"Not sure if this is good news (Oracle is very busy patching their stuff) or bad news (Oracle is very busy patching their stuff) but this quarterly cycle they tied their all-time high number of vulnerability fixes released," writes Slashdot reader bobthesungeek76036. "And they are urging folks to not drag their feet in deploying these patches." Threatpost reports: The software giant patched 300+ bugs in its quarterly update. Oracle has patched 334 vulnerabilities across all of its product families in its January 2020 quarterly Critical Patch Update (CPU). Out of these, 43 are critical/severe flaws carrying CVSS scores of 9.1 and above. The CPU ties for Oracle's previous all-time high for number of patches issued, in July 2019, which overtook its previous record of 308 in July 2017. The company said in a pre-release announcement that some of the vulnerabilities affect multiple products. "Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update patches as soon as possible," it added.

"Some of these vulnerabilities were remotely exploitable, not requiring any login data; therefore posing an extremely high risk of exposure," said Boris Cipot, senior security engineer at Synopsys, speaking to Threatpost. "Additionally, there were database, system-level, Java and virtualization patches within the scope of this update. These are all critical elements within a company's infrastructure, and for this reason the update should be considered mandatory. At the same time, organizations need to take into account the impact that this update could have on their systems, scheduling downtime accordingly."

theodp writes: Major League Baseball Regulations "prohibit the use of electronic equipment during games and state that no such equipment may be used for the purpose of stealing signs or conveying information designed to give a Club an advantage," reminded MLB Commissioner Rob Manfred Monday as harsh punishment was meted out for the Houston Astros sign stealing scandal. You can read the Commissioner's full statement at MLB.com, after you first carefully review the site's 5,680 word Privacy Policy which, ironically, attempts to describe the many ways that MLB will use electronic surveillance to collect and share information about you and your friends.

MLB, a poster child for Google Marketing, boasted recently that the data it collects has enabled it to literally put a price on MLB fans' heads in the form of a Lifetime Value (LTV) metric. "Understanding our fans' budgets allows us to customize the offers and deals we present them," explained the MLB Technology blog. More details are available in Data Science and the Business of Major League Baseball (PDF, Strata Data Conference slides).

pgmrdlm shares a report from ABC News: Some hospitals are ditching the ritual of covering reproductive organs and fetuses during imaging exams after prominent medical and scientific groups have said it's a feel-good measure that can impair the quality of diagnostic tests and sometimes inadvertently increase a patient's radiation exposure. The about-face is intended to improve care, but it will require a major effort to reassure regulators, health care workers and the public that it's better not to shield.

Lead shields are difficult to position accurately, so they often miss the target area they are supposed to protect. Even when in the right place, they can inadvertently obscure areas of the body a doctor needs to see -- the location of a swallowed object, say -- resulting in a need to repeat the imaging process, according to the American Association of Physicists in Medicine, which represents physicists who work in hospitals. Shields can also cause automatic exposure controls on an X-ray machine to increase radiation to all parts of the body being examined in an effort to "see through" the lead. Moreover, shielding doesn't protect against the greatest radiation effect: "scatter," which occurs when radiation ricochets inside the body, including under the shield, and eventually deposits its energy in tissues. "In April, the physicists' association recommended that shielding of patients be 'discontinued as routine practice,'" the report adds. "Its statement was endorsed by several groups, including the American College of Radiology and the Image Gently Alliance, which promotes safe pediatric imaging. However, experts continue to recommend that health care workers in the imaging area protect themselves with leaded barriers as a matter of occupational safety."

According to the Las Vegas Convention and Visitors Authority, Elon Musk's Boring Company is now about 50% complete with its underground tunnel. It's about six football fields in length. Teslarati reports: The Boring Company officially started tunneling for the people mover after a ceremonial groundbreaking event on November 15. In just two months, the project is nearly halfway completed. The company's Tunnel Boring Machine (TBM) has been 40 feet underground for months and is working to drill two, one-mile-long tunnels. Boring Company began shipping portions of the TBM to the site in Las Vegas in September. Since then, the project has really started to take shape.

