, Seagate, and the rest. Fortunately for us stat nerds and anyone else who is curious, the folks at cloud backup firm Backblaze frequently issue reliability reports that give insight into the how often various models and capacities give up the ghost. At a glance, Backblaze's latest report highlights that bigger capacity drives -- 12TB, 14TB, and 16TB -- fail less often than smaller capacity models. A closer examination, however, reveals that it's not so cut and dry. [...] In a nutshell, Backblaze noted an overall rise in the annual failure rates (AFRs) for 2022. The cumulative AFR of all drives deployed rose to 1.37 percent, up from 1.01 percent in 2021. By the end of 2022, Backblaze had 236,608 HDDs in service, including 231,309 data drives and 4,299 boot drives. Its latest report focuses on the data drives. [...] Bigger drives are more reliable than smaller drives, case close, right? Not so fast. There's an important caveat to this data -- while the smaller drives failed more often last year, they are also older, as can be seen in the graph above. "The aging of our fleet of hard drives does appear to be the most logical reason for the increased AFR in 2022. We could dig in further, but that is probably moot at this point. You see, we spent 2022 building out our presence in two new data centers, the Nautilus facility in Stockton, California and the CoreSite facility in Reston, Virginia. In 2023, our focus is expected to be on replacing our older drives with 16TB and larger hard drives," Backblaze says.

Read more of this story at Slashdot.

31 Jan 20:21

On this day in history, in 1917, the Germans unleased their U-Boats, which were a remarkable improvement over the previous R, S, and T-Boats [Vintage]

31 Jan 20:21

Pearl Star Mia Goth Says That Eerie End Credits Smile Wasn't In The Script

by Shae Sennett

If you're a fan of Ti West's "Pearl," then Mia Goth's terrifying smile is etched into your memory. But did you know that the smile wasn't even in the script originally? The idea to extend the smile didn't come til after production began, but it helped the actress access a new dimension of her character.

"Pearl" is the second entry into West's horror trilogy, which also included the 2022 film "X" and the upcoming 2023 film "MaXXXine." Goth plays two iterations of Pearl in the film series — a younger version of the character in "Pearl," set during World War I, and an older version of her in "X," set in the 1970s. She also plays Maxine, the namesake of the third film, who first appears in "X."

Goth's involvement in the project doesn't stop at playing several distinct roles — she actually co-wrote the script for "Pearl" with West. "I would write in the kind of stream style [of] consciousness, and then I would send that out to [West]," the actress told MovieMaker. "[H]e would incorporate that into the script format because I've never written a script, I've never studied screenwriting. So that was kind of how it worked."

The actress was intimately familiar with the script, so she was surprised when West had a last-minute addition — her creepy, frozen smile that haunts the film's end credits.

"That actually wasn't written in the script," she revealed to Total Film Magazine in their latest issue, coming February 2, 2023. "It was something that Ti [West] thought of on the day before we shot it. He came up to me and said, Listen, I have this idea, rather than freezeframe we'll just keep going and see what happens. And if nothing comes of it, fine, we'll just stick with the freezeframe."

This Allowed Goth To Be In The Moment

The "Pearl" star was a fan of West's idea but didn't want to over-intellectualize this last-minute decision.

"I really didn't think it through at all, because I'd say that my body always has better ideas than my head," Goth explained. "If I start thinking things through too much, I'm going to get in the way of my intuition, and your instincts are always what's going to lead you in the right direction."

The actress may not have had a lot of time to prepare for this scene, but that ended up working to her advantage. Goth prefers to be "in the moment" as a performer, rather than over-rehearse and deprive a scene of spontaneity. The quasi-improvisational nature of the smile allowed her to really let loose emotionally, which resulted in an incredibly impactful performance.

"[T]hat scene proved to be an incredibly cathartic experience for me," she admitted. "A really poignant experience. It's like a purging."

Goth's highly emotional on-screen moment proved to be extremely evocative not just for the actress but the viewer as well. Goth's aim as an actress is to always "be vulnerable and brave" and to "ground" her performances "in truth and honesty" in hopes that "someone else will watch that and might not feel so alone."

Director Ti West Places A Lot Of Trust In Goth

West gave Goth a lot of creative power and freedom in the "X" trilogy, which the actress is incredibly grateful for. In turn, she too places a lot of trust in West's direction.

