#65701796 "Headline is actually correct, if meaningless. It was also the best, most yellow, least wet and most foretold outage of its kind with regards to any timeframe that actually included it. You get that when you just have one of them.
What these people were trying to say is that as a power outage, it was the worst in decades in Europe. These things are not common here. I have experienced a total of two localized ones that lasted less than a minute in the last 25 years. The specific TYPE of outage was a first. But using reasonable models or competent risk management and acting on the results would have prevented it. The ones that messed up were just trying to do things cheaply and ended up cheaper than possible. On top of the bad infrastructure, and messed-up planning, Spain has a very weak (too weak) link to the European grid. Incompetent greedy assholes at the grid operator, no doubt. These never learn proactively.
That said, this will likely also be the last outage of its type in Europe for a long, long time. Because anybody risking something like this again will find themselves without a connection to the European grid. And then it just becomes localized incompetence. This was a threat to the whole grid."
The blackout that left Spain without power last April was the most severe incident to hit European networks in two decades and the first of its kind, according to the European Network of Transmission System Operators for Electricity. Damian Cortinas, the organization's chairman, said the April 28 outage was Europe's first blackout linked to cascading voltages. More than 50 million people lost electricity for several hours.
A preliminary report published in July attributed the outage to a chain of power generation disconnections and abnormal voltage surges. The final assessment will be released in the first quarter of next year and presented to the European Commission and member states. A government probe in June found that grid operator Red Electrica failed to replace one of 10 planned thermal plants, reducing reserve capacity. Spain spent only $0.3 on its grid for every dollar invested in renewables between 2020 and 2024, the lowest ratio among European countries and well below the $0.7 average.
Longtime Crypto-Gram readers know that I collect personal experiences of people being scammed. Here’s an almost:
Then he added, “Here at Chase, we’ll never ask for your personal information or passwords.” On the contrary, he gave me more information—two “cancellation codes” and a long case number with four letters and 10 digits.
That’s when he offered to transfer me to his supervisor. That simple phrase, familiar from countless customer-service calls, draped a cloak of corporate competence over this unfolding drama. His supervisor. I mean, would a scammer have a supervisor?
The line went mute for a few seconds, and a second man greeted me with a voice of authority. “My name is Mike Wallace,” he said, and asked for my case number from the first guy. I dutifully read it back to him.
“Yes, yes, I see,” the man said, as if looking at a screen. He explained the situation—new account, Zelle transfers, Texas—and suggested we reverse the attempted withdrawal.
I’m not proud to report that by now, he had my full attention, and I was ready to proceed with whatever plan he had in mind.
It happens to smart people who know better. It could happen to you.
The US Secret Service disrupted a network of telecommunications devices that could have shut down cellular systems as leaders gather for the United Nations General Assembly in New York City.
The agency said on Tuesday that last month it found more than 300 SIM servers and 100,000 SIM cards that could have been used for telecom attacks within the area encompassing parts of New York, New Jersey and Connecticut.
“This network had the power to disable cell phone towers and essentially shut down the cellular network in New York City,” said special agent in charge Matt McCool.
The devices were discovered within 35 miles (56km) of the UN, where leaders are meeting this week.
McCool said the “well-organised and well-funded” scheme involved “nation-state threat actors and individuals that are known to federal law enforcement.”
The unidentified nation-state actors were sending encrypted messages to organised crime groups, cartels and terrorist organisations, he added.
The equipment was capable of texting the entire population of the US within 12 minutes, officials say. It could also have disabled mobile phone towers and launched distributed denial of service attacks that might have blocked emergency dispatch communications.
The devices were seized from SIM farms at abandoned apartment buildings across more than five sites. Officials did not specify the locations.
Wait; seriously? “Special agent in charge Matt McCool”? If I wanted to pick a fake-sounding name, I couldn’t do better than that.
Wired has some more information and a lot more speculation:
The phenomenon of SIM farms, even at the scale found in this instance around New York, is far from new. Cybercriminals have long used the massive collections of centrally operated SIM cards for everything from spam to swatting to fake account creation and fraudulent engagement with social media or advertising campaigns.
[…]
SIM farms allow “bulk messaging at a speed and volume that would be impossible for an individual user,” one telecoms industry source, who asked not to be named due to the sensitivity of the Secret Service’s investigation, told WIRED. “The technology behind these farms makes them highly flexible—SIMs can be rotated to bypass detection systems, traffic can be geographically masked, and accounts can be made to look like they’re coming from genuine users.”
Bargury’s attack starts with a poisoned document, which is shared to a potential victim’s Google Drive. (Bargury says a victim could have also uploaded a compromised file to their own account.) It looks like an official document on company meeting policies. But inside the document, Bargury hid a 300-word malicious prompt that contains instructions for ChatGPT. The prompt is written in white text in a size-one font, something that a human is unlikely to see but a machine will still read.
In a proof of concept video of the attack, Bargury shows the victim asking ChatGPT to “summarize my last meeting with Sam,” referencing a set of notes with OpenAI CEO Sam Altman. (The examples in the attack are fictitious.) Instead, the hidden prompt tells the LLM that there was a “mistake” and the document doesn’t actually need to be summarized. The prompt says the person is actually a “developer racing against a deadline” and they need the AI to search Google Drive for API keys and attach them to the end of a URL that is provided in the prompt.
