In the name of security and privacy, Google is taking away the ability for users to select third-party camera apps in Android 11, forcing users to rely on the built-in camera app. Android Police reports: At the heart of this change is one of the defining traits of Android: the Intent system. Let's say you need to take a picture of a novelty coffee mug to sell through an auction app. Since the auction app wasn't built for photography, the developer chose to leave that up to a proper camera app. This where the Intent system comes into play. Developers simply create a request with a few criteria and Android will prompt users to pick from a list of installed apps to do the job.

However, things are going to change with Android 11 for apps that ask for photos or videos. Three specific intents will cease to work like they used to, including: VIDEO_CAPTURE, IMAGE_CAPTURE, and IMAGE_CAPTURE_SECURE. Android 11 will now automatically provide the pre-installed camera app to perform these actions without ever searching for other apps to fill the role. Google describes the change in a list of new behaviors in Android 11, and further confirmed it in the Issue Tracker. Privacy and security are cited as the reason, but there's no discussion about what exactly made those intents dangerous. Perhaps some users were tricked into setting a malicious camera app as the default and then using it to capture things that should have remained private.

Not only does Android 11 take the liberty of automatically launching the pre-installed camera app when requested, it also prevents app developers from conveniently providing their own interface to simulate the same functionality. I ran a test with some simple code to query for the camera apps on a phone, then ran it on devices running Android 10 and 11 with the same set of camera apps installed. Android 10 gave back a full set of apps, but Android 11 reported nothing, not even Google's own pre-installed Camera app.

Researchers have demonstrated that they can make a working 3D-printed copy of a key just by listening to how the key sounds when inserted into a lock. Slashdot reader colinwb writes: While you cannot hear the shape of a drum it seems you can hear the shape of one type of key from the sound it makes in the lock. That says it all really, but [here's how Soundarya Ramesh and her team at the National University of Singapore accomplished this feat]: "[The NUS team developed and tested what it calls SpiKey, an end-to-end attack technique for, as its name suggests, spying on Yale/Schlage type keys and using signal processing software to infer their correct shapes.] Once they have a key-insertion audio file, SpiKey's inference software gets to work filtering the signal to reveal the strong, metallic clicks as key ridges hit the lock's pins [and you can hear those filtered clicks online here]. These clicks are vital to the inference analysis: the time between them allows the SpiKey software to compute the key's inter-ridge distances and what locksmiths call the 'bitting depth' of those ridges: basically, how deeply they cut into the key shaft, or where they plateau out. If a key is inserted at a nonconstant speed, the analysis can be ruined, but the software can compensate for small speed variations.

The result of all this is that SpiKey software outputs the three most likely key designs that will fit the lock used in the audio file, reducing the potential search space from 330,000 keys to just three. 'Given that the profile of the key is publicly available for commonly used [pin-tumbler lock] keys, we can 3D-print the keys for the inferred bitting codes, one of which will unlock the door,' says Ramesh." The article has a link to a 15-minute video presentation of the research and to another article on the research.

Researchers at NYU Langone Health and Facebook's artificial intelligence division have teamed up to develop an AI model that uses less data and creates images faster than traditional MRI techniques, according to a Wall Street Journal report. From a report: The goal of the project is to create a five-minute MRI as an alternative to the 20 minutes to an hour it takes for current MRI machines to scan a patient, Michael Recht, MD, told the publication. Dr. Recht is professor and chair of New York City-based NYU Langone Health's radiology department and also a co-author of the research project. The combination of AI and MRI technology aims to construct images with less data rather than diagnose a medical condition. The project uses different technology and standards than those used to create AI-generated or synthetic media. Because it centers on constructing MRI scans, Facebook said the project must create images "that are accurate to the ground truth," compared to synthetic media, which usually needs to create a believable image, according to the report.

For the experiment, researchers created 108 patient images using standard MRI techniques as well as a second set of images in which some of the image data was thrown out. Facebook's AI model was then applied to construct the images with less data. Researchers used commercially available MRI machines, and data was collected from patients from various points of their bodies. Six MRI readers reviewed both sets of images, and readings were spaced out across a four-week period to ensure the readers could not recall important details from previous sets. Dr. Recht told the Journal that all six engineers concluded that the quality of the AI model-generated images was "as good [as] or better" than the conventional images. The AI system still needs regulatory approval, but NYU Langone is now using it to treat patients as part of an institutional review board study, according to the report.