"I'm very director-oriented," Goth told Collider. "[If] you don't trust the director who's leading the ship, then nothing of any value I think is going to be made."

Equally important to the actress is the director's trust in his cast and crew. "I think the best directors aren't afraid to give up control," she explained, saying:

"The best directors don't try to micromanage or control their actors or anyone on set. In some ways, the director's job is everything leading up to set. The director is the one bringing everyone together and picking costume designers and makeup artists and production designers and so on, and then trusting them to do their job. And if the director has faith in these people, I think that's where real magic can happen."

If West had not put his faith in Goth, we would never have seen Pearl's now-infamous tearful smile. That shot is an epitomic example of the magic that can happen when a filmmaker trusts his actors to do what they do best. Goth used the liberty that West gave her to access some very real emotions that resonated deeply with the film's audience. That smile is perhaps more memorable than any other image in "Pearl," and it's all thanks to West's hands-off approach — and, of course, Goth's incredible performance.

Read this next: Horror Movies You Don't Want To Miss In 2023

The post Pearl Star Mia Goth Says That Eerie End Credits Smile Wasn't In The Script appeared first on /Film.

31 Jan 20:19

A Great Audition Wasn't Enough For Quentin Tarantino To Cast Pam Grier In Pulp Fiction

by Jeremy Smith

As a lifelong fan of Blaxploitation flicks and exploitation movies in general, of course Quentin Tarantino was desperate to work with Pam Grier. The legendary star of "The Big Bird Cage," "Coffey," and "Foxy Brown" meshed uncommon beauty with undeniable grit. She wasn't looking for trouble. She was trouble. And the bad folks clownish enough to try her on for size always found her to be a treacherously poor fit.

Unfortunately, when the Blaxploitation trend faded in the late 1970s, Hollywood failed Grier. She went from starring roles to underwritten supporting parts in a string of mostly forgettable movies. Strangely, she didn't benefit much from the Black filmmaking renaissance of the early 1990s led by directors like Spike Lee, John Singleton and the Hughes brothers. Then 1996 happened. Though the films weren't particularly big hits, the triple-punch of "Mars Attacks!," "Original Gangsters," and "Escape from L.A." proved she still had plenty of swagger and good old-fashioned star power to lead a movie. She just needed to find the right lead part.

Tarantino finally came through in 1997 with the titular role of flight attendant/smuggler "Jackie Brown," but the two nearly teamed up four years earlier for "Pulp Fiction." How could Tarantino resist working with one of his big-screen heroes?

You Can't Force Chemistry

In a live Q&A with Pam Grier, Quentin Tarantino, Robert Forster, and Lawrence Bender posted to The Guardian in 1998, Grier was initially blunt about why she didn't pass the audition. "I was too tall," she said. "Eric [Stoltz] was short."

According to Tarantino, it was a little more complicated than that: "It is just a situation where she came in and gave a great reading, but I wanted it to be right, I wanted it to be perfect." Grier ultimately concurred:

"I felt I really needed a compatibility with Eric, and you had already cast him. You already knew him and felt his beats and rhythm, and he really needed to see a chemistry with us. I didn't give him what he needed, which was great because Quentin said, 'I still want to work with her' and it was to my advantage, possibly, maybe subliminally."

I'll say. Tarantino has made six movies since "Jackie Brown" (we count "Kill Bill" as one movie in this dojo), but his collaboration with Grier is still his finest hour as a filmmaker. It's a wise and sad movie about getting old and realizing there aren't a lot of moves left before it's checkmate. Grier and Forster (as world-weary bail bondsman Max Cherry) have a sensational chemistry from their first scene together. We dearly want these two to run off together, but they're both too settled in their lives to shake things up. It's one of the greatest unconsummated romances in film history, one that aches just a little more with each viewing. I can't hear Bobby Womack's "Across 110th Street" and not let out a deep, melancholy sigh.

Read this next: 13 Tarantino Projects We Never Saw But Wish We Could've

The post A Great Audition Wasn't Enough For Quentin Tarantino To Cast Pam Grier In Pulp Fiction appeared first on /Film.