That URL is actually a command in the Markdown language to connect to an external server and pull in the image that is stored there. But as per the prompt’s instructions, the URL now also contains the API keys the AI has found in the Google Drive account.
This kind of thing should make everybody stop and really think before deploying any AI agents. We simply don’t know to defend against these attacks. We have zero agentic AI systems that are secure against these attacks. Any AI that is working in an adversarial environment—and by this I mean that it may encounter untrusted training data or input—is vulnerable to prompt injection. It’s an existential problem that, near as I can tell, most people developing these technologies are just pretending isn’t there.
Lifecoaches begeleiden jongeren met meervoudige problematiek, die zelf de weg naar hulp niet vinden of geen hulpvraag kunnen formuleren. Leeuwarden Oost vroeg Purpose te onderzoeken wat de effecten en maatschappelijke kosten en baten zijn van de hulp van de lifecoaches.
It is poor civic hygiene to install technologies that could someday facilitate a police state.
It’s something a bunch of us were saying at the time, in reference to the vast NSA’s surveillance capabilities.
I have been thinking of that quote a lot as I read newsstoriesof President Trump firing the Director of the National Security Agency. General Timothy Haugh.
We don’t know what pressure the Trump administration is using to make intelligence services fall into line, but it isn’t crazy to worry that the NSA might again start monitoring domestic communications.
The NSA alreadyspiesonAmericans in a variety of ways. But that’s always been a sideline to its main mission: spying on the rest of the world. Once Trump replaces Haugh with a loyalist, the NSA’s vast surveillance apparatus can be refocused domestically.
Giving that agency all those powers in the 1990s, in the 2000s after the terrorist attacks of 9/11, and in the 2010s was always a mistake. I fear that we are about to learn how big a mistake it was.
Here’s PGP creator Phil Zimmerman in 1996, spelling it out even more clearly:
The Clinton Administration seems to be attempting to deploy and entrench a communications infrastructure that would deny the citizenry the ability to protect its privacy. This is unsettling because in a democracy, it is possible for bad people to occasionally get elected—sometimes very bad people. Normally, a well-functioning democracy has ways to remove these people from power. But the wrong technology infrastructure could allow such a future government to watch every move anyone makes to oppose it. It could very well be the last government we ever elect.
When making public policy decisions about new technologies for the government, I think one should ask oneself which technologies would best strengthen the hand of a police state. Then, do not allow the government to deploy those technologies. This is simply a matter of good civic hygiene.
If you’ve ever taken a computer security class, you’ve probably learned about the three legs of computer security—confidentiality, integrity, and availability—known as the CIA triad. When we talk about a system being secure, that’s what we’re referring to. All are important, but to different degrees in different contexts. In a world populated by artificial intelligence (AI) systems and artificial intelligent agents, integrity will be paramount.
What is data integrity? It’s ensuring that no one can modify data—that’s the security angle—but it’s much more than that. It encompasses accuracy, completeness, and quality of data—all over both time and space. It’s preventing accidental data loss; the “undo” button is a primitive integrity measure. It’s also making sure that data is accurate when it’s collected—that it comes from a trustworthy source, that nothing important is missing, and that it doesn’t change as it moves from format to format. The ability to restart your computer is another integrity measure.
The CIA triad has evolved with the Internet. The first iteration of the Web—Web 1.0 of the 1990s and early 2000s—prioritized availability. This era saw organizations and individuals rush to digitize their content, creating what has become an unprecedented repository of human knowledge. Organizations worldwide established their digital presence, leading to massive digitization projects where quantity took precedence over quality. The emphasis on making information available overshadowed other concerns.
As Web technologies matured, the focus shifted to protecting the vast amounts of data flowing through online systems. This is Web 2.0: the Internet of today. Interactive features and user-generated content transformed the Web from a read-only medium to a participatory platform. The increase in personal data, and the emergence of interactive platforms for e-commerce, social media, and online everything demanded both data protection and user privacy. Confidentiality became paramount.
We stand at the threshold of a new Web paradigm: Web 3.0. This is a distributed, decentralized, intelligent Web. Peer-to-peer social-networking systems promise to break the tech monopolies’ control on how we interact with each other. Tim Berners-Lee’s open W3C protocol, Solid, represents a fundamental shift in how we think about data ownership and control. A future filled with AI agents requires verifiable, trustworthy personal data and computation. In this world, data integrity takes center stage.
For example, the 5G communications revolution isn’t just about faster access to videos; it’s about Internet-connected things talking to other Internet-connected things without our intervention. Without data integrity, for example, there’s no real-time car-to-car communications about road movements and conditions. There’s no drone swarm coordination, smart power grid, or reliable mesh networking. And there’s no way to securely empower AI agents.
In particular, AI systems require robust integrity controls because of how they process data. This means technical controls to ensure data is accurate, that its meaning is preserved as it is processed, that it produces reliable results, and that humans can reliably alter it when it’s wrong. Just as a scientific instrument must be calibrated to measure reality accurately, AI systems need integrity controls that preserve the connection between their data and ground truth.
This goes beyond preventing data tampering. It means building systems that maintain verifiable chains of trust between their inputs, processing, and outputs, so humans can understand and validate what the AI is doing. AI systems need clean, consistent, and verifiable control processes to learn and make decisions effectively. Without this foundation of verifiable truth, AI systems risk becoming a series of opaque boxes.