An anonymous reader quotes a report from The Verge: Google Maps is being redesigned to make it easier to distinguish between natural features in the environment, whether they're mountainous ice caps, deserts, beaches, or dense forests. Google says the new maps will be available in the 220 countries and territories currently supported by Google Maps, "from the biggest metropolitan areas to small, rural towns." Google says that street maps are also getting more detailed in select cities. Google says it used satellite imagery as the basis for its redesigned maps and that this has had a "new color-mapping algorithmic technique" applied to it. The end result does a much better job of showing off the differences between natural features, such as between snowy peaks and dense forests or green fields and sandy beaches. The comparison shots below give an idea of what the new color-mapping technique is capable of.

Along with the changes it's made to the natural world, Google is also making its street maps more detailed in select cities. While previously its maps simply showed the streets themselves, in New York, San Francisco, and London, they'll soon distinguish between different street features like roadways, sidewalks, crosswalks, and pedestrian islands. Google says the new design shows the shape and width of any given road "to scale." Google says the more detailed maps of natural features will be rolling out starting this week around the world, and it adds that you'll need to "zoom out" to be able to see them. The improved street designs for New York, San Francisco, and London are getting released in the coming months, with plans to add more cities over time.

Secure Thoughts reports that artificial intelligence company Cense AI, which specializes in "SaaS-based intelligent process automation management solutions," has leaked nearly 2.6 million medical records on the internet. PCMag reports: [O]n July 7 security researcher Jeremiah Fowler discovered two folders of medical records available for anyone to access on the internet. The data was labeled as "staging data." Fowler believes the data was made public because Cense AI was temporarily hosting it online before loading it into the company's management system or an AI bot.

The medical records are quite detailed and include names, insurance records, medical diagnosis notes, and payment records. It looks as though the data was sourced from insurance companies and relates to car accident claims and referrals for neck and spine injuries. The majority of the personal information is thought to be for individuals located in New York, with a total of 2,594,261 records exposed. Fowler sent a responsible disclosure notice to Cense AI and public access to the folders was restricted soon after. However, the damage has potentially already been done if others had previously discovered the data was available. Fowler points out that medical data is the most valuable on the black market, fetching as much as $250 per record. If someone willing to act maliciously came across this data you can guarantee it is, or has been sold.

Just when it seemed like Facebook's controversies might have peaked, the company now appears to be obstructing a genocide investigation, and it's using U.S. law to do it. From a report: The West African nation The Gambia is seeking to hold Myanmar accountable for charges of genocide against the Rohingya people, an ethnic and religious minority. In 2016 and 2017, Myanmar soldiers and their civilian proxies massacred Rohingya men, women and children, raped women and girls and razed villages, forcing more than 800,000 to flee into neighboring Bangladesh. Facebook's role in these atrocities isn't news. In 2018, Facebook acknowledged it was used to "foment division and incite offline violence" in Myanmar, where the social media platform is so ubiquitous it's often synonymous with the internet. An independent report commissioned by the company documented the same, as did independent fact-finders appointed by the U.N. In response, Facebook took down the account of the commander-in-chief of the Myanmar military, Senior General Min Aung Hlaing, and other military officials and organizations. In 2018 alone it shut down numerous networks that sought to incite violence against Rohingya, removing 484 pages, 157 accounts, and 17 groups for "coordinated inauthentic behavior."

To its credit, Facebook preserved the data and content it took down, and the company committed to cleaning up its act. "We know we need to do more to ensure we are a force for good in Myanmar," a company representative said in an official statement in 2018. Now, two years later, the company is doing exactly the opposite. In June, The Gambia filed an application in U.S. federal court seeking information from Facebook that would help it hold Myanmar accountable at the International Court of Justice (ICJ). Specifically, The Gambia is seeking documents and communications from Myanmar military officials as well as information from hundreds of other pages and accounts that Facebook took down and preserved. The Gambia is also seeking documents related to Facebook's internal investigations into the matter as well as a deposition of a relevant Facebook executive. All of this information could help to prove Myanmar's genocidal intent. Back in May, The Gambia filed a similar application in U.S. court against Twitter. The case disappeared quickly because The Gambia pulled its application shortly after submitting it, presumably because Twitter agreed to cooperate. Not Facebook. Earlier this month, the company filed its opposition to The Gambia's application. Facebook said the request is "extraordinarily broad," as well as "unduly intrusive or burdensome."

