XXongo writes: Monitoring parolees released from prison by an app on their smartphone sounds like a good idea, right? The phone has facial recognition and biometric ID, and a GPS system that knows where it is. But what if the app doesn't work? In a story on Gizmodo, the [Telmate Guardian] app's coding is "sloppy" and "irresponsible" and its default privacy settings are wildly invasive, asking for "excessive permissions" to access device data. And the app isn't even accurate on recognizing parolees, nor on knowing location, with one parolee noting that the app set off the high-pitched warning alarm and sent a notification to her parole officers telling him that she was not at home multiple times in the middle of the night, when she was in fact at home and in bed. The device also serves as a covert surveillance bug, with built-in potential to covertly record ambient audio from the phone, even in standby mode -- a feature which is not even legal in many states. "But there's nothing you can do," according to one parolee. "If you don't accept it, then you go back to prison. You're considered their property. That's how they see it."

The Pentagon on Monday formally released three unclassified videos taken by Navy pilots that have circulated for years showing interactions with "unidentified aerial phenomena." CBS News reports: One of the videos shows an incident from 2004, and the other two were recorded in January 2015, according to Sue Gough, a Defense Department spokeswoman. The 2004 incident occurred about 100 miles out in the Pacific, according to The New York Times, which first reported on the video in 2017. Two fighter pilots on a routine training mission were dispatched to investigate unidentified aircraft that a Navy cruiser had been tracking for weeks. The Navy pilots found an oblong object about 40 feet long hovering about 50 feet above the water, and it began a rapid ascent as the pilots approached before quickly flying away. "It accelerated like nothing I've ever seen," one of the pilots told The Times. The pilots left the area to meet at a rendezvous point about 60 miles away. When they were still about 40 miles out, the ship radioed and said the object was at the rendezvous point, having traversed the distance "in less than a minute," the pilot told The Times.

The two other videos of incidents in 2015 include footage of objects moving rapidly through the air. In one, an object is seen racing through the sky and begins rotating in midair. Five Navy pilots who spotted the objects in 2015 told The Times in 2017 that they had a series of interactions with unidentified aircraft during training missions in 2014 and 2015 along the East Coast from Virginia to Florida. The episodes prompted the Navy to clarify how pilots should report experiences with "unidentified aerial phenomena," which had been studied under a Pentagon program from 2007 to 2012.
UPDATE (5/3/2020): Astronomer Phil Plait doesn't think the videos captured proof of alien spacecraft -- and explains what he thinks they're showing us instead.

U.S. chipmaker Broadcom has offered to scrap its exclusivity deals with TV and modem makers to end an EU antitrust investigation and stave off a possible hefty fine. Reuters reports: Broadcom, which makes chips to power smartphones, computers and networking equipment and is a major supplier to Apple, found itself in EU competition enforcers' crosshairs over its deals with six companies to buy chips exclusively or almost exclusively from it. That triggered an investigation in June last year and an order to stop such deals until the end of the probe on whether such practices were aimed at squeezing out rivals.

Broadcom has now pledged not to offer incentives to TV and modem makers to encourage them to acquire more than 50% of their chips and modems from the company for their worldwide or European production. Broadcom said its offer addressed the Commission's concerns and it expected the investigation to close before the end of the year. "In these uncertain times, we welcome the opportunity to avoid protracted litigation and to resolve the investigation without recognition of liability or the imposition of a fine," the company said in a statement. The European Commission said it would now seek feedback before deciding whether to accept the offer which would be valid for five years and without a finding of infringement by the company.

An anonymous reader quotes a report from TechCrunch: Properly equipped Tesla vehicles can now recognize and respond to traffic lights and stop signs thanks to a software update the company started pushing out to owners over the weekend. The software update had been available to a sliver of Tesla owners, some of whom had posted videos of the new capability. Now, the automaker is pushing the software update (2020.12.6) to the broader fleet. The feature isn't available in every Tesla vehicle on the road today. The vehicles must be equipped with the most recent Hardware 3 package and the fully optioned Autopilot package that the company has marketed as "full self-driving." The feature, called Traffic Light and Stop Sign Control, is designed to allow the vehicles to recognize and respond to traffic lights and stop signs.