31 Jan 11:51

Enigma Virtual Box が一部の環境でクラッシュする理由が酷すぎる件

by blackwingcat
  push SSZ00482A64_kernel32_dll
  call jmp_kernel32.dll!GetModuleHandleA
  test eax,eax
  jz L00482A5A
  push SSZ00482A74_CreateActCtxW
  push eax
  call jmp_kernel32.dll!GetProcAddress
  mov [ebp-04h],eax
  cmp dword ptr [ebp-04h],00000000h
  jz L00482A5A
  mov esi,[ebp-04h]
  xor ebx,ebx
L004829C4:
  mov eax,esi
  call SUB_L00482218
  test eax,eax
  jz L004829D8
  add ebx,eax
  add esi,eax
  cmp ebx,00000005h
  jl L004829C4
L004829D8:
  mov cl,[eax]
  add cl,0xB0
  sub cl,08h
  jc L0048224A //58 pop eax
  sub cl,10h
  jz L00482252 //68 push 0xyyyyyyyy
  sub cl,23h
  jz L00482239 //8b [mov ]
  sub cl,5Eh
  jnz L00482257
  mov edx,00000005h //e9
  mov eax,edx
  retn
;------------------------------------------------------------------------------
L00482239:
  mov al,[eax+01h]
  add al,40h
  sub al,40h
  jnc L00482257 //c0-ff
  mov edx,00000002h
  mov eax,edx
  retn
;------------------------------------------------------------------------------
L0048224A:
  mov edx,00000001h
  mov eax,edx
  retn
;------------------------------------------------------------------------------
L00482252:
  mov edx,00000005h
L00482257:
  mov eax,edx
  retn


問題の処理
CreateActCtxAの関数をフックして書き換える処理
オリジナルの関数の処理が
pop eax
mov ~
push 0x********
jmp 0x********
以外の処理だった場合、返り値が初期化されてないので、とんでもなくでっかい値が返ってきた場合クラッシュする

拡張カーネルの場合、思いっきりこの条件に適合するのでクラッシュしていた模様 ・ω・

ちなみに、Windows 2000の拡張カーネル以外でも、セキュリティソフトや、ゲームガード系アプリがフックを書き換えたりした場合や、将来のOSで処理が変わった場合も起こりうる

[Report] CreateActCtxW detector function does not initialize return value. - Enigma Protector
報告しておいた
31 Jan 11:51

Intel To Overhaul Arc Control Software In “Fine Wine” Graphics Driver Next Month

by Jason R. Wilson

New update to Arc GPU driver combines the Arc Control gaming software to the Arc GPU driver, fixing major issues 1

Intel's Arc Control software will be receiving a significant update next month along with a new Arc GPU driver that is expected to bring big performance enhancements. As reported by numerous sources, the software update will roll out with the new graphics driver & will see a change in how it looks.

Intel Readies Major Arc GPU Driver & Arc Control Software Suite Release For February Release

The Arc Control software from Intel was difficult at best to use primarily because of its overall presentation. Many people found it unmanageable as an overlay and will probably welcome the new change that is expected soon. Linus Sebastian of Linus Tech Tips said this in his recent video:

Intel refuses to provide an exact timeline or any other detail, but they heard you [Luke] and everyone. They know the overlay sucks, it’s going away. We are getting a non-overlay single app that will have everything consolidated into one pane.

Linus Sebastian, Linus Tech Tips

German tech magazine and website PC Games Hardware showed a section of a story written for its physical magazine, which is not in print until next month. The magazine states that Intel is planning to bring some major performance improvements along with various bug fixes in a major driver that is expected to land next month.

Image source: PC Games Hardware via Reddit.

As we have heard from well-informed circles, a major driver update is also planned for this February, which should improve performance in all APIs and also bring new features. Intel has already released a few driver updates over the past few months, which primarily address the rightly criticized performance under DirectX 9. […] As soon as the “miracle driver” appears, you can of course look forward to a test (promptly on PCGH.de).

PC Games Hardware (machine translated from the above image)

Some reviewers have access to the new information but are under strict embargo about what can be revealed to the public. AdoredTV and Tom's Hardware reviewer, Albert Thomas, notes that the latest software update is less of a removal or replacement to the overlay but an upgrade that would please both users and those who found it challenging.

I am limited in what I can say due to an NDA, but it's not fully accurate to say overlay is going away. I believe I can say Intel's solution will satisfy both folks who hate the overlay, and folks who like it.

Albert Thomas, Reddit

The finale from Linus Tech Tips and the group's experience with Intel Arc graphics cards is below. You can find the complete discussion on the Linus Tech Tips YouTube channel.

The post Intel To Overhaul Arc Control Software In “Fine Wine” Graphics Driver Next Month by Jason R. Wilson appeared first on Wccftech.

31 Jan 11:50

Warranties For Graphics Cards & Motherboards Are Analyzed By Swiss Retailer

by Jason R. Wilson

Linux 6.3 Receives Further Optimizations For AMD DRM-Next Radeon Graphics Hardware1

Digitec, a Swiss electronics retailer, recently revealed an analysis of warranty statistics for graphics cards and motherboards over the last twenty-four months. Seventeen brands were pitted against each other to see the highest defect rate during that time and the number of days it takes to process a warranty by each company. The retailer also ran a similar analysis for motherboards during the two years.

Graphics cards and motherboards are analyzed from 2020 to 2022 to discover the defect rate and warranty processing time with several manufacturers

A few things should be noted before looking at the results from Digitec. The number of graphics cards purchased and returned during the 24 months is 300 GPUs. Another factor is the period chosen, from 2020 to the end of 2022. This time was the highest point in history when cryptocurrency was in the public eye and graphics cards were used to mine for enthusiasts. It could be argued that the failure rate comes from crypto mining. Still, there were also many gaming graphics advancements, which have a similar stress effect to mining, depending on the situation and which side of the argument you stand on.

Also, the company with the least amount of GPU defects was Dell, which supplies GPUs for workstations and high-performance situations, which would stand to the high cost and build being superior to most GPUs in the marketplace. That being said, it is probably best to omit this from the findings, but it is understandable why it was added to the analysis.

The last thing to remember is that this information is not global but regional. In this case, some companies can process claims faster depending on the region's laws that the graphics cards or motherboards are shipped.

Image: Digitec via VideoCardz.

The company with the highest defect rate over a twenty-four-month period was XFX, with Sapphire a close second. Both companies are exclusive to AMD graphics technology and were the least used GPU brand to mine digital currency (NVIDIA graphics cards were the preferred GPU of choice for mining). The least amount of defects outside of Dell was from ASRock, which saw a 0.3% defect within the first 24 months.

Upon looking at the results of processing warranty claims, Sapphire, who happened to be one of the most defective GPUs during the two-year analysis, was also the fastest to process any warranties with only a three-day processing timeframe. The highest manufacturer warranty processing wait came from Gigabyte, who took eighteen days to process the contract and return it to the consumer. Most of the companies on the list started at nine days wait time to two weeks on average.

Image: Digitec via VideoCardz.

Motherboards saw many defects during the last two years, with MSI winning the defect rate at only 2.8% compared to the five other brands listed. Supermicro had the highest at five percent. Looking at the warranty claims, Biostar, which had a defect rate of 4.6% and was almost at the top of the defect rate, had the least wait time to process a warranty claim, where it was settled immediately. ASRock motherboards, on the other hand, took thirteen days for turnaround.

The post Warranties For Graphics Cards & Motherboards Are Analyzed By Swiss Retailer by Jason R. Wilson appeared first on Wccftech.

31 Jan 00:11

Watch This Rare Masterpiece on Netflix Before It's Too Late - CNET

by Mark Serrels
30 Jan 22:58

Here’s How Much Emergency Cash You Should Keep at Home

by Jeff Somers

In many places, cash is no longer king. While you still can manage to live a cash-only lifestyle if you want to, few of us do. Some of us don’t even carry cash at all, relying on our phones and credit cards, tapping and swiping at stores and using apps like Venmo or Cash App for personal transactions that would once…

Read more...

30 Jan 21:35

Deliver Us Mars Tech Q&A – ‘DLSS 3 Works Wonders, It’s Amazing What NVIDIA Has Done’

by Alessio Palumbo

Deliver Us Mars

On Thursday, February 2nd, the list of DLSS 3 compatible games will grow with the addition of two titles: PERISH, on which we posted an extensive interview earlier today, and Deliver Us Mars.

The latter is the direct sequel to 2018's Deliver Us The Moon: Fortuna, a sci-fi adventure game made by Dutch indie team KeokeN Interactive. In Deliver Us The Moon, players followed a lone astronaut's desperate bid to find new resources on Earth's satellite after our planet had fully depleted its own. In the sequel, set ten years after the previous entry, a new protagonist crashes on the Red Planet's surface while trying to find the stolen ARK colony ships that might save humanity once and for all.

Despite the small size of the team, Deliver Us The Moon was among the first games to implement ray tracing and DLSS. Deliver Us Mars continues the tradition by featuring DLSS 3 support at launch in addition to ray traced reflections and shadows. According to the official benchmarks released by NVIDIA earlier this week, the game will run at nearly 120 average FPS on a 4070Ti GPU, nearly 154 FPS on a 4080 GPU, and nearly 181 FPS on a 4090 GPU with DLSS 3 enabled and Super Resolution set to Performance.

Wccftech recently spoke with a couple of team members from KeokeN to discuss NVIDIA DLSS 3 and other tech-related topics. As a reminder, Deliver Us Mars will also be released on February 2nd for PlayStation and Xbox consoles.

What was your first impression of DLSS 3 as a developer? Do you feel AI-based Frame Generation is the future of rendering to keep up with advanced ray tracing effects?

Daniel Torkar, Technical Artist: DLSS Frame Generation works wonders to add extra frames,
and it is amazing what NVIDIA has done. The added smoothness is well worth it, in our
opinion. With heavier games and more ray tracing effects now a standard part of the
modern PC gaming experience, it can help output higher frame rates which makes a huge
difference.

How much of an improvement does DLSS 3 introduce in your game compared to DLSS 2 (Super Resolution)? 

They really benefit from each other. DLSS 2 adds many improvements with minimal visual
drawbacks; DLSS Frame Generation can add extra smoothness, which as detailed above, is a
very worthwhile addition.

One of the potential drawbacks of DLSS 3 is the additional latency. Does Frame Generation add significant latency in your implementation, or is Reflex able to cover that?

It adds a little bit of latency, but our game isn’t very input latency sensitive. Reflex absolutely helps to minimise the latency, and we feel there’s no meaningful impact on responsiveness in Deliver Us Mars.

Do you have an ETA on when DLSS 3 will be added to your game?

We can confirm that we are shipping Deliver Us Mars with DLSS 3 on launch, February 2nd.

The GeForce RTX 4000 Series also introduced Shader Execution Reordering (SER), Opacity Micro-Maps (OMM), and Displaced Micro-Mesh (DMM) to help with ray tracing optimization. All of these have to be explicitly enabled and set up by game developers. Are you planning to take advantage of any of them?

We do not use these techniques, honestly. Our team is relatively small and so we don’t have the people to implement them as it stands.

Lastly, what do you think of RTX Remix as a developer? 

Gerben Pasjes, Art Director: RTX Remix seems like a super interesting tool for young kids to
get their feet wet in game development before moving on to other forms of modding or
building their own games. It’s very accessible and looks easy to use from a UX standpoint.

Daniel: RTX Remix brings amazing tools to modding, and I’m very excited to see what people
can do with older games. Also, what Gerben said, but not just limited to young kids.

Thank you for your time.

The post Deliver Us Mars Tech Q&A – ‘DLSS 3 Works Wonders, It’s Amazing What NVIDIA Has Done’ by Alessio Palumbo appeared first on Wccftech.

30 Jan 20:18

Wolfenstein: Enemy Territory open source project ET: Legacy has a new release

by Liam Dawe
ET: Legacy continues carrying the torch of the classic multiplayer title Wolfenstein: Enemy Territory, with a new release out that has lots of fixes.
30 Jan 20:18

January 30 - February 5

by Felix Threepaper

Welcome folks, and happy “50th Anniversary of the first Kiss concert” week!

30 Jan 20:13

Unreal Prototype Remaster in Unreal Engine 4 available for download

by John Papadopoulos

Now here is something that completely passed under my radar. Last year, YouTube’s “exo7341” released a prototype remaster of the first classic Unreal game in Unreal Engine 4. And this is so cool that it definitely deserves your attention. I know, I know, shame on me for not discovering this project earlier. However, you should … Continue reading Unreal Prototype Remaster in Unreal Engine 4 available for download →

The post Unreal Prototype Remaster in Unreal Engine 4 available for download appeared first on DSOGaming.