KindMind shares a report from The Register: Toyota has expanded its collaboration with Amazon Web Services in ways that will see many of its models upload performance data into the Amazonian cloud to expand the services the auto-maker offers to drivers and fleet owners. [...] Toyota reckons the data could turn into "new contextual services such as car share, rideshare, full-service lease, and new corporate and consumer services such as proactive vehicle maintenance notifications and driving behavior-based insurance."

The two companies say their joint efforts "will help build a foundation for streamlined and secure data sharing throughout the company and accelerate its move toward CASE (Connected, Autonomous/Automated, Shared and Electric) mobility technologies." Neither party has specified just which bits of the AWS cloud Toyota will take for a spin but it seems sensible to suggest the auto-maker is going to need lots of storage and analytics capabilities, making AWS S3 and Kinesis likely candidates for a test drive. Whatever Toyota uses, prepare for privacy ponderings because while cheaper car insurance sounds lovely, having an insurer source driving data from a manufacturer has plenty of potential pitfalls.

An anonymous reader quotes a report from Motherboard: A group of activists have released Landlord Tech Watch, a site that allows anyone to report where this "landlord tech" is being used and plot it on a map -- like a version of Nextdoor that turns the tables to hold property owners and real estate companies accountable. The project is the effort of technologists and tenants rights advocates, who say they're aiming to use data to shed light on the use of biometric locks, tenant screening systems, and other technology used by landlords to exert power over tenants.

"It just became apparent that these technologies are increasingly being deployed in residential spaces, and there's so little public information about them," Erin McElroy, a postdoctoral researcher at the AI Now Institute and co-founder of the Anti-Eviction Mapping Project, told Motherboard. McElroy said the project came together following a prominent tenant dispute at Atlantic Plaza Towers, a rent-stabilized building in Brownsville, Brooklyn. The landlord, Robert Nelson, was trying to replace physical key fobs with a facial recognition system, a technology which has been repeatedly shown to exhibit racial bias. The project was abandoned after 136 tenants rallied in protest, filing a legal complaint with the New York State Department of Housing and Community Renewal. "We want to be able to collectively organize tenants from multiple buildings," adds McElroy. "That's the ultimate goal -- whether it be for direct action or policy reform or both."

Oculus will soon require all of its virtual reality headset users to sign up with a Facebook account. The Facebook-owned company says it will start removing support for separate Oculus accounts in October, although users can maintain an existing account until January 1st, 2023. All users can maintain a distinct "VR profile" with a separate friends list. From a report: Starting later this year, you'll only be able to sign up for an Oculus account through Facebook. If you already have an account, you'll be prompted to permanently merge your account. If you don't, you'll be able to use the headset normally until 2023, at which point official support will end. Old headsets using non-linked accounts will still work, but some games and apps may no longer function. Developers can keep using an unlinked developer account without social functionality, and the Oculus for Business platform uses a separate login process that will remain unchanged. Facebook also says that all future unreleased Oculus devices will require a Facebook login, even if you've got a separate account already.

Uber and Lyft, which are facing mounting pressure to classify their freelance drivers as full-time employees in California, are looking for another way. From a report: One option that both companies are seriously discussing is licensing their brands to operators of vehicle fleets in California, according to three people with knowledge of the plans. The change would resemble an independently operated franchise, allowing Uber and Lyft to keep an arms-length association with drivers so that the companies would not need to employ them and pay their benefits.

The idea would effectively be a return to the days of how groups of black cars were run. Lyft has presented the plan to its board of directors, one person said. Uber, which already works with fleet operators in Germany and Spain, is also familiar with the business model. The companies have not committed to the franchise-like plans, said the people with knowledge of the discussions, who asked to remain anonymous because the details are confidential. Uber and Lyft are waiting to see how California's legal situation around drivers, who have been treated as independent contractors, plays out first, they said.