To be clear, Tesla vehicles are not self-driving and this feature has its limits. The feature slows properly equipped Tesla vehicles to a stop when using "traffic-aware cruise control" or "Autosteer." The vehicle will slow for all detected traffic lights, including green, blinking yellow and off lights, according to the software release notes. As the vehicle approaches an intersection, a notification will indicate the intention to slow down. The vehicle will then begin to slow down and stop at the red line shown on the driving visualization, which is on the center display. Owners must pull the Autopilot stalk once or manually press the accelerator pedal to continue through the stop line. Tesla said the feature is designed to be conservative at first. Owners will notice that it will slow down often and will not attempt to turn through intersections. "Over time, as we learn from the fleet, the feature will control more naturally," the company wrote in the release notes. You can watch a demo of the new feature here.

New York City mayor Bill de Blasio announced on Monday the city will close 40 miles worth of streets near parks to give residents a lot more room to get out of their homes. CNET reports: The eventual goal is to open 100 miles of public roads for residents to bike, walk, jog and more while spreading groups of people out. It's not clear which roads will be affected yet, but Mayor De Blasio said the street closures will be "mostly" near parks. Last week, the city of Milan announced that 22 miles of streets will be transformed over the summer, with a rapid, experimental citywide expansion of cycling and walking space to protect residents as COVID-19 restrictions are lifted. Many other cities across the world are expected to enact similar schemes to help social distancing.

According to The Wall Street Journal, Apple is delaying the production ramp-up of its 2020 flagship smartphones by about a month, "as the coronavirus pandemic weakens global consumer demand and disrupts manufacturing across Asia, the heart of the consumer electronics supply chain." From the report: Apple is forging ahead with plans to release four new iPhone models later this year, people familiar with its plans say. The phones, some with 5G connectivity, will vary in price and come in three sizes -- 5.4 inches, two measuring 6.1 inches, and one at 6.7 inches, all featuring organic light-emitting diode, or OLED, screens, the people said. Apple's annual product refresh fuels the majority of iPhone sales for an entire year, making new phones the linchpin of a business segment that accounts for more than half of the company's total revenue.

Apple usually unveils new iPhone models in mid-September and begins selling them before the end of the month. To do so, it usually ramps up mass-production in the early summer, building up inventory around August. This year, while Apple would still be building some of the new phones in the July-to-September period, the mass-production ramp-up will slide back by about a month, the people said. Apple is slashing the number of handsets that it plans to make in the second half of this year by as much as 20%, one of the people said. It isn't clear whether the slashed amount for 2020 would be pushed back into 2021 for manufacturing.

An anonymous reader quotes a report from Ars Technica: Cloud-connected, "smart" automated pet-feeder system Petnet has had a rough spring. The service not only went offline in February, but all its customer service vanished, too, leaving users in the dark until the company apologized and pushed a patch more than a week later. The service briefly returned for some users but fell off again in March. Now, after weeks of silence, the company is blaming COVID-19 for driving it offline for good -- even though its problems started weeks or months before the novel coronavirus became a significant concern.

Several Petnet customers began reaching out to Ars during the second and third weeks of April to report that, once again, not only were their feeders not working, but also they couldn't reach anyone at Petnet about it. Everyone's feeders didn't go offline at the same time but seemed to fail in slow sequence over the period between March 26 and April 13. The company emailed its customers on March 26, blaming the novel coronavirus for outages and delays. The message to customers listed the same email (support@petnet.io) and Twitter (@petnetiosupport) handles the company has always used, but every reader who wrote to Ars said they were unable to receive support through either.

For the most part, you can no longer use Twitter as it was originally built to be used: over text message. From a report: Last week, Twitter turned off the ability to receive SMS messages containing the text of new tweets. The feature was disabled in all but "a few countries" that rely on the feature. This won't be a huge deal for the vasty majority of Twitter users who access the service via the app or website. But there are already complaints from some people who still used SMS to read tweets. The change largely marks the end of an era for Twitter: when the service launched, it was built around SMS. Its original 140-character limit was tailored to text message sizes, and you were meant to send and receive new tweets entirely over SMS.

The UK's coronavirus contact-tracing app is set to use a different model to the one proposed by Apple and Google, despite concerns raised about privacy and performance. From a report: The NHS says it has a way to make the software work "sufficiently well" on iPhones without users having to keep it active and on-screen. That limitation has posed problems for similar apps in other countries. Experts from GCHQ's National Cyber Security Centre have aided the effort. NCSC indicated that its involvement has been limited to an advisory role. "Engineers have met several core challenges for the app to meet public health needs and support detection of contact events sufficiently well, including when the app is in the background, without excessively affecting battery life," said a spokeswoman for NHSX, the health service's digital innovation unit.

