Google has announced plans today to phase out the usage of user-agent strings in its web browser Chrome. From a report: UA strings have been developed part of the Netscape browser in the 90s, and have been in use ever since. For decades, websites have used UA strings to fine-tune features based on a visitor's technical specifications. But now, Google says that this once-useful mechanism has become a constant source of problems, on different fronts. For starters, UA strings have been used by online advertisers as a way to track and fingerprint website visitors. "On top of those privacy issues, User-Agent sniffing is an abundant source of compatibility issues, in particular for minority browsers, resulting in browsers lying about themselves (generally or to specific sites) , and sites (including Google properties) being broken in some browsers for no good reason," said Yoav Weiss, a Google engineer working on the Chrome browser.

To address these issues, Google said it plans to phase out the importance of UA strings in Chrome by freezing the standard as a whole. Google's plan is to stop updating Chrome's UA component with new strings (the UA string text that Chrome shares with websites). The long-term plan is to unify all Chrome UA strings into generic values that don't reveal too much information about a user. This means that new Chrome browser releases on new platforms such as new smartphone models or new OS releases will use a generic UA string, rather than one that's customised for that specific platform.

An anonymous reader shares a report: The U.S. military is spending more than $4.5 million to develop facial recognition technology that reads the pattern of heat being emitted by faces in order to identify specific people. The technology would work in the dark and across long distances, according to contracts posted on a federal spending database. Facial recognition is already employed by the military, which uses the technology to identify individuals on the battlefield. But existing facial recognition technology typically relies on images generated by standard cameras, such as those found in iPhone or CCTV networks.

Now, the military wants to develop a facial recognition system that analyzes infrared images to identify individuals. The Army Research Lab has previously publicized research in this area, but these contracts, which started at the end of September 2019 and run until 2021, indicate the technology is now being actively developed for use in the field. "Sensors should be demonstrable in environments such as targets seen through automotive windshield glass, targets that are backlit, and targets that are obscured due to light weather (e.g., fog)," the Department of Defense indicated when requesting proposals.

Indonesia's Lion Air considered putting its pilots through simulator training before flying the Boeing 737 Max but abandoned the idea after the planemaker convinced them in 2017 it was unnecessary, Bloomberg reported Tuesday, citing people familiar with the matter and internal company communications. From the report: The next year, 189 people died when a Lion Air 737 Max plunged into the Java Sea, a disaster blamed in part on inadequate training and the crew's unfamiliarity with a new flight-control feature on the Max that malfunctioned. Boeing employees had expressed alarm among themselves over the possibility that one of the company's largest customers might require its pilots to undergo costly simulator training before flying the new 737 model, according to internal messages that have been released to the media. Those messages, included in the more than 100 pages of internal Boeing communications that the company provided to lawmakers and the U.S. Federal Aviation Administration and released widely on Thursday, had Lion Air's name redacted.

Brian Krebs: Sources tell KrebsOnSecurity that Microsoft is slated to release a software update on Tuesday to fix an extraordinarily serious security vulnerability in a core cryptographic component present in all versions of Windows. Those sources say Microsoft has quietly shipped a patch for the bug to branches of the U.S. military and to other high-value customers/targets that manage key Internet infrastructure, and that those organizations have been asked to sign agreements preventing them from disclosing details of the flaw prior to Jan. 14, the first Patch Tuesday of 2020. According to sources, the vulnerability in question resides in a Windows component known as crypt32.dll, a Windows module that Microsoft says handles "certificate and cryptographic messaging functions in the CryptoAPI." The Microsoft CryptoAPI provides services that enable developers to secure Windows-based applications using cryptography, and includes functionality for encrypting and decrypting data using digital certificates. NSA said on Tuesday that it spotted the vulnerability and reported it to Microsoft. NSA said Microsoft will report later today that it has seen no active exploitation of this vulnerability. NSA's Director of Cybersecurity, Anne Neuberger, says the critical cryptographic vulnerability resides in Windows 10 and Windows Server 2016, and that the concern about this particular flaw is that it "makes trust vulnerable."

An anonymous reader quotes a report from CNET: In a tweet, the Tesla CEO Elon Musk said the company's vehicles will soon be able to talk to pedestrians if you choose, and he showed off a clip of the unnamed feature in action. The Model 3 passing by tells the cameraman, "Well, don't just stand there staring, hop in."

Musk didn't dish out more information on the function, but the speakers used are likely the same ones added to meet new regulations for electric cars and plug-in hybrids this year. Teslas, and all other EVs, will need to make an alert tone under 18.6 mph starting this year. What also isn't clear is how the car will actually talk. Clearly, the clip above is a prerecorded message. If drivers will actually be able to speak to pedestrians remains unknown, or perhaps Tesla will offer a library of messages. Tesla told Roadshow Musk's tweet "is the extent of what we're sharing right now, though the CEO did say Teslas will also be able to "fart in [pedestrians'] general direction."

Apple's initiatives to minimize tracking by marketers is continuing to make life harder for the advertising industry, forcing advertisers to use inefficient data sources to pinpoint users. AppleInsider reports: Over the years, Apple has enhanced how it protects the privacy of its users online, typically by limiting what data can be seen by advertisers tracking different data points. Initiatives such as Intelligent Tracking Protection in Safari has helped secure more privacy by making it harder to track individual users, which advertising executives in December admitted has been "stunningly effective." While ITP and other improvements have helped to minimize the tracking of users, marketers are also being affected by another element of iOS 13, one where users are regularly notified of apps that are capturing their location in the background. The warning gives options for users to allow an app to continue to track all the time or to do so when it is open, with users often selecting the latter.

According to data from verification firm Location Sciences seen by DigiDay, approximately seven in ten iPhone users tracked by the company downloaded iOS 13 in its first six weeks of availability. Of those tracked users who installed the update, around 80% of them stopped all background tracking by apps. Ad tracking company