The project cost the Boring Company $52.5 million and is expected to connect the Las Vegas Convention Center to popular Las Vegas hot spots. Downtown Las Vegas, the Strip, and McCarran International Airport will all be destination options for riders. The mover is expected to transport an estimated 4,400 people per hour. The Las Vegas project is just one of five projects the Boring Company has listed on its website. A Livestream of the Boring Company's Las Vegas Tunnel Project is available for viewing here.

Tekla Perry writes: Startup Mojo Vision announced a microdisplay mid-2019, with not a lot of talk about applications. Turns out, they had one very specific application in mind -- an AR contact lens. Last week the company let selected media have a look at working prototypes, powered wirelessly, though plans for the next version include a battery on board. The demos included edge detection and enhancement (intended for people with low vision) in a darkened room and text annotations. The lenses are entering clinical trials (company executives have been testing them for some time already). Steve Sinclair, senior vice president of product and marketing, says the first application will likely be for people with low vision -- providing real-time edge detection and dropping crisp lines around objects. Other applications include translating languages in real time, tagging faces, and providing emotional cues.

"People can't tell you are wearing it, so we want the interaction to be subtle, done using just your eyes," Sinclair said. He also noted the experience is different from wearing glasses. "When you close your eyes, you still see the content displayed," he says. Mojo Vision is calling the technology Invisible Computing.

An anonymous reader quotes a report from Motherboard: BlackVue is a dashcam company with its own social network. With a small, internet-connected dashcam installed inside their vehicle, BlackVue users can receive alerts when their camera detects an unusual event such as someone colliding with their parked car. Customers can also allow others to tune into their camera's feed, letting others "vicariously experience the excitement and pleasure of driving all over the world," a message displayed inside the app reads. Users are invited to upload footage of their BlackVue camera spotting people crashing into their cars or other mishaps with the #CaughtOnBlackVue hashtag. But what BlackVue's app doesn't make clear is that it is possible to pull and store users' GPS locations in real-time over days or even weeks. Motherboard was able to track the movements of some of BlackVue's customers in the United States.

Ordinarily, BlackVue lets anyone create an account and then view a map of cameras that are broadcasting their location and live feed. This broadcasting is not enabled by default, and users have to select the option to do so when setting up or configuring their own camera. Motherboard tuned into live feeds from users in Hong Kong, China, Russia, the U.K, Germany, and elsewhere. BlackVue spokesperson Jeremie Sinic told Motherboard in an email that the users on the map only represent a tiny fraction of BlackVue's overall customers. But the actual GPS data that drives the map is available and publicly accessible. By reverse engineering the iOS version of the BlackVue app, Motherboard was able to write scripts that pull the GPS location of BlackVue users over a week long period and store the coordinates and other information like the user's unique identifier. One script could collect the location data of every BlackVue user who had mapping enabled on the eastern half of the United States every two minutes. Motherboard collected data on dozens of customers. Following the report, BlackVue said their developers "have updated the security measures" to prevent this sort of tracking.

Motherboard confirmed that previously provided user data stopped working, and they said they have "deleted all of the data collected to preserve individuals' privacy."

An anonymous reader quotes a report from Ars Technica: Comcast has agreed to issue refunds to 15,600 customers and cancel the debts of another 16,000 people to settle allegations that the cable company lied to customers in order to hide the true cost of service. Comcast will have to pay $1.3 million in refunds. The settlement with Minnesota Attorney General Keith Ellison, announced yesterday, resolves a lawsuit filed by the state against Comcast in December 2018.

The attorney general's lawsuit alleged that Comcast "charged Minnesota consumers more than it promised it would for their cable services, including undisclosed 'fees' that the company used to bolster its profits, and that it charged for services and equipment that customers did not request," the settlement announcement said. Comcast also "promised [customers] prepaid gift cards as an inducement to enter into multi-year contracts, then failed to provide the cards," Minnesota alleged. Refunds to the 15,600 customers will total $1.14 million. Comcast must also pay another $160,000 to the state attorney general's office, which can use any or all of that amount to provide additional refunds. That brings the total amount Comcast will pay to $1.3 million.