An anonymous reader quotes a report from Gizmodo: A newly released document shows the U.S. Secret Service went through a controversial social media surveillance company to purchase the location information on American's movements, no warrant necessary. Babel Street is a shadowy organization that offers a product called Locate X that is reportedly used to gather anonymized location data from a host of popular apps that users have unwittingly installed on their phones. When we say "unwittingly," we mean that not everyone is aware that random innocuous apps are often bundling and anonymizing their data to be sold off to the highest bidder.

Back in March, Protocol reported that U.S. Customs and Border Protection had a contract to use Locate X and that sources inside the secretive company described the system's capabilities as allowing a user "to draw a digital fence around an address or area, pinpoint mobile devices that were within that area, and see where else those devices have traveled, going back months." Protocol's sources also said that the Secret Service had used the Locate X system in the course of investigating a large credit card skimming operation. On Monday, Motherboard confirmed the investigation when it published an internal Secret Service document it acquired through a Freedom of Information Act (FOIA) request. (You can view the full document here.) The document covers a relationship between Secret Service and Babel Street from September 28, 2017, to September 27, 2018. In the past, the Secret Service has reportedly used a separate social media surveillance product from Babel Street, and the newly-released document totals fees paid after the addition of the Locate X license as $1,999,394.

While there's wide HTTPS adoption today, HTTP content on secure pages still persists. Google has been working to stamp that out, and Chrome is now turning its attention to and warning about insecure forms. "These 'mixed forms' (forms on HTTPS sites that do not submit on HTTPS) are a risk to users' security and privacy," says Google in a blog post. "Information submitted on these forms can be visible to eavesdroppers, allowing malicious parties to read or change sensitive form data." 9to5Google reports: The Google browser today removes the address bar's lock icon from sites with mixed forms. However, this proved to deliver an "unclear" experience that "did not effectively communicate the risks associated with submitting data in insecure forms." Starting in version 86, due to hit stable in October, Chrome will provide a more aggressive warning about insecure forms. Autofill will be disabled, but the built-in password manager will continue to offer "unique passwords." The company argues it's safer than reusing credentials. Next, the form will show red warning text underneath the field: "This form is not secure. Autofill has been turned off. The last measure will throw up a full-page warning communicating the potential risks. It gives users an option to cancel the action, but there will be a "Send anyway" button.

Four cities in Indiana are suing Netflix and other video companies, claiming that online video providers and satellite-TV operators should have to pay the same franchise fees that cable companies pay for using local rights of way. Ars Technica reports: The lawsuit was filed against Netflix, Disney, Hulu, DirecTV, and Dish Network on August 4 in Indiana Commercial Court in Marion County. The cities of Indianapolis, Evansville, Valparaiso, and Fishers want the companies to pay the cable-franchise fees established in Indiana's Video Service Franchises (VSF) Act, which requires payments of 5 percent of gross revenue in each city.

The lawsuit is based on an unusual legal argument and doesn't seem likely to succeed. Essentially, the cities are claiming that Netflix and similar providers use the public rights of way simply by offering video streaming services over the Internet: "Defendants transmit video programming to Indiana subscribers using Internet protocol and other technologies. When doing so, Defendants transmit their programming through facilities located at least in part in public rights of way within the geographic boundaries of Indiana Units, including public rights of way located within Plaintiffs' geographic boundaries. Therefore, Defendants are required by the VSF Act to pay the Plaintiffs -- and all other Indiana Units in which Defendants transmit video programming through facilities located at least in part in a public right-of-way -- "franchise fees."

But streaming companies don't have to build physical infrastructure in each city to offer online video, so they aren't deploying their own wires on public rights of way. US law defines a cable system as "a facility, consisting of a set of closed transmission paths and associated signal generation, reception, and control equipment that is designed to provide cable service." Local franchising rules and fees are based on cities' authority to manage their local rights of way. Netflix, Hulu, and Disney+ are Internet-only services. Dish and DirecTV are primarily satellite operators but also offer online access. The cities' lawsuit never mentions the word "satellite" and doesn't fully explain how DirecTV and Dish use the public rights of way.

