Security researchers from Google have disclosed today a zero-day vulnerability in the Windows operating system that is currently under active exploitation. From a report: The zero-day is expected to be patched on November 10, which is the date of Microsoft's next Patch Tuesday, according to Ben Hawkes, team lead for Project Zero, Google's elite vulnerability research team. On Twitter, Hawkes said the Windows zero-day (tracked as CVE-2020-17087) was used as part of a two-punch attack, together with another a Chrome zero-day (tracked as CVE-2020-15999) that his team disclosed last week. The Chrome zero-day was used to allow attackers to run malicious code inside Chrome, while the Windows zero-day was the second part of this attack, allowing threat actors to escape Chrome's secure container and run code on the underlying operating system -- in what security experts call a sandbox escape.

Facebook revealed Thursday how internal technical glitches had disrupted the delivery of some ads from the Joe Biden and Donald Trump campaigns, but said it made changes to resolve those hiccups in the run-up to the November U.S. presidential election. From a report: The social media giant's admission followed complaints from the Biden camp about how thousands of its ads had been blocked. Facebook said in a blog post it spotted "unanticipated issues" affecting both campaigns, including technical flaws that caused a number of ads to be "paused improperly." "No ad was paused or rejected by a person, or because of any partisan consideration," Facebook said in its post. "The technical problems were automated and impacted ads from across the political spectrum and both Presidential campaigns."

An anonymous reader shares a report: Unless you're a physicist or an engineer, there really isn't much reason for you to know about partial differential equations. I know. After years of poring over them in undergrad while studying mechanical engineering, I've never used them since in the real world. But partial differential equations, or PDEs, are also kind of magical. They're a category of math equations that are really good at describing change over space and time, and thus very handy for describing the physical phenomena in our universe. They can be used to model everything from planetary orbits to plate tectonics to the air turbulence that disturbs a flight, which in turn allows us to do practical things like predict seismic activity and design safe planes. The catch is PDEs are notoriously hard to solve. And here, the meaning of "solve" is perhaps best illustrated by an example. Say you are trying to simulate air turbulence to test a new plane design. There is a known PDE called Navier-Stokes that is used to describe the motion of any fluid. "Solving" Navier-Stokes allows you to take a snapshot of the air's motion (a.k.a. wind conditions) at any point in time and model how it will continue to move, or how it was moving before.

These calculations are highly complex and computationally intensive, which is why disciplines that use a lot of PDEs often rely on supercomputers to do the math. It's also why the AI field has taken a special interest in these equations. If we could use deep learning to speed up the process of solving them, it could do a whole lot of good for scientific inquiry and engineering. Now researchers at Caltech have introduced a new deep-learning technique for solving PDEs that is dramatically more accurate than deep-learning methods developed previously. It's also much more generalizable, capable of solving entire families of PDEs -- such as the Navier-Stokes equation for any type of fluid -- without needing retraining. Finally, it is 1,000 times faster than traditional mathematical formulas, which would ease our reliance on supercomputers and increase our computational capacity to model even bigger problems. That's right. Bring it on.

New submitter B1948J writes: It's interesting that Honeywell is once again emerging as a computing hardware vendor. Over 50 years ago, Honeywell established itself as one of the big 3 computer mainframe manufacturers (Honeywell, Burroughs and IBM). Some say the Honeywell-200 introduced "channel architecture" before IBM "announced" it for their 360 series computers. Now, Honeywell is announcing its H1 Quantum Computer capable of a Quantum Value of 128 through 10 fully connected qubits.

WhatsApp, the popular instant messaging app owned by Facebook, is now delivering roughly 100 billion messages a day, the company's chief executive Mark Zuckerberg said at the quarterly earnings call Thursday. From a report: For some perspective, users exchanged 100 billion messages on WhatsApp last New Year's Eve. That is the day when WhatsApp tops its engagement figures, and as many of you may remember, also the time when the service customarily suffered glitches in the past years. (No outage on last New Year's Eve!) At this point, WhatsApp is just competing with itself. Facebook Messenger and WhatsApp together were used to exchange 60 billion messages a day as of early 2016.

While the rest of the U.S. economy languished earlier this year, the tech industry's biggest companies seemed immune to the downturn, surging as the country worked, learned and shopped from home. From a report: On Thursday, as the economy is showing signs of improvement, Amazon, Apple, Alphabet and Facebook reported profits that highlighted how a recovery may provide another catalyst to help them generate a level of wealth that hasn't been seen in a single industry in generations. With an entrenched audience of users and the financial resources to press their leads in areas like cloud computing, e-commerce and digital advertising, the companies demonstrated again that economic malaise, upstart competitors and feisty antitrust regulators have had little impact on their bottom line. Combined, the four companies reported a quarterly net profit of $38 billion.