Pine64 will finally start shipping the pre-order units of PinePhone Braveheart Edition on January 17, 2020. Fossbytes reports: A year ago, PinePhone was made available only to developers and hackers. After getting better responses and suggestions, the Pine64 developers planned to bring Pinephone for everyone. In November last year, pre-orders for PinePhone Braveheart Edition commenced for everyone. But due to manufacturing issues coming in the way, the shipment date slipped for weeks, which was scheduled in December last year.

PinePhone Braveheart Edition is an affordable, open source Linux-based operating system smartphone preloaded with factory test image running on Linux OS (postmarketOS) on inbuilt storage. You can check on PinePhone Wiki to find the PinePhone compatible operating system such as Ubuntu Touch, postmarketOS, or Sailfish OS, which you can boot either from internal storage or an SD card.

Google said today that it's on track to bring more than 120 games to its cloud gaming service Stadia in 2020 and is planning to offer more than 10 Stadia-exclusive games for the first half of the year. From a report: That would be a pretty massive jump from the 26 games and one exclusive that are currently available, and all in a little more than a year after the service's launch, if those projections hold true. Previously, Google had only explicitly confirmed four games for 2020, so this news was much needed to let early adopters know there are a lot more games on the way. Google also announced other updates rolling out to Stadia over the next three months, including 4K gaming on the web, support for more Android phones (it's currently only available on Google's Pixels), wireless gameplay on the web through the Stadia controller (you currently have to plug in a cable), and "further [Google] Assistant functionality" when playing Stadia through a browser. We're asking Google for more details -- and we're particularly curious whether any of the new exclusive games are the kind that are only possible with the power of the cloud. The company said in October that it's building out a few first-party studios to eventually make that a reality.

Google said this week that it will begin to phase out traditional Chrome apps starting in June, and winding down slowly over two years' time. Chrome extensions, though, will live on. From a report: Google said Tuesday in a blog post that it would stop accepting new Chrome apps in March. Existing apps could continue to be developed through June, 2022. The important dates start in June of this year, when Google will end support for Chrome Apps on the Windows, Mac, and Linux platforms. Education and Enterprise customers on these platforms will get a little more time to get their affairs in order, until December, 2020. Google had actually said four years ago that it would phase out Chrome apps on Windows, Mac, and Linux in 2018. The company appears to have waited longer than announced before beginning this process. The other platform that's affected by this, of course, is Google's own Chrome OS and Chromebooks, for which the apps were originally developed.

Bruce Schneier comments on the issues surrounding 5G security: [...] Keeping untrusted companies like Huawei out of Western infrastructure isn't enough to secure 5G. Neither is banning Chinese microchips, software, or programmers. Security vulnerabilities in the standards, the protocols and software for 5G, ensure that vulnerabilities will remain, regardless of who provides the hardware and software. These insecurities are a result of market forces that prioritize costs over security and of governments, including the United States, that want to preserve the option of surveillance in 5G networks. If the United States is serious about tackling the national security threats related to an insecure 5G network, it needs to rethink the extent to which it values corporate profits and government espionage over security. To be sure, there are significant security improvements in 5G over 4G in encryption, authentication, integrity protection, privacy, and network availability. But the enhancements aren't enough. The 5G security problems are threefold.

First, the standards are simply too complex to implement securely. This is true for all software, but the 5G protocols offer particular difficulties. Because of how it is designed, the system blurs the wireless portion of the network connecting phones with base stations and the core portion that routes data around the world. Additionally, much of the network is virtualized, meaning that it will rely on software running on dynamically configurable hardware. This design dramatically increases the points vulnerable to attack, as does the expected massive increase in both things connected to the network and the data flying about it. Second, there's so much backward compatibility built into the 5G network that older vulnerabilities remain. 5G is an evolution of the decade-old 4G network, and most networks will mix generations. Without the ability to do a clean break from 4G to 5G, it will simply be impossible to improve security in some areas. Attackers may be able to force 5G systems to use more vulnerable 4G protocols, for example, and 5G networks will inherit many existing problems. Third, the 5G standards committees missed many opportunities to improve security. Many of the new security features in 5G are optional, and network operators can choose not to implement them. The same happened with 4G; operators even ignored security features defined as mandatory in the standard because implementing them was expensive. But even worse, for 5G, development, performance, cost, and time to market were all prioritized over security, which was treated as an afterthought.