WhatsApp's bid to cutting virality of messages circulating on its platform by introducing an additional limit earlier this month has already started to pay off. From a report: The Facebook -owned service said on Monday that spread of "highly forwarded" messages sent on WhatsApp had dropped by 70% globally in weeks after introducing a new restriction earlier this month. In one of the biggest changes to its core feature, WhatsApp said earlier this month that users on its platform can now send along frequently forwarded messages they receive to only one person or a group at a time, down from five. The restriction was rolled out globally to WhatsApp's 2 billion users on April 7.

Cyber-security firm Sophos has published an emergency security update to patch a zero-day vulnerability in its XG enterprise firewall product that was being abused in the wild by hackers. From a report: Sophos said it first learned of the zero-day on late Wednesday, April 22, after it received a report from one of its customers. The customer reported seeing "a suspicious field value visible in the management interface." After investigating the report, Sophos determined this was an active attack and not an error in its product. "The attack used a previously unknown SQL injection vulnerability to gain access to exposed XG devices," Sophos said in a security advisory today. Hackers targeted Sophos XG Firewall devices that had their administration (HTTPS service) or the User Portal control panel exposed on the internet. Sophos said the hackers used the SQL injection vulnerability to download a payload on the device. This payload then stole files from the XG Firewall.

Long-time Slashdot reader RoccamOccam quotes Interesting Engineering: The United States Space force now has offensive power, though it might not be the massive orbiting weapons system that you're envisioning.

The new weapons system delivered to the space force is a jammer type array that can prevent military or intelligence combatants from accessing their military satellites. This functionality allows the space force to neutralize orbiting satellites in a matter of minutes.
The International Business Times adds that "In a previous report, the U.S. identified Russia and China as potential threats to the country's presence in space.

"The U.S. Space Force's recently confirmed that it already has 16 units of its new ground-based offensive weapon system. The agency also reported that it has already started working on the system's successor..."

"SpaceX's Starlink internet satellites will soon sport an accessory to tamp down their surprising brightness," reports Live Science: That brightness worries many astronomers, who say that the huge Starlink constellation could seriously disrupt a variety of scientific observations. And Starlink will indeed be huge, if all goes according to SpaceX's plan: The company has approval to launch 12,000 craft to low Earth orbit (LEO) and has applied for permission to loft 30,000 more. (For perspective, humanity has launched just 9,400 objects to orbit since the dawn of the space age in 1957).

SpaceX founder and CEO Elon Musk has said that the company will find a way to make Starlink craft fade from scientists' sight, predicting that the constellation will end up having no impact whatsoever on astronomical discoveries. SpaceX has been working with the astronomical community to help make this happen, researchers say, and the company has already tried out some mitigation measures. For example, one of the 60 Starlink satellites that launched atop a Falcon 9 rocket this past January sported an experimental coating to make it less reflective. Observations show that this "DarkSat" is considerably dimmer than its brighter Starlink cohorts, but probably not dim enough to quell most astronomers' concerns about the megaconstellation.

But SpaceX is taking additional measures as well, which brings us to the new accessory. Musk tweeted the following on Wednesday (April 22), in response to a Twitter follower who wished SpaceX luck on a 60-satellite Starlink launch that day: "Thanks! We are taking some key steps to reduce satellite brightness btw. Should be much less noticeable during orbit raise by changing solar panel angle & all sats get sunshades starting with launch 9."

"We're updating our bug bounty policy and payouts to make it more appealing to researchers and reflect the more hardened security stance we adopted after moving to a multi-process, sandboxed architecture," reports the Mozilla security blog: Besides rewarding duplicate submissions, we're clarifying our payout criteria and raising the payouts for higher impact bugs. Now, sandbox escapes and related bugs will be eligible for a baseline $8,000, with a high quality report up to $10,000. Additionally, proxy bypass bugs are eligible for a baseline of $3,000, with a high quality report up to $5,000...

Additionally, we'll be publishing more posts about how to get started testing Firefox — which is something we began by talking about the HTML Sanitization we rely on to prevent UXSS. By following the instructions there you can immediately start trying to bypass our sanitizer using your existing Firefox installation in less than a minute...