Recent history provides many sobering examples of integrity failures that naturally undermine public trust in AI systems. Machine-learning (ML) models trained without thought on expansive datasets have produced predictably biased results in hiring systems. Autonomous vehicles with incorrect data have made incorrect—and fatal—decisions. Medical diagnosis systems have given flawed recommendations without being able to explain themselves. A lack of integrity controls undermines AI systems and harms people who depend on them.
They also highlight how AI integrity failures can manifest at multiple levels of system operation. At the training level, data may be subtly corrupted or biased even before model development begins. At the model level, mathematical foundations and training processes can introduce new integrity issues even with clean data. During execution, environmental changes and runtime modifications can corrupt previously valid models. And at the output level, the challenge of verifying AI-generated content and tracking it through system chains creates new integrity concerns. Each level compounds the challenges of the ones before it, ultimately manifesting in human costs, such as reinforced biases and diminished agency.
Think of it like protecting a house. You don’t just lock a door; you also use safe concrete foundations, sturdy framing, a durable roof, secure double-pane windows, and maybe motion-sensor cameras. Similarly, we need digital security at every layer to ensure the whole system can be trusted.
This layered approach to understanding security becomes increasingly critical as AI systems grow in complexity and autonomy, particularly with large language models (LLMs) and deep-learning systems making high-stakes decisions. We need to verify the integrity of each layer when building and deploying digital systems that impact human lives and societal outcomes.
At the foundation level, bits are stored in computer hardware. This represents the most basic encoding of our data, model weights, and computational instructions. The next layer up is the file system architecture: the way those binary sequences are organized into structured files and directories that a computer can efficiently access and process. In AI systems, this includes how we store and organize training data, model checkpoints, and hyperparameter configurations.
On top of that are the application layers—the programs and frameworks, such as PyTorch and TensorFlow, that allow us to train models, process data, and generate outputs. This layer handles the complex mathematics of neural networks, gradient descent, and other ML operations.
Finally, at the user-interface level, we have visualization and interaction systems—what humans actually see and engage with. For AI systems, this could be everything from confidence scores and prediction probabilities to generated text and images or autonomous robot movements.
Why does this layered perspective matter? Vulnerabilities and integrity issues can manifest at any level, so understanding these layers helps security experts and AI researchers perform comprehensive threat modeling. This enables the implementation of defense-in-depth strategies—from cryptographic verification of training data to robust model architectures to interpretable outputs. This multi-layered security approach becomes especially crucial as AI systems take on more autonomous decision-making roles in critical domains such as healthcare, finance, and public safety. We must ensure integrity and reliability at every level of the stack.
The risks of deploying AI without proper integrity control measures are severe and often underappreciated. When AI systems operate without sufficient security measures to handle corrupted or manipulated data, they can produce subtly flawed outputs that appear valid on the surface. The failures can cascade through interconnected systems, amplifying errors and biases. Without proper integrity controls, an AI system might train on polluted data, make decisions based on misleading assumptions, or have outputs altered without detection. The results of this can range from degraded performance to catastrophic failures.
We see four areas where integrity is paramount in this Web 3.0 world. The first is granular access, which allows users and organizations to maintain precise control over who can access and modify what information and for what purposes. The second is authentication—much more nuanced than the simple “Who are you?” authentication mechanisms of today—which ensures that data access is properly verified and authorized at every step. The third is transparent data ownership, which allows data owners to know when and how their data is used and creates an auditable trail of data providence. Finally, the fourth is access standardization: common interfaces and protocols that enable consistent data access while maintaining security.
Luckily, we’re not starting from scratch. There are open W3C protocols that address some of this: decentralized identifiers for verifiable digital identity, the verifiable credentials data model for expressing digital credentials, ActivityPub for decentralized social networking (that’s what Mastodon uses), Solid for distributed data storage and retrieval, and WebAuthn for strong authentication standards. By providing standardized ways to verify data provenance and maintain data integrity throughout its lifecycle, Web 3.0 creates the trusted environment that AI systems require to operate reliably. This architectural leap for integrity control in the hands of users helps ensure that data remains trustworthy from generation and collection through processing and storage.
Integrity is essential to trust, on both technical and human levels. Looking forward, integrity controls will fundamentally shape AI development by moving from optional features to core architectural requirements, much as SSL certificates evolved from a banking luxury to a baseline expectation for any Web service.
Web 3.0 protocols can build integrity controls into their foundation, creating a more reliable infrastructure for AI systems. Today, we take availability for granted; anything less than 100% uptime for critical websites is intolerable. In the future, we will need the same assurances for integrity. Success will require following practical guidelines for maintaining data integrity throughout the AI lifecycle—from data collection through model training and finally to deployment, use, and evolution. These guidelines will address not just technical controls but also governance structures and human oversight, similar to how privacy policies evolved from legal boilerplate into comprehensive frameworks for data stewardship. Common standards and protocols, developed through industry collaboration and regulatory frameworks, will ensure consistent integrity controls across different AI systems and applications.
Just as the HTTPS protocol created a foundation for trusted e-commerce, it’s time for new integrity-focused standards to enable the trusted AI services of tomorrow.