Security researchers have published proof-of-concept (PoC) code for exploiting a recently-patched vulnerability in the Windows operating system, a vulnerability that has been reported to Microsoft by the US National Security Agency (NSA). From a report: The bug, which some have started calling CurveBall, impacts CryptoAPI (Crypt32.dll), the component that handles cryptographic operations in the Windows OS. According to a high-level technical analysis of the bug from cyber-security researcher Tal Be'ery, "the root cause of this vulnerability is a flawed implementation of the Elliptic Curve Cryptography (ECC) within Microsoft's code." According to both the NSA, the DHS, and Microsoft, when exploited, this bug (tracked as CVE-2020-0601) can allow an attacker to: 1. Launch MitM (man-in-the-middle) attacks and intercept and fake HTTPS connections. 2. Fake signatures for files and emails. 3. Fake signed-executable code launched inside Windows.

The two companies, along with Sonos and Basecamp, are set to testify at an antitrust hearing Friday that Apple, Amazon, Facebook and Google threaten their businesses. From a report: David Barnett is an unlikely warrior in the battle against big tech. The founder and chief executive of PopSockets, a Colorado company that makes a widely popular kickstand-of-sorts for smartphones, says he isn't even an "expert on antitrust laws" in Washington. But Barnett discovered firsthand the rare power and influence of Amazon in 2018, after clashing with the e-commerce giant over policies that made it hard to sell his products on his preferred terms and prices. PopSockets soon terminated its ties with Amazon, which helped lead to sizable losses later as a result. "What company that started a business out of their garage can afford to lose $10 million?" he asked in an interview. "We're lucky we're in a position we're profitable and could take a stand."

Barnett's story could resonate with federal regulators: Such tales of big tech's debatably brash, bullying tactics are set to take center stage when he and his corporate peers testify at a high-profile congressional hearing Friday. The session could elicit the most convincing, public evidence to date that Apple, Amazon, Facebook and Google have become too big and powerful -- and need to be restrained. [...] Along with PopSockets, lawmakers are set to hear from top executives at Sonos, a high-end audio company, and Basecamp, which makes collaborative workplace software. Both allege Google undermines smaller rivals. Sonos has sued Google, alleging patent infringement as well.

Apple's recent purchase of Seattle-based AI company Xnor.ai is leaving Wyze's affordable cameras without the people detection feature. The Verge reports: Cameras from fellow Seattle-based company Wyze, including the Wyze Cam V2 and Wyze Cam Pan, have utilized Xnor.ai's on-device people detection since last summer. But now that Apple owns the company, it's no longer available. Some people on Wyze's forum are noting that the beta firmware removing the people detection has already started to roll out. Oddly enough, word of this lapse in service isn't anything new. Wyze issued a statement in November 2019 saying that Xnor.ai had terminated their contract (though its reason for doing so wasn't as clear then as it is today), and that a firmware update slated for mid-January 2020 would remove the feature from those cameras.

There's a bright side to this loss, though, even if Apple snapping up Xnor.ai makes Wyze's affordable cameras less appealing in the interim. Wyze says that it's working on its own in-house version of people detection for launch at some point this year. And whether it operates on-device via "edge AI" computing like Xnor.ai's does, or by authenticating through the cloud, it will be free for users when it launches. That's good and all, but the year just started, and it's a little worrying Wyze hasn't followed up with a specific time frame for its replacement of the feature. Two days ago, Wyze's social media community manager stated that the company was "making great progress" on its forums, but they didn't offer up when it would be available.

According to contracts posted on a federal spending database, the U.S. military is working to develop facial recognition technology that reads the pattern of heat being emitted by faces in order to identify specific people. OneZero reports: Now, the military wants to develop a facial recognition system that analyzes infrared images to identify individuals. The Army Research Lab has previously publicized research in this area, but these contracts, which started at the end of September 2019 and run until 2021, indicate the technology is now being actively developed for use in the field. "Sensors should be demonstrable in environments such as targets seen through automotive windshield glass, targets that are backlit, and targets that are obscured due to light weather (e.g., fog)," the Department of Defense indicated when requesting proposals.