Amazon reported record sales, and an almost 200 percent rise in profits, as the pandemic accelerated the transition to online shopping. Despite a boycott of its advertising over the summer, Facebook had another blockbuster quarter. Alphabet's record quarterly net profit was up 59 percent, as marketers plowed money into advertisements for Google search and YouTube. And Apple's sales rose even though the pandemic forced it to push back the iPhone 12's release to October, in the current quarter. On Tuesday, Microsoft, Amazon's closest competitor in cloud computing, also reported its most profitable quarter, growing 30 percent from a year earlier. "The scene that's playing out fundamentally is that these tech stalwarts are gaining more market share by the day," said Dan Ives, managing director of equity research at Wedbush Securities. "It's 'A Tale of Two Cities' for this group of tech companies and everyone else."

In preparation for next year's Xe HPG graphics cards, Intel's open-source developers have begun publishing their patches enabling their "ANC" Vulkan Linux driver to support Vulkan ray-tracing. Phoronix reports: Jason Ekstrand as the lead developer originally on the Intel ANV driver has posted today the initial ray-tracing code for ANV in order to support VK_KHR_ray_tracing for their forthcoming hardware. Today is the first time Intel has approved of this open-source code being published and more is on the way. The code today isn't enough for Vulkan ray-tracing but more is on the way and based against the latest internal Khronos ray-tracing specification. At the moment they are not focusing on the former NVIDIA-specific ray-tracing extension but may handle it in the future if game vendors continue targeting it rather than the forthcoming finalized KHR version.

Among other big ticket items still to come in the near-term includes extending the ANV driver to support compiling and dispatching OpenCL kernels, new SPIR-V capabilities, and generic pointer support. Also needed is the actual support for compiling ray-tracing pipelines, managing acceleration structures, dispatching rays, and the platform support. The actual exposing of the support won't come until after The Khronos Group has firmed up their VK_KHR_ray_tracing extension. Some of this Intel-specific Vulkan ray-tracing code may prove useful to Mesa's Radeon Vulkan "RADV" driver as well. Intel engineers have been testing their latest ray-tracing support with ANV internally on Xe HPG.

User growth in the United States in Canada -- the company's most lucrative ad market -- has declined, Facebook reported as part of its third-quarter earnings. Engadget reports: The company now has 196 million users in North America, down slightly from 198 million last quarter. In a statement, the company said the decrease was expected, and could continue through the end of the year. "As expected, in the third quarter of 2020, we saw Facebook DAUs and MAUs in the US & Canada decline slightly from the second quarter 2020 levels which were elevated due to the impact of the COVID-19 pandemic," Facebook wrote in a press release. "In the fourth quarter of 2020, we expect this trend to continue and that the number of DAUs and MAUs in the US & Canada will be flat or slightly down compared to the third quarter of 2020."

The company had previously reported a large surge in growth at the start of the year due to widespread coronavirus lockdowns. Facebook isn't seeing the same slowdown everywhere, though, and the social network is continuing to add new users in Asia and its "rest of world" markets. The company also continued to tout its "family of apps" metrics, which combines Facebook, Instagram, WhatsApp and Messenger. That number rose to 2.54 billion "daily active people" in September, according to the company. The slowdown also doesn't seem to have affected Facebook's revenue, which was up to $21.4 billion for the quarter, an increase of 22 percent from last year and better than analyst expectations for the company.

Researchers at Google say they've developing an AI system that can automatically convert webpages into short videos. From a report: It extracts assets like text and images and their design styles including fonts, colors, and graphical layouts from HTML sources and organizes the assets into a sequence of shots, maintaining a look and feel similar to the source page as it does so. Google envisions the system could be useful to businesses that host websites containing rich visual representations about their services or products. These assets, the company says, could be repurposed for videos, potentially enabling those without extensive resources to reach a broader audience. A typical video costs between $880 and $1,200 and can take days to weeks to produce. URL2Video, which was presented at the 2020 User Interface Software and Technology Symposium, automatically selects key content from a page and decides the temporal and visual presentation of each asset.

An anonymous reader quotes a report from The Register: The Brave web browser will soon block CNAME cloaking, a technique used by online marketers to defy privacy controls designed to prevent the use of third-party cookies. The browser security model makes a distinction between first-party domains -- those being visited -- and third-party domains -- from the suppliers of things like image assets or tracking code, to the visited site. Many of the online privacy abuses over the years have come from third-party resources like scripts and cookies, which is why third-party cookies are now blocked by default in Brave, Firefox, Safari, and Tor Browser.