Microsoft will end support for Internet Explorer 11 across its Microsoft 365 apps and services next year. The Verge reports: In exactly a year, on August 17th, 2021, Internet Explorer 11 will no longer be supported for Microsoft's online services like Office 365, OneDrive, Outlook, and more. Microsoft is also ending support for Internet Explorer 11 with the Microsoft Teams web app later this year, with support ending on November 30th. While it's still going to take some time to pry enterprise users of Internet Explorer 11 away, Microsoft is hoping that the new Internet Explorer legacy mode in the Chromium-based Microsoft Edge browser will help. It will continue to let businesses access old sites that were specifically built for Internet Explorer, until Microsoft fully drops support for Internet Explorer 11 within Windows 10. Microsoft's move to stop supporting Internet Explorer 11 with its main web properties is a good first step, though.

Alongside the support changes, Microsoft is also planning to drop support for its existing legacy version of Microsoft Edge on March 9th, 2021. After the end of support date, the legacy version of Edge will no longer receive security updates. Microsoft has been moving existing Windows 10 users over to new its Chromium-based Edge browser, and the company says new devices and future Windows feature updates will all include the new Edge browser.

The website of Notepad++ is banned in China as of Monday, "obviously due to" its release of editions named "Free Uyghur" and "Stand with Hong Kong," the source code and text editor announced on Twitter. TechCrunch reports: First released in 2003 by France-based developer Don Ho, free-to-use Notepad++ operates on Windows and supports some 90 languages. In his release notices for the two editions, Ho openly voiced his concerns over "human rights" conditions, respectively in the Xinjiang autonomous region and Hong Kong. Tests by TechCrunch found that the Notepad++ ban only applies to its Download page -- which showcases the special editions and thus politically sensitive language -- when one tries to reach it from Chinese browsers developed by Tencent (QQ Browser and WeChat's built-in browser), Alibaba (UC Browser), 360 and Sogou. These services flag the page as containing content "prohibited" by local regulators.

Notepad++'s home page, on the other hand, remains unblocked through these local browsers. One can still access the full site from Chrome and DuckDuckGo in China. The ban began as early as August 12 when a user notified Ho of the ban, the developer told TechCrunch. He has never been contacted by any Chinese government authority and does not plan to take measures to cope with the website restriction.

At the Hot Chips 2020 conference, which was held virtually this year, IBM announced the IBM Power10. From a report: It's the successor to the Power9 and represents the next generation of the company's processor family. IBM claims that the Power10 delivers up to three times greater efficiency than its predecessor while at the same time delivering higher workload capacity and container density. The Power10 was designed over five years and has the distinction of being IBM's first commercial 7-nanometer processor. (In 2015, IBM, Samsung, and other members of IBM's Research Alliance produced the first test chips as part of a $3 billion R&D investment.) There will be multiple configurations, and while the specifics aren't yet being disclosed, the maximum single-chip-module offering won't exceed 15 SMT8 cores and the dual-chip-module offering won't exceed 30 SMT8 cores, according to IBM distinguished engineer and Power10 architect William Starke.

Below its home page's search bar, Google is now warning everyone in Australia ominously that "The way Aussies search every day on Google is at risk from new Government regulation."

For more emphasis, Google even added the "hazard sign" symbol — a yellow triangle with an exclamation point, reports Gizmodo. "And in case you missed that, the website has also added a famously popular pop-up prompt that comes up during a search." After a year and a half of investigating, the ACCC, affectionately known as Australia's consumer watchdog, published a report last year that found that digital platforms had significant bargaining powers. News publishers, on the other hand, were a lot less powerful and this imbalance had significant adverse affects... In April this year, the Australian government asked Australia's consumer watchdog, the ACCC, to create some rules for a negotiation between news publishers and tech platforms... It laid out a process for negotiation and requirements that the platforms give more information to publishers...

In the letter, Google's ANZ Director Mel Silva claims that the code places free services — like Search, Gmail, Youtube — "at risk", seemingly implying that these services will be affected or may be discontinued if the draft code goes through. "A proposed law, the News Media Bargaining Code, would force us to provide you with a dramatically worse Google Search and YouTube, could lead to your data being handed over to big news businesses, and would put the free services you use at risk in Australia," she wrote...

In adding these warnings, the company is using its real estate on Australia's most visited website as a way to push back against negotiations that could force it to pay for its dominance.
UPDATE (8/17/2020): "The open letter published by Google today contains misinformation..." responds the Australian Competition and Consumer Commission.