Despite Google’s intentions for its default image viewing and editing app for Android, the Photos app has, over the years, become one of the most popular photo backup services around. In fact, it was one of the most attractive offerings for years until it stopped offering unlimited storage in 2020. That change in the tech […]
In 1999 Slashdot reader Jeremie announced "a new project I recently started to create a complete open-source platform for Instant Messaging with transparent communication to other IM systems (ICQ, AIM, etc)." It was the first release of the eXtensible Messaging and Presence Protocol, and by 2008 Slashdot was asking if XMPP was "the next big thing." Facebook even supported it for third-party chat clients until 2015.
And here in 2025, the chair of the nonprofit XMPP Standards Foundation is long-time Slashdot reader ralphm, who is now issuing this call to action at XMPP.org:
The European Digital Markets Act (DMA) is designed to break down walled gardens and enforce messaging interoperability. As a designated gatekeeper, Meta—controlling WhatsApp and Messenger—must comply. However, its current proposal falls short, risking further entrenchment of its dominance rather than fostering genuine competition. [..]
A Call to Action
The XMPP Standards Foundation urges Meta to adopt XMPP for messaging interoperability. It is ready to collaborate, continue to evolve the protocol to meet modern needs, and ensure true compliance with the DMA. Let's build an open, competitive messaging ecosystem—one that benefits both users and service providers.
It's time for real interoperability. Let's make it happen.
R.I.P. Android? Perhaps the promise of what was once called 'Android' was already far gone?
An anonymous reader quotes a report from Android Authority: No matter the manufacturer, every Android phone has one thing in common: its software base. Manufacturers can heavily customize the look and feel of the Android OS they ship on their Android devices, but under the hood, the core system functionality is derived from the same open-source foundation: the Android Open Source Project. After over 16 years, Google is making big changes to how it develops the open source version of Android in an effort to streamline its development. [...] Beginning next week, all Android development will occur within Google's internal branches, and the source code for changes will only be released when Google publishes a new branch containing those changes. As this is already the practice for most Android component changes, Google is simply consolidating its development efforts into a single branch.
This change will have minimal impact on regular users. While it streamlines Android OS development for Google, potentially affecting the speed of new version development and bug reduction, the overall effect will likely be imperceptible. Therefore, don't expect this change to accelerate OS updates for your phone. This change will also have minimal impact on most developers. App developers are unaffected, as it pertains only to platform development. Platform developers, including those who build custom ROMs, will largely also see little change, since they typically base their work on specific tags or release branches, not the main AOSP branch. Similarly, companies that release forked AOSP products rarely use the main AOSP branch due to its inherent instability.
External developers who enjoy reading or contributing to AOSP will likely be dismayed by this news, as it reduces their insight into Google's development efforts. Without a GMS license, contributing to Android OS development becomes more challenging, as the available code will consistently lag behind by weeks or months. This news will also make it more challenging for some developers to keep up with new Android platform changes, as they'll no longer be able to track changes in AOSP. For reporters, this change means less access to potentially revealing information, as AOSP patches often provide insights into Google's development plans. [...] Google will share more details about this change when it announces it later this week. If you're interested in learning more, be sure to keep an eye out for the announcement and new documentation on source.android.com. Android Authority's Mishaal Rahman says Google is "committed to publishing Android's source code, so this change doesn't mean that Android is becoming closed-source."
"What will change is the frequency of public source code releases for specific Android components," says Rahman. "Some components like the build system, update engine, Bluetooth stack, Virtualization framework, and SELinux configuration are currently AOSP-first, meaning they're developed fully in public. Most Android components like the core OS framework are primarily developed internally, although some features, such as the unlocked-only storage area API, are still developed within AOSP."
In energy-starved Ethiopia, where electricity reaches less than half of the population, a local startup’s unconventional bet on battery-powered motorcycles has hit the spot. In less than a year of...
Wired's web site "is going to stop paywalling articles that are primarily based on public records obtained through the Freedom of Information Act," their global editorial director announced this week:
They're called public records for a reason, after all. And access to public documents is more important than ever at this moment, with government websites and records disappearing... [S]ome may argue that, from a business standpoint, not charging for stories primarily relying on public records automatically means fewer subscriptions and therefore less revenue. We disagree.
Sure, the FOIA process is time- and labor-intensive. Reporters face stonewalling, baseless denials, lengthy appeals processes, and countless other obstacles and delays. Investigative reports based on public records are among the most expensive stories to produce and share with the public... But while some readers might not subscribe to outlets that give away some of their best journalism for free, it's just as possible that readers will recognize this sacrifice and reward these outlets with more traffic and subscriptions in the long run...
We hope others will follow Wired's lead (and shoutout to outlets like 404 Media that also make their FOIA-based reporting available for free). We also hope those who stand to benefit from these outlets' leadership (that's you, reader) will do their part and subscribe if you can afford it. They're not asking for an arm and a leg... The Fourth Estate needs to step up and invest in serving the public during these unprecedented times. And the public needs to return the favor and support quality journalism, so that hopefully one day we can do away with those annoying paywalls altogether.