Lastly, we would like to let you know that we have cross-posted this to our new Attack & Defense blog. This new blog is a vehicle for tailored content specifically for engineers, security researchers, and Firefox bug bounty participants.
They point out that Firefox has one of the world's oldest bug bounty programs, dating back to 2004 -- and it's still going strong. "From 2017-2019, we paid out $965,750 to researchers across 348 bugs, making the average payout $2,775 — but as you can see in the graph below, our most common payout was actually $4,000!"

An anonymous reader quotes ZDNet: Rust has been voted the "most-loved" programming language by developers on Stack Overflow for four years in a row. But the Rust project now admits it has an adoption problem among developers and organizations. Rust's adoption issue surfaced in January's Stack Overflow's 2019 survey, which revealed that despite developers' positive feelings toward Rust, 97% of them hadn't actually used it.

Rust maintainers have now explored the adoption challenges in their latest annual survey of nearly 4,000 developers across the world...

Asked why developers have stopped using Rust, the most common response is that the respondent's company doesn't use it, suggesting an adoption issue. Other common reasons are the learning curve, a lack of necessary libraries, and a lack of integrated development environment (IDE) support. The top issues that respondents say the Rust project could do to improve adoption of the language are better training and documentation, followed by better libraries, IDE integration, and improved compile times... "Most indicated that Rust maturity — such as more libraries and complete learning resources and more mature production capabilities — would make Rust more appealing," the project noted....

"The results show the overriding problem hindering use of Rust is adoption. The learning curve continues to be a challenge — we appear to most need to improve our follow-through for intermediate users — but so are libraries and tooling."
The article also notes that Rust is popular with some developers at Microsoft, "who are experimenting with Rust to reduce memory-related bugs in Windows components written in C and C++."

"Australia's coronavirus tracing app, dubbed COVIDSafe, has been released as the nation seeks to contain the spread of the deadly pandemic," reports ABC.net.au: People who download the app will be asked to supply a name, which can be a pseudonym, their age range, a mobile number and post code. Those who download the software will be notified if they have contact with another user who tests positive for coronavirus... Using Bluetooth technology, the app "pings" or exchanges a "digital handshake" with another user when they come within 1.5 metres of each other, and then logs this contact and encrypts it.

The data remains encrypted on a user's phone for 21 days, after which it is deleted if they have not been in contact with a confirmed case. The application will have two stages of consent that people will have to agree to: initially when they download the app so data can be collected, and secondly to release that data on their phone if they are diagnosed with the virus. If a person with the app tested positive to COVID-19, and provided they consent to sharing the information, it will be sent to a central server. From here, state and territory health authorities can access it and start contacting other people who might have contracted coronavirus...

The app is voluntary and it will be illegal to force anyone to download it.
In addition, Australia "will make it illegal for non-health officials to access data collected on smartphone software to trace the spread of the coronavirus," reports Reuters, citing comments Friday by Prime Minister Scott Morrison "amid privacy concerns raised by the measure." Australia has so far avoided the high death toll of other countries, with only 78 deaths, largely as a result of tough restrictions on movement that have brought public life to a standstill. The federal government has said existing "social distancing" measures will remain until at least mid-May, and that its willingness to relax them will depend on whether people download the smartphone "app" to identify who a person with the illness has had contact with...

Morrison also confirmed a local media report which said the data would be stored on servers managed by AWS, a unit of U.S. internet giant Amazon.com Inc, but added that "it's a nationally encrypted data store".
"The spec for it is very privacy-positive," writes Slashdot reader Bleve97, adding "It will be interesting to see what it looks like once it's been disassembled in a sandbox and played with!"

And Slashdot reader betsuin has already installed it (adding that the app "does not require GPS... I've installed, GPS is off on my rooted device."

"Tesla has released a new, highly anticipated Traffic Light and Stop Sign Control feature," reports Electrek: As we reported last month, Tesla has started to push an Autopilot update with the actual ability to handle intersections to some drivers in its "early access fleet," a group of owners who beta test new software update from Tesla. We even got to see a quick demo video. Later, we also took a look at the manual for the new feature that explains in detail how it works as well as its limitations.

Now Tesla is starting to push the new feature to the wider fleet in the U.S. as part of a new 2020.12.6 software update... Some owners have already started testing the feature.
Electrek argues that while the update may be of limited use, it's "more about improving Autopilot to help Tesla achieve full self-driving...