In a blog post on Tuesday, Anton Lazarev, research engineer at Brave Software, and senior privacy researcher Peter Snyder, explain that online tracking scripts may use canonical name DNS records, known as CNAMEs, to make associated third-party tracking domains look like they're part of the first-party websites actually being visited. They point to the site https://mathon.fr/ as an example, noting that without CNAME uncloaking, Brave blocks six requests for tracking scripts served by ad companies like Google, Facebook, Criteo, Sirdan, and Trustpilot. But the page also makes four requests via a script hosted at a randomized path under the first-party subdomain 16ao.mathon.fr. When Brave 1.17 ships next month (currently available as a developer build), it will be able to uncloak the CNAME deception and block the Eulerian script. Other browser vendors are planning related defenses. "Mozilla has been working on a fix in Firefox since last November," notes The Register. "And in August, Apple's Safari WebKit team proposed a way to prevent CNAME cloaking from being used to bypass the seven-day cookie lifetime imposed by WebKit's Intelligent Tracking Protection system."

Microsoft is overhauling Excel with the ability to support custom live data types. The Verge reports: You could import the data type for Seattle, for example, and then create a formula that references that single cell to pull out information on the population of Seattle. These data types work by cramming a set of structured data into a single cell in Excel that can then be referenced by the rest of the spreadsheet. Data can also be refreshed to keep it up to date. If you're a student who is researching the periodic table, for example, you could create a cell for each element and easily pull out individual data from there.

Microsoft is bringing more than 100 new data types into Excel for Microsoft 365 Personal or Family subscribers. Excel users will be able to track stocks, pull in nutritional information for dieting plans, and much more, thanks to data from Wolfram Alpha's service. This is currently available for Office beta testers in the Insiders program. Where these custom data types will be most powerful is obviously for businesses that rely on Excel daily. Microsoft is leveraging its Power BI service to act as the connector to bring sources of data into Excel data types on the commercial side, allowing businesses to connect up a variety of data. This could be hierarchical data or even references to other data types and images. Businesses will even be able to convert existing cells into linked data types, making data analysis a lot easier.

Power BI won't be the only way for this feature to work, though. When you import data into Excel, you can now transform it into a data type with Power Query. That could include information from files, databases, websites, and more. The data that's imported can be cleaned up and then converted into a data type to be used in spreadsheets. If you've pulled in data using Power Query, it's easy to refresh the data from its original source. [...] These new Power BI data types will be available in Excel for Windows for all Microsoft 365 / Office 365 subscribers that also have a Power BI Pro service plan. Power Query data types are also rolling out to subscribers. On the consumer side, Wolfram Alpha data types are currently available in preview for Office insiders and should be available to all Microsoft 365 subscribers soon.

An anonymous reader quotes a report from The New York Times: China's Communist Party emerged from four days of meetings behind closed doors in Beijing declaring the country's leader, Xi Jinping, a "helmsman" who would lead "the ship of socialism sailing into the wind and waves with determination." At a time when other world leaders remain consumed by the coronavirus pandemic, China promised an economic revival, greater technological self-reliance and a stronger military to protect the country's economic and political interests. The meeting underscored Mr. Xi's seemingly boundless political control, as well as his ambitions to propel China out of the current crisis into a new phase of growth, less vulnerable to external risks. Here are the main outcomes from the meeting, which outlined policy priorities for the coming years.

Economic revival: After the shock from the coronavirus crisis of the first months of this year, China's economy returned to4.9 percent growth in the July-to-September quarter, and exports have revived strongly. In its five-year plan, China aims to expand domestic markets and encourage innovation across the economy -- from cutting-edge technology to more efficient farming -- the party leaders said in an official summary of their meeting. That summary did not offer specific growth projections from 2021.

Homegrown technology: The meeting of the party's Central Committee declared that China would make enhanced technological self-reliance a priority over the next 15 years. "Insist on the core status of innovation across all of our national modernization," the leaders said. "Make technological self-sufficiency a strategic pillar of national development."

Military modernization and security: The Central Committee declared that China's military -- one of Mr. Xi's core priorities since taking office in 2012 -- had improved greatly, even as it promised to make still more "major steps" to enhance the country's security. The committee did not detail any new programs but called for "comprehensively strengthening military training and preparedness."