"During the Cold War, the CIA considered building a bird-sized drone designed to spy on the communist bloc," reports Popular Mechanics. "The drone would carry 'black box' spy packages into Russia and China, as well as take secret photographs — all while hiding in plain sight disguised as a bird..." The project envisioned a fleet of 12 bird-shaped drones, powered by nuclear energy, that could stay aloft for up to a month. The drone, which was supposed to act as a robotic spy plane and courier for secret payloads, was never completed... "Aquiline" was a small drone, meant to be kept as close to bird-like size as possible — five feet long, 7.5 feet wide, and a takeoff weight of 83 pounds — under the constraints of the technology of the time. A silent 3.5-horsepower, four-cycle engine would give the drone a speed of 47 to 80 knots and an endurance of 50 hours and 1,200 miles. Aquiline's maximum altitude was estimated at 20,000 feet.

Nuclear power promised to give Aquiline even greater range. The CIA proposed to install a radioisotope propulsion system on the flying drone, one that would convert waste heat from decaying isotopes (like plutonium) into electricity. Such an engine, developed primarily for deep space probes, would boost the drone's endurance to an astonishing 30 days or 36,000 miles.

Aquiline was designed to carry both photographic and intelligence payloads. It could take overhead photographs of sensitive sites while flying much lower than the U-2 spy plane, and would scoop up electronic signals of radios, radar, and other devices for later analysis. Unlike manned planes, Aquiline could fly much closer to its targets, producing high resolution photographs and recording stronger electromagnetic signals. The drone could also secretly drop off payloads of specially developed sensors near sites the CIA wanted to closely monitor...

Radars and human sentries at sensitive sites would mistake Aquiline for a bird and pay little attention to it.
The drone was to have been designed by McDonnell Douglas — and developed Area 51, according to the article.

And since data storage at the time was limited to cumbersome things like punch cards and tapes, the drone would instead beam all of its data to a nearby reconnaissance plane.

"Self-driving cars are bullshit," writes Cory Doctorow: I'm a science fiction writer, so I quite enjoy thinking about self-driving cars. They make for really interesting analogies about data, liability, self-determination, information security and openness... But I'm a science fiction writer and that means I can tell the difference between "thought experiments" and "real things." Alas, the same cannot be said of corporate America.

For example, according to its own IPO filings, Uber can only be profitable if it invents fully autonomous vehicles and replaces every public transit ride in the world with them. Elon Musk — a man whose "green electric car company" is only profitable thanks to the carbon credits it sells to manufacturers of the dirtiest SUVs in America, without which those planet-killing SUVs would not exist — makes the same mistake. Musk wants to abolish public transit and replace it with EVs (he says that public transit makes you sit next to strangers who might be serial killers, which tells you a lot about his view of humanity).

Now, both Uber and Musk are both wrong as a matter of simple geometry. Multiply the space occupied by all those AVs by the journeys people in cities need to make by the additional distances of those journeys if we need road for all those cars, and you run out of space... these fairy tales require so much credulity to be taken seriously that they strain even the car-addled imaginations of American automotive culture, and also rely on the irrational exuberance inspired by imaginary self-driving cars to propagate and persist.

But that exuberance is sorely misplaced. Machine learning systems have brittle and unpredictable failure modes that can be triggered by accident or deliberately. The unconstrained problem of navigating busy cities with unquantifiable human activities is insoluble with ML.

Or, at least, it's insoluble if you care about whether cars kill even more people in even less predictable ways than they do now...
Doctorow adds that a key plot point in the third book in his "Little Brother" series (coming out in October) is "subverted, lethal autonomous vehicles." But Doctorow also shares a link to his short story "Car Wars," commissioned by Deakin University to explore the sociotechnological issues around autonomous vehicle.

It begins with a high school warning parents about students performing "dangerous modifications" to their car in violation of new federal laws -- three student vehicles were already confiscated for "operating with unlicensed firmware." (And "one of those cases has been referred to the police as the student involved was a repeat offender.")

But as the school launches its random vehicle firmware audits, a developer sends a desperate message to his followers on Twitter about something even more disturbing that's happening in real-time...