"Drivers using this feature will basically train Autopilot to cross intersections."

Some Windows users are reporting serious problems after downloading Microsoft's latest update for Windows 10, according to Forbes: The problems those users are reporting to the Microsoft support forums and on social media have included the installation failing and looping back to restart again, the dreaded Blue Screen of Death (BSOD) following a "successful" update and computers that simply refuse to boot again afterward. Among the more common issues, in terms of complaints after a Windows 10 update, were Bluetooth and Wi-Fi connectivity related ones. But there were have also been users complaining that after a restart, all files from the C drive had been deleted.

Microsoft has stated that it has "not seen these issues reflected in telemetry, support data, or customer feedback channels," but is aware of social media reports that mention Bluetooth, a stop error with a blue screen, and other related issues. "We continuously investigate all customer feedback and are closely monitoring this situation," Microsoft said in the known issues section of the update notes.
"On social platforms like Twitter and Reddit, PC users are reporting photos, documents and apps are disappearing without a trace..." reports Komando.com.

"Some things never change... Microsoft can't deliver a stable update to save its life!"

CNET reports on new research from a threat-intelligence company into the more than 540 domain names registered this month with the word "reopen" in their URL.

While hundreds of them are "designed to lend credibility to anti-lockdown protests," and 98 more were purchased to thwart that effort, there's still many other domains that "come from suspicious sources or resellers looking to make money... Researchers at DomainTools have found hundreds of 'reopen' URLs that were bought specifically to be resold and others that resemble malware campaigns." These are "reopen" websites targeted toward restaurants, movie theaters and sports, and all are set up for sale... "Domainers are a particular type of people who spot any chance they can to hop on a quick buck," said Chad Anderson, senior security researcher at DomainTools. "In any of these instances, there's going to be people who try and pick domains they are able to sell for $5,000 that they bought for $10 because someone wants to start a movement."

DomainTools' researchers also found a batch of links registered in bulk specifically with typos for the phrase "Reopen American Business." All of these domains were registered in China and have misspellings, indicating they're set up to be phishing pages... The idea is to trick visitors who make typos into entering their sensitive credentials on these fraudulent pages. These domains all have servers registered with Bodis, an advertising service that monetizes domain names and has links to a previous malware campaign from the advanced persistent threat (APT) group DarkHotel.

APTs are known groups behind cyberattacks. DarkHotel APT is a hacking group that primarily affects victims in Japan, Taiwan, China, Russia and South Korea. "It looks like it's going to be used for phishing campaigns," Anderson said. "It hasn't been fully activated yet, but it has characteristics of a DarkHotel APT group."
There's also an interesting detail about the first seven "reopen" pages created, which looked like they represented independent groups but were all registered under the name of pro-gun activist Aaron Dorr from Iowa, and redirected visitors to the gun rights groups that were organizing protests to "liberate" their locked down cities. That activist's family also created "reopen" Facebook groups with hundreds of thousands of followers -- which then directed people to the websites. "NBC News found that many of the websites hosted by Dorr were designed to harvest visitors' data, including emails and home addresses."

NBC adds that the group's usual method "is to attack established conservative groups from the right, including the National Rifle Association, and then make money by selling memberships in their groups or selling mailing lists of those who sign up, according to some conservative politicians and activists who have labeled the efforts as scams."

Facebook is challenging Zoom with the introduction of "Messenger Rooms," a group messaging service that allows Facebook users to host group calls of up to 50 people that anyone can join. Engadget reports: Instead of inviting people individually, Facebook users can post links in their News Feed or in Groups or event pages. And unlike Messenger's existing video chat features, participants don't need to have the Messenger app or even a Facebook account to join a room. When a room is created, anyone can join via their browser, though hosts can opt to "lock" rooms to new guests to prevent party crashers.

There are other Zoom-like features, too. Messenger Rooms will have "immersive 360-degree backgrounds that transport you to beautiful and iconic spaces, from the beach to a luxe apartment on the water," along with "14 new camera filters that offer ambient lighting to brighten your space and your face." Facebook also notes that there are no time limits for video chat sessions, which can be scheduled in advance. Messenger Rooms is starting to roll out now, and will be live in the U.S. "in the coming weeks." Facebook also announced that it's integrating Messenger's video calling into Facebook Dating, so users can participate in "virtual dates" while they can't plan IRL get-togethers. The update will be available "in the coming months."