The DoD is calling for the technology to be incorporated into a device that is small enough to be carried by an individual. The device should be able to operate from a distance of 10 to 500 meters and match individuals against a watchlist. According to the details of the request, the Defense Forensics and Biometrics Agency is directly overseeing work on the technology. Two companies are working on this technology on behalf of the DFBA, Cyan Systems, Inc. and Polaris Sensor Technologies.

According to physicist Jason Steffen, letting slower passengers board airplanes first actually results in a more efficient process and less time before takeoff. An anonymous reader shares a report from Ars Technica: Back in 2011, Jason Steffen, now a physicist at the University of Nevada, Las Vegas, became intrigued by the problem and applied the same optimization routine used to solve the famous traveling salesman problem to airline boarding strategies. Steffen fully expected that boarding from the back to the front would be the most efficient strategy and was surprised when his results showed that strategy was actually the least efficient. The most efficient, aka the "Steffen method," has the passengers board in a series of waves. "Adjacent passengers in line will be seated two rows apart from each other," Steffen wrote at The Conversation in 2014. "The first wave of passengers would be, in order, 30A, 28A, 26A, 24A, and so on, starting from the back."

Field tests bore out the results, showing that Steffen's method was almost twice as fast as boarding back-to-front or rotating blocks of rows and 20-30 percent faster than random boarding. The key is parallelism, according to Steffen: the ideal scenario is having more than one person sitting down at the same time. "The more parallel you can make the boarding process, the faster it will go," he told Ars. "It's not about structuring things as much as it is about finding the best way to facilitate multiple people sitting down at the same time." Steffen used a standard agent-based model using particles to represent individual agents. This latest study takes a different approach, modeling the boarding process using Lorentzian geometry -- the mathematical foundation of Einstein's general theory of relativity. Co-author Sveinung Erland of Western Norway University and colleagues from Latvia and Israel exploited the well-known connection between microscopic dynamics of interacting particles and macroscopic properties and applied it to the boarding process. In this case, the microscopic interacting particles are the passengers waiting in line to board, and the macroscopic property is how long it takes all the passengers to settle into their assigned seats. The paper has been published in the journal Physical Review E.

On Monday, members of the European Parliament (MEPs) discussed the idea of introducing "binding measures" that would require chargers that fit all mobile phones and portable electronic devices. The company that would be impacted most by this legislation would be Apple and its iPhone, which uses a Lightning cable while most new Android phones use USB-C ports for charging. ZDNet reports: The EU introduced the voluntary Radio Equipment Directive in 2014, but MEPs believe the effort fell short of the objectives. "The voluntary agreements between different industry players have not yielded the desired results," MEPs said. The proposed more stringent measures are aimed at reducing electronic waste, which is estimated to amount to 51,000 tons per year in old chargers.

Apple last year argued that regulations to standardize chargers for phones would "freeze innovation rather than encourage it" and it claimed the proposal was "bad for the environment and unnecessarily disruptive for customers." Noted Apple analyst Ming-Chi Kuo reckons Apple has a different idea in store: getting rid of the Lightning port and not replacing it with USB-C, which is a standard that Apple doesn't have complete control over. According to the analyst, Apple plans to remove the Lightning connector on a flagship iPhone to be released in 2021. Instead it would rely on wireless charging.

Gary Starkweather, engineer and inventor of the first laser printer, died on December 26 at the age of 81. The New York Times reports: Mr. Starkweather was working as a junior engineer in the offices of the Xerox Corporation in Rochester, N.Y., in 1964 -- several years after the company had introduced the photocopier to American office buildings -- when he began working on a version that could transmit information between two distant copiers, so that a person could scan a document in one place and send a copy to someone else in another. He decided that this could best be done with the precision of a laser, another recent invention, which can use amplified light to transfer images onto paper. But then he had a better idea: Rather than sending grainy images of paper documents from place to place, what if he used the precision of a laser to print more refined images straight from a computer? "What you have to do is not just look at the marble," he said in a talk at the University of South Florida in 2017. "You have to see the angel in the marble."