Top banks, including JPMorgan Chase and Goldman Sachs, are battening down their technology hatches for next week's presidential election. From a report (paywalled): Around next Tuesday, the final day of voting, JPMorgan and Goldman will both halt software updates to the retail and investment banking systems their customers use to manage accounts, The Information has learned. It's a precaution intended to minimize the risk of outages of their services during a period of potential market volatility surrounding the election. Banks have good reason to institute these software code "freezes." Faulty software updates are one of the main culprits behind online service outages. While suspending software updates is common for banks during times of heightened market volatility, this year's election could be especially turbulent, with wide fears over civil unrest and contested election results.

Long-time Slashdot reader imAck writes: Glenn Greenwald announced via Twitter recently that he has resigned from The Intercept (and First Look Media), the former being a media outlet that he co-founded [in February 2014]. Purportedly, a recent attempt to constrain his editorial freedom was the incident that pushed him to make the decision. "Not content to simply prevent publication of this article at the media outlet I co-founded, these Intercept editors also demanded that I refrain from exercising a separate contractual right to publish this article with any other publication," an anonymous Slashdot reader quotes him as saying.

As The New York Times notes, Mr. Greenwald is "best known for his role in making public the National Security Agency documents leaked by Edward Snowden in 2013," which Slashdot covered extensively. "For now, Mr. Greenwald will be part of a growing number of journalists who have left major media outlets to try their luck at Substack, a group that includes Andrew Sullivan, formerly of New York Magazine, and Matt Taibbi, formerly of Rolling Stone."

Betsy Reed, Editor-in-Chief of The Intercept, responded to Greenwald's departure, saying there's a "fundamental disagreement over the role of editors in the production of journalism and the nature of censorship."

An anonymous reader shares a report: If you're a Google One subscriber, there's a new reason to consider the service's $10 per month 2TB plan. Google is adding built-in virtual private network (VPN) functionality to the Google One app, but you'll need to subscribe to the 2TB and above plans to access the perk. While the feature is built into Google One, the company says you can take advantage of it while using any other app on your Android phone to protect your online privacy. Moreover, with the family sharing feature that comes with Google One, five other people can get access to a VPN as well.

Hackers stole $2.3 million from the Wisconsin Republican Party's account that was being used to help reelect President Donald Trump in the key battleground state, the party's chairman told The Associated Press on Thursday. From a report: The party noticed the suspicious activity on Oct. 22 and contacted the FBI on Friday, said Republican Party Chairman Andrew Hitt. Hitt said the FBI is investigating. The attack was discovered less than two weeks before Election Day as both Trump and Democratic rival Joe Biden made their final push to win Wisconsin and its 10 electoral votes. Trump won the state by fewer than 23,000 votes in 2016 and planned his third visit in seven days on Friday. Biden also planned to campaign in Wisconsin on Friday. Polls have consistently shown a tight race in the state, usually with Biden ahead by single digits and within the margin of error.

An anonymous reader shares a report from the BBC: Facebook is being sued for failing to protect users' personal data in the Cambridge Analytica breach. The scandal involved harvested Facebook data of 87 million people being used for advertising during elections. Mass legal action is being launched against Facebook for misuse of information from almost one million users in England and Wales. Facebook said it has not received any documents regarding this claim. The group taking action -- Facebook You Owe Us -- follows a similar mass action law suit against Google. Google You Owe Us, led by former Which? director Richard Lloyd, is also active for another alleged mass data breach. Both represented by law firm Millberg London, the Google case is being heard in the Supreme Court in April next year.

The Facebook case will argue that by taking data without consent, the firm failed to meet their legal obligations under the Data Protection Act 1998. Representative claimant in the case Alvin Carpio said: "When we use Facebook, we expect that our personal data is being used responsibly, transparently, and legally. By failing to protect our personal information from abuse, we believe that Facebook broke the law. Paying less than 0.01% of your annual revenue in fines -- pocket change to Facebook -- is clearly a punishment that does not fit the crime. Apologizing for breaking the law is simply not enough. Facebook, you owe us honesty, responsibility and redress. We will fight to hold Facebook to account."

An anonymous reader quotes a report from Ars Technica: Cadillac Super Cruise has retained its title as the best driver assistance system on the market, Consumer Reports declared in a new ranking. Super Cruise also won CR's last ranking in 2018. While Super Cruise started out as a Cadillac-only feature, GM is planning to bring it to 22 vehicles by 2023. Tesla's Autopilot came in second place -- a "distant second" according to Consumer Reports. The group says it saw "minor improvements in lane keeping performance" from Tesla's offering since the system was last evaluated in 2018.

Those minor improvements were enough for Autopilot to get the top spot in the "lane keeping and performance" category of CR's report. CR ranked Autopilot 9/10 for performance, while Super Cruise scored 8/10. Tesla also got top marks for Autopilot's ease of use. But Cadillac got a much better score -- seven points versus three for Tesla -- for its driver monitoring system. Cadillac Super Cruise uses a driver-facing camera to verify that the driver has their eyes on the road. The system uses lights and sounds to aggressively alert the driver if they stop paying attention. By contrast, Tesla uses a steering wheel torque sensor to determine whether the driver is holding the wheel. As CR points out, having hands on the wheel "does not necessarily mean the driver is actually looking at the road ahead."

CR also gave Cadillac credit for limiting the use of Super Cruise to pre-mapped highways. GM has made detailed maps of thousands of miles of highway across the US. The maps help Super Cruise understand the road and allows the vehicle to alert drivers ahead of time if they need to take the wheel. Tesla got dinged for allowing the use of Autopilot in residential areas -- areas where drivers need to pay especially close attention to avoid hitting pedestrians or other obstacles. Finally, CR found that Super Cruise did the best job of safely bringing the vehicle to a stop if the driver became unresponsive -- for example because she fell asleep or had a heart attack.

Microsoft has released a Windows update that removes Adobe's Flash Player before it reaches end of support on December 31, 2020. ZDNet reports: Update KB4577586 is part of Microsoft's effort to follow through with plans it announced along with Adobe, Apple, Facebook, Google, and Mozilla in 2017 to end support for Flash by December 2020. The Flash-removing update is available for all supported versions of Windows 10 and Windows Server, as well as Windows 8.1.

This new update removes Flash Player from Windows devices and cannot be uninstalled, Microsoft says in a new support note. However, it isn't rolling out via Windows Server Update Service (WSUS) just yet, and the update needs to be downloaded and installed from the Microsoft Update Catalog. It will become available to WSUS in early 2021, but admins can import it to WSUS manually today. Microsoft is releasing the Flash-removing update ahead of the end of support so that enterprise customers can test the impact on business applications when Flash is removed from a Windows PC or server. But the company says it will continue to deliver Flash security updates until support ends.

Microsoft has also detailed two methods that users and admins can follow to continue using Flash Player after the update is installed. Users can reset a device to an earlier system restore point. However, users need to explicitly enable this feature and a system restore point must have been created on the Windows device before the update is applied. The other option is to reinstall Windows without applying the update.

The Wikimedia Foundation, the American non-profit organization that owns the internet domain names of many movement projects and hosts sites like Wikipedia, has decided to migrate their code repositories from Gerrit to Gitlab. Slashdot reader nfrankel shares the announcement: For the past two years, our developer satisfaction survey has shown that there is some level of dissatisfaction with Gerrit, our code review system. This dissatisfaction is particularly evident for our volunteer communities. The evident dissatisfaction with code review, coupled with an internal review of our CI tooling and practice makes this an opportune moment to revisit our code review choices. While Gerrit's workflow is in many respects best-in-class, its interface suffers from usability deficits, and its workflow differs from mainstream industry practices. This creates barriers to entry for the community and slows onboarding for WMF technical staff. In addition, there are a growing number of individuals and teams (both staff and non-staff) who are opting to forgo the use of Gerrit and instead use a third-party hosted option such as GitHub. Reasons vary for the choice to use third-party hosting but, based on informal communication, there are 3 main groupings: lower friction to create new repositories; easier setup and self-service of Continuous Integration configuration; and more familiarity with pull-request style workflows.

All these explanations point to friction in our existing code-review system slowing development rather than fostering it. The choice to use third-party code-hosting hurts our collaboration (both internal and external), adds to the confusion of onboarding, and makes it more difficult to maintain code standards across repositories. At the same time, there is a requirement that all software which is deployed to Wikimedia production is hosted and deployed from Gerrit. If we fail to address the real usability problems that users have with Gerrit, people will continue to launch and build projects on whatever system it is they prefer -- Wikimedia's GitHub already contains 152 projects, the Research team has 127 projects.

This raises the question: if Gerrit has identifiable problems, why can't we solve those problems in Gerrit? Gerrit is open source (Apache licensed) software; modifications are a simple matter of programming. [...] Upstream has improved the UI in recent releases, and releases have become more frequent; however, upgrade path documentation is often lacking. The migration from Gerrit 2 to Gerrit 3, for example, required several upstream patchsets to avoid the recommended path of several days of downtime. This is the effort required to maintain the status quo. Even small improvements require effort and time as, often, our use-case is very different from the remainder of the Gerrit community.