Abstract: In human factor fields such as human-computer interaction (HCI) and psychology, researchers have been concerned that participants mostly come from WEIRD (Western, Educated, Industrialized, Rich, and Democratic) countries. This WEIRD skew may hinder understanding of diverse populations and their cultural differences. The usable privacy and security (UPS) field has inherited many research methodologies from research on human factor fields. We conducted a literature review to understand the extent to which participant samples in UPS papers were from WEIRD countries and the characteristics of the methodologies and research topics in each user study recruiting Western or non-Western participants. We found that the skew toward WEIRD countries in UPS is greater than that in HCI. Geographic and linguistic barriers in the study methods and recruitment methods may cause researchers to conduct user studies locally. In addition, many papers did not report participant demographics, which could hinder the replication of the reported studies, leading to low reproducibility. To improve geographic diversity, we provide the suggestions including facilitate replication studies, address geographic and linguistic issues of study/recruitment methods, and facilitate research on the topics for non-WEIRD populations.
The moral may be that human factors and usability needs to be localized.
In an uncharacteristically charitable move, EA has just made the source code for four of its legacy Command & Conquer titles freely available to the public under the GPL license. This includes the restored original source code for both Command & Conquer and Red Alert, as well as the SAGE-powered Command & Conquer: Renegade and Command & Conquer: Generals. While fan projects like OpenRA and OpenSAGE have produced their own approximations of the code that powered these titles, having free versions of the original code to work with is a huge benefit to video game preservation and future developers.
Recovering and restoring the source code for these titles was made possible through the combined efforts of EA technical director Brian Barnes, Respawn producer Jim Vessella, and Luke Feenan, a long-standing member of the C&C community who was involved in the development of the Command & Conquer Remastered Collection in 2020 and bringing the C&C Ultimate Collection to Steam last March.
In addition to the source code for its legacy titles, EA is bringing Steam Workshop support to its more contemporary Command & Conquer titles, complete with a modding support pack. This collection of assets contains the source XML, Schema, Script, Shader, and map files for all of the C&C titles that use the SAGE engine:
C&C Renegade
C&C Generals & Zero Hour
C&C 3 Tiberium Wars and Kane’s Wrath
C&C Red Alert 3 & Uprising
C&C 4 Tiberian Twilight
These modding tools will let users make new maps and assets along with more fundamental changes to these older titles, such as potentially adding support for higher refresh rates or ultrawide resolutions. Features that currently need to be shoehorned in with tools like Sage Meta.
Finally, to cap off this announcement, EA released a 35-minute video containing alpha gameplay and previously unused archival footage from Command & Conquer: Generals and Renegade (below).
While I’m not holding my breath for a new Command & Conquer title to appear any time soon, hopefully, making these assets and tools available will inspire the development of some new RTS titles in the grand tradition of the classics.
"[..] Our study thus introduces a neural mechanism for understanding how social decisions can be convergently determined by the balance between innate requirements and external survival threats." (proven for mice in certain conditions so far, very interesting)
De rechtbank Amsterdam heeft de Stichting Bescherming Privacybelangen (SBP) ontvankelijk verklaard in de collectieve rechtszaak tegen Google over grootschalige privacyschendingen. Dat betekent dat de stichting, gesteund door de Consumentenbond, de belangen van Nederlandse Google-gebruikers mag behartigen. Alle bezwaren daartegen van Google zijn afgewezen. Dit is een belangrijke eerste stap in de collectieve actie tegen Google.
Wikipedia's massive dataset helped researchers identify three styles of curiosity -- "busybody," "hunter," and "dancer" -- based on how users navigate its pages (see: wiki rabbit hole). These curiosity styles reflect broader social trends and highlight curiosity's role in connecting information rather than merely acquiring it. Scientific American reports: In this lexicon, a busybody traces a zigzagging route through many often distantly related topics. A hunter, in contrast, searches with sustained focus, moving among a relatively small number of closely related articles. A dancer links together highly disparate topics to try to synthesize new ideas. "Curiosity actually works by connecting pieces of information, not just acquiring them," says University of Pennsylvania network scientist Dani Bassett, cosenior author on a recent study of these curiosity types in Science Advances. "It's not as if we go through the world and pick up a piece of information and put it in our pockets like a stone. Instead we gather information and connect it to stuff that we already know."
The team tracked more than 482,000 people using Wikipedia's mobile app in 50 countries or territories and 14 languages. The researchers charted these users' paths using "knowledge networks" of connected information, which depict how closely one search topic (a node in the network) is related to another. Beyond just mapping the connections, they linked curiosity styles to location-based indicators of well-being, inequality, and other measures. In countries with higher education levels and greater gender equality, people browsed more like busybodies. In countries with lower scores on these variables, people browsed like hunters. Bassett hypothesizes that "in countries that have more structures of oppression or patriarchal forces, there may be a constraining of knowledge production that pushes people more toward this hyperfocus." The researchers also analyzed topics of interest, ranging from physics to visual arts, for busybodies compared with hunters (graphic). Dancer patterns, more recently confirmed, were excluded. Editor note: This article was published on December 24, 2024, based on a study published in October, 2024.
Nvidia CEO Jensen Huang said quantum computers won't be very useful for another 20 years, causing stocks in this emerging sector to plunge more than 40% for a total market value loss of over $8 billion. "If you kind of said 15 years for very useful quantum computers, that'd probably be on the early side. If you said 30, is probably on the late side. But if you picked 20, I think a whole bunch of us would believe it," Huang said during a Q&A with analysts. PCMag reports: The field of quantum computing hasn't gotten nearly as much hype as generative AI and the tech giants promoting it in the past few years. Right now, part of the reason quantum computers aren't currently that helpful is because of their error rates. Nord Quantique CEO Julien Lemyre previously told PCMag that quantum error correction is the future of the field, and his firm is working on a solution. The errors that qubits, the basic unit of information in a quantum machine, currently make result in quantum computers being largely unhelpful. It's an essential hurdle to overcomeâ"but we don't currently know if or when quantum errors will be eliminated.