Because his idea ventured away from the company's core business, copiers, his boss hated it. At one point Mr. Starkweather was told that if he did not stop working on the project, his entire team would be laid off. "If you have a good idea, you can bet someone else doesn't think it's good," Mr. Starkweather would say in 1997 in a lecture for the Computer History Museum in Mountain View, Calif. But he soon finagled a move to the company's new research lab in Northern California, where a group of visionaries was developing what would become the most important digital technologies of the next three decades, including the personal computer as it is known today. At the Palo Alto Research Center, or PARC, Mr. Starkweather built the first working laser printer in 1971 in less than nine months. By the 1990s, it was a staple of offices around the world. By the new millennium, it was nearly ubiquitous in homes as well.

Bose plans to close its entire retail store footprint in North America, Europe, Japan, and Australia. The company announced the decision earlier today and pointed to the fact that its headphones, speakers, and other products "are increasingly purchased through e-commerce" as the reasoning. Hundreds of employees will be laid off as a result. The Verge reports: Bose opened its first physical retail store in 1993 and currently has locations in many shopping centers and the remaining malls scattered across the US. The stores are used to showcase the company's product lineup, which has grown beyond Bose's signature noise-canceling headphones in recent years to include smart speakers and sunglasses that double as earbuds. There are often similar demo areas at retailers like Best Buy, though Bose has plenty of competition to worry about in that environment.

The Framingham, Massachusetts-based company is privately held and is not revealing exactly how many workers are being impacted by its decision to pull out of physical retail. Bose is shuttering its retail presence in North America, Europe, Japan, and Australia "over the next few months." That adds up to a total of 119 stores, according to a spokesperson. "In other parts of the world, Bose stores will remain open, including approximately 130 stores located in Greater China and the United Arab Emirates; and additional stores in India, Southeast Asia, and South Korea," the company told The Verge by email. Bose says it's offering outplacement assistance and severance to employees that are being laid off.

An anonymous reader quotes a report from Wired: Twitch has been and remains home to illicit sports broadcasts; a late December boxing match attracted over 86,000 viewers -- some of whom spammed ASCII genitalia in chat -- and a mid-January soccer match drew over 70,000 over three livestreams. Although Twitch often stomps them out mid-match, plenty of livestreams posted by throwaway accounts with innocuous names like "Untitled" slip through the cracks and garner tens of thousands of viewers. As the value of sports media rights has climbed to over $20 billion, copyright holders have more incentive than ever to guard their treasure. Yet piracy persists, in part because it's so burdensome for copyright holders to catch it. Stream aggregation site FirstRow Sports lays out a buffet of illicit livestreams for games ranging from ice hockey to basketball and attracts over 300,000 daily visitors, according to data from web analytics firm SimilarWeb. In January 2019 alone, sports fans accessed sports piracy sites 362.7 million times, according to data from digital piracy research firm Muso. On Discord, anonymous benefactors distribute links to soccer livestreams like handfuls of pigeon feed at the park. Once a stream is taken down, another immediately manifests. It's like 40 games of Whac-A-Mole simultaneously taking place in 40 adjacent arcades.

Increasingly, those links lead to Twitch, whose credentials as a mainstream platform make it a relatively safe option -- especially after Reddit shut down the popular soccer piracy subreddit r/soccerstreams. "The older days of streams (5+ years ago) was [sic] littered with ads and viruses," says a soccer stream Discord moderator who goes by Tom. "even though it is considered illegal, I see it being the same as watching porn and being under 18." He adds that some of the hairier-looking piracy sites are still more popular, offer higher-quality streams, and have live chats that utilize Twitch chats' code. Twitch's DMCA guidelines specify that copyright owners can submit takedown requests, and asks the people who submit them to add a "statement under penalty of perjury" that they're authorized to act on behalf of the copyright owner. Occasionally, media companies file claims to Twitch impacting legitimate streamers who commentate over or react to games, television, or YouTube clips. Copyright holders can also choose to sue, as the third-largest internet company in Russia did against Twitch in December for broadcasting an English Premier League streams. It's a rare escalation, and one that underscores how serious an issue Twitch sports piracy has become. Twitch "only provides users access to the platform, does not post its own content, cannot change the content posted by users, or track possible violations of rights," says Twitch lawyer Yuliana Tabastayeva.

The live streaming service said it will "continue to, as has always been the case, effectively and swiftly address any violation of its terms of service with the removal of unlicensed copyrighted content."