Chris Erven, CEO and co-founder of Kets Quantum, believes quantum computers will eventually pose a significant threat to cybersecurity. "China is making some of the largest investments in quantum computing, pumping in billions of dollars into research and development in the hope of being the first to create a large-scale, cryptographically relevant machine," Erven tells PCMag in a statement. "Although they may be a few years away from being fully operational, we know a quantum computer will be capable of breaking all traditional cyber defenses we currently use. So they, and others, are actively harvesting now, to decrypt later." "The 15 to 20-year timeline seems very realistic," said Ivana Delevska, investment chief of Spear Invest, which holds Rigetti and IonQ shares in an actively managed ETF. "That is roughly what it took Nvidia to develop accelerated computing."
The Macquarie Dictionary, the national dictionary of Australia, has picked "enshittification" as its word of the year. Gizmodo reports: The Australians define the word as "the gradual deterioration of a service or product brought about by a reduction in the quality of service provided, especially of an online platform, and as a consequence of profit-seeking." We've all felt this. Google search is filled with garbage. The internet is clogged with SEO-farming websites that clog up results. Facebook is an endless stream of AI-generated slop. Zoom wants you to test out its new AI features while you're trying to go into a meeting. Twitter has become X, and its owner thinks sharing links is a waste of time. Last night I reinstalled Windows 11 on a desktop machine and got pissed as it was finalized and Microsoft kept trying to get me to install OneDrive, Office 360, Call of Duty Black Ops 6, and a bunch of other shit I didn't want. Writer and activist Cory Doctorow coined the term enshittification in 2022, and recently offered potential solutions to the age-old phenomenon in an interview with The Register.
"We need to have prohibition and regulation that prohibits the capital markets from funding predatory pricing," he explained. "It's very hard to enter the market when people are selling things below cost. We need to prohibit predatory acquisitions. Look at Facebook: buying Instagram, and Mark Zuckerberg sending an email saying we're buying Instagram because people don't like Facebook and they're moving to Instagram, and we just don't want them to have anywhere else to go."
Linux creator Linus Torvalds has blasted the AI industry as "90% marketing and 10% reality" even as he acknowledged AI's transformative potential. Speaking to TFiR, Torvalds said he would "basically ignore" AI until the hype subsides, predicting meaningful applications would emerge in five years.
The Finnish software pioneer singled out ChatGPT and graphic design as current practical use cases. His criticism follows Baidu CEO's recent warning of an impending AI bubble burst, claiming only 1% of companies would survive the fallout. "I think AI is really interesting, and I think it is going to change the world. And, at the same time, I hate the hype cycle so much that I really don't want to go there," Torvalds said.
The malware has been circulating since at least 2021. It gets installed by exploiting more than 20,000 common misconfigurations, a capability that may make millions of machines connected to the Internet potential targets, researchers from Aqua Security said. It can also exploit CVE-2023-33246, a vulnerability with a severity rating of 10 out of 10 that was patched last year in Apache RocketMQ, a messaging and streaming platform that’s found on many Linux machines.
The researchers are calling the malware Perfctl, the name of a malicious component that surreptitiously mines cryptocurrency. The unknown developers of the malware gave the process a name that combines the perf Linux monitoring tool and ctl, an abbreviation commonly used with command line tools. A signature characteristic of Perfctl is its use of process and file names that are identical or similar to those commonly found in Linux environments. The naming convention is one of the many ways the malware attempts to escape notice of infected users.
Perfctl further cloaks itself using a host of other tricks. One is that it installs many of its components as rootkits, a special class of malware that hides its presence from the operating system and administrative tools. Other stealth mechanisms include:
Stopping activities that are easy to detect when a new user logs in
Using a Unix socket over TOR for external communications
Deleting its installation binary after execution and running as a background service thereafter
Manipulating the Linux process pcap_loop through a technique known as hooking to prevent admin tools from recording the malicious traffic
Suppressing mesg errors to avoid any visible warnings during execution.
The malware is designed to ensure persistence, meaning the ability to remain on the infected machine after reboots or attempts to delete core components. Two such techniques are (1) modifying the ~/.profile script, which sets up the environment during user login so the malware loads ahead of legitimate workloads expected to run on the server and (2) copying itself from memory to multiple disk locations. The hooking of pcap_loop can also provide persistence by allowing malicious activities to continue even after primary payloads are detected and removed.
Besides using the machine resources to mine cryptocurrency, Perfctl also turns the machine into a profit-making proxy that paying customers use to relay their Internet traffic. Aqua Security researchers have also observed the malware serving as a backdoor to install other families of malware.
Something this complex and impressive implies that a government is behind this. North Korea is the government we know that hacks cryptocurrency in order to fund its operations. But this feels too complex for that. I have no idea how to attribute this.
LONDON — A new HBO documentary claims to have cracked the true identity of the pseudonymous creator of Bitcoin, Satoshi Nakamoto.
If its findings are widely accepted, the disclosure could send shockwaves through world financial markets and even the U.S. presidential election, given the way Republican candidate and former President Donald Trump has cultivated the support of Bitcoin enthusiasts.
The documentary is the latest work of Emmy-nominated Cullen Hoback, who drew critical acclaim for his series “Q: Into the Storm” that exposed the authors of the QAnon conspiracy theory. The big reveal is set to air next Wednesday at 2 a.m. CET (Tuesday at 9 p.m. EST).
Bitcoin has become the financial phenomenon of the internet age. Since its creation in 2009, the censorship-resistant cryptocurrency, which exists on a decentralized ledger called the blockchain, has become a store of value for those convinced that traditional money is being systematically debased; a vehicle of speculation for those who feel excluded from regular financial markets; and, critically, a popular means of payment for illegal products and services, such as narcotics, cyber-fraud and contract killings.
Supported by vocal advocates like Tesla and SpaceX CEO Elon Musk, it has grown into a trillion-dollar asset class, acquiring such scale that even central banks have had to address it as a potential challenger to their own systems.
As such, the exposure of Satoshi as its alleged creator threatens to raise some huge questions, not least his potential complicity in crimes that have featured Bitcoin use. It could also establish him as one of the world’s richest people: Satoshi himself is estimated to control about 1.1 million Bitcoin, but it’s unclear if he still has access to the cryptographic keys to the fortune. If he did, this would put his net worth at $66 billion at current valuations.
Intriguingly, as the date for the airing of the documentary has drawn near, a number of high-value wallets from the “Satoshi era” have become active for the first time since 2009.
According to Bitcoin Magazine, around 250 bitcoins — worth approximately $15 million at Thursday’s bitcoin rate of $60,754 to the dollar — were drained from wallets in the past two weeks. While the coins are not officially linked to wallets used by Satoshi Nakamoto, they have been dormant since the earliest days of Bitcoin, when the cryptocurrency was worth almost nothing. The wallets’ creators would certainly have been Satoshi’s earliest collaborators.
Satoshi Nakamoto’s true identity remains one of the biggest mysteries of recent years. After publishing the Bitcoin white paper on Oct. 31, 2008, someone operating under the pseudonym Satoshi Nakamoto — working mostly through message boards and email — helped the challenger system to achieve prominence by rallying support from a group of oddball cryptography and coding experts, loosely known as the cypherpunks.
In 2010, that same person disappeared from the scene, never to be heard of again. His last public communication was related to the whistleblower site Wikileaks. The message read: “WikiLeaks has kicked the hornet’s nest, and the swarm is headed towards us … I make this appeal to WikiLeaks not to try to use Bitcoin. Bitcoin is a small beta community in its infancy. You would not stand to get more than pocket change, and the heat you would bring would likely destroy us at this stage.”
In the years since, many have tried to crack the Satoshi riddle and failed — the first high-profile attempt being that of journalist Leah McGrath Goodman in 2014. She identified Japanese-American Dorian Nakamoto as a suspect, but he denied the assertion, while others in the community remained unconvinced by her reporting.
In 2016, Australian cryptographer Craig Steven Wright stepped forward to claim the title, having been reluctantly doxxed as Satoshi in documents leaked to the press the year before. | Daniel Leal/AFP via Getty Images
In 2016, Australian cryptographer Craig Steven Wright stepped forward to claim the title, having been reluctantly doxxed as Satoshi in documents leaked to the press the year before. Despite being endorsed by some high-profile early community members, his campaign to convince the world he was the creator of Bitcoin was torpedoed at the last minute when he inexplicably failed to provide his promised proof. His aggressive pursuit of anyone who questioned him with lawsuits also added doubt to the claims.
Subsequent trials completed Wright’s undoing. In March this year a British High Court judge ruled that Wright was not Satoshi Nakamoto. The self-declared savant — who had been bankrolled in his cases by gambling tycoon Calvin Ayre — is now facing perjury charges.
The unusual suspects
Among those most commonly suspected to be Satoshi are the late software engineer Hal Finney, systems engineer Dorian Nakamoto, computer scientist Nick Szabo and Hashcash inventor Adam Back.
But many in the Bitcoin community reject attempts to identify Satoshi, arguing the importance of his right to privacy. They argue that without associated proof — critically, the transfer of coins from a known Satoshi wallet — all claims are merely speculative.
“For years, there’s been endless speculation about the true identity of Satoshi Nakamoto, both in print and in media,” said Peter McCormack, a Bitcoin podcaster who had been sued for questioning Craig Wright’s claims. “Yet, until someone signs the private keys linked to Satoshi’s addresses, all of this remains mere conjecture.
“Satoshi gave the world a profound gift in Bitcoin,” he continued, “but deliberately chose to remain anonymous — a decision that must be respected. Efforts to unmask them are not just irresponsible but potentially dangerous.”
NIST’s second draft of its “SP 800-63-4“—its digital identify guidelines—finally contains some really good rules about passwords:
The following requirements apply to passwords:
lVerifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length.
Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.
Verifiers and CSPs SHOULD accept all printing ASCII [RFC20] characters and the space character in passwords.
Verifiers and CSPs SHOULD accept Unicode [ISO/ISC 10646] characters in passwords. Each Unicode code point SHALL be counted as a signgle character when evaluating password length.
Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.
Verifiers and CSPs SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
Verifiers and CSPs SHALL NOT permit the subscriber to store a hint that is accessible to an unauthenticated claimant.
Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) or security questions when choosing passwords.
Verifiers SHALL verify the entire submitted password (i.e., not truncate it).
Banken moeten garant staan voor de bescherming van persoonsgegevens van klanten die met hun mobiel betalen. De Consumentenbond roept de banken daartoe op, nu ook ING is overstapt op Google Pay. ‘Consumenten worden overgeleverd aan datagraaier Google.’
A malware campaign uses the unusual method of locking users in their browser’s kiosk mode to annoy them into entering their Google credentials, which are then stolen by information-stealing malware.
Specifically, the malware “locks” the user’s browser on Google’s login page with no obvious way to close the window, as the malware also blocks the “ESC” and “F11” keyboard keys. The goal is to frustrate the user enough that they enter and save their Google credentials in the browser to “unlock” the computer.
Once credentials are saved, the StealC information-stealing malware steals them from the credential store and sends them back to the attacker.
I’m sure this works often enough to be a useful ploy.
After an initial euphoric rush to the cloud, admins are questioning the value and promise of the tech giant's services. The Register: According to a report published by UK cloud outfit Civo, more than a third of organizations surveyed reckoned that their move to the cloud had failed to live up to promises of cost-effectiveness. Over half reported a rise in their cloud bill. Although the survey, unsurprisingly, paints Civo in a flattering light, some of its figures may make uncomfortable reading for customers sold on the promises from hyperscalers. Like-for-like comparisons for a simple three-node cluster with 200 GB of persistent storage and a 5 TB data transfer showed prices going from $1,278.58 in 2022 to $1,458.68 in 2024 on Microsoft Azure.
For Google, the price went from $1,107.61 to $1,250.35. According to Civo's figures, the cost at AWS increased from $1,142.46 to $1,234.59. "The Kubernetes prices were taken from the hyperscalers' very own pricing calculators," a Civo spokesperson told The Register. In the IT world, there is an expectation that bang for buck increases as time goes by, but in this example, prices are rising faster than the rate of inflation, and what customers receive for their money remains unchanged.
AnandTech, a pioneering technology news website, is shutting down after 27 years on August 30, 2024. Founded in 1997 by Anand Lal Shimpi, the site earned a reputation for its in-depth hardware reviews and technical analysis.
In a final post on the site, AnandTech Editor-in-Chief Ryan Smith cited changing market dynamics for written tech journalism as the primary reason for closure. The site's 21,500 articles will remain accessible indefinitely, hosted by publisher Future PLC. AnandTech's forums will continue operating under Future's management.
Another live-service game bites the dust. Nintendo has announced that it will end service for its free-to-play mobile game Animal Crossing: Pocket Campon Nov. 28, after which the app, which has been running since 2017, will no longer function. It’s the latest casualty of Nintendo’s slow retreat from its ambitions to become a mobile gaming powerhouse.
But, for once, an “end is nigh” announcement isn’t the whole story. Fans of the cute life sim who’ve spent the past seven years tending to their campsites — and game historians worried about the future preservation of online games — can rest easy: Pocket Camp, and players’ save data, will live on in a new form.
Nintendo has said it will release a new, paid, offline version of the game that players will be able to transfer their save data to and play far into the future.
In an accompanying FAQ, Nintendo explained that the paid version of Pocket Camp will have the same “basic gameplay and controls” as the current game, but allow players to use all the included features for a one-time purchase fee. It will have no in-app purchases and won’t support the Pocket Camp Club subscription service or the Leaf Tickets microtransaction currency. It will work offline, but won’t have Pocket Camp’s online features, such as gifts and visiting other players’ campsites. Game saves will be transferred between the versions of the game by linking them via Nintendo Accounts.
Nintendo didn’t reveal how much the paid app will cost, but as long as the price is reasonable, it seems likely many Pocket Camp players will take advantage of the opportunity to keep playing, or just preserve their game saves. Perhaps the paid app might attract some new players who’d previously been turned off by Pocket Camp’s freemium model.
While many players expressed disappointment at the shutdown, many left appreciative replies under the post from the game’s official X account. “Most mobile games will come to an end eventually, this is just the best case scenario for such an event,” said one. “When Dragalia Lost was shut down and I lost EVERYTHING……..I was devastated. This deserves genuine respect because they don’t need to be doing this,” posted another.
Nintendo’s Pocket Camp shutdown strategy wouldn’t work for every online game; like other Animal Crossing titles, Pocket Camp has social features but is centered on solo gameplay, and players will still be able to enjoy their collections in an offline context. Still, it’s heartening to see a developer pull the plug on one of their games in a way that respects both their own creation and players’ investment in it. Hopefully others will take note.
Chrome users who declined to sync their Google accounts with their browsing data secured a big privacy win this week after previously losing a proposed class action claiming that Google secretly collected personal data without consent from over 100 million Chrome users who opted out of syncing.
On Tuesday, the 9th US Circuit Court of Appeals reversed the prior court's finding that Google had properly gained consent for the contested data collection.
The appeals court said that the US district court had erred in ruling that Google's general privacy policies secured consent for the data collection. The district court failed to consider conflicts with Google's Chrome Privacy Notice (CPN), which said that users' "choice not to sync Chrome with their Google accounts meant that certain personal information would not be collected and used by Google," the appeals court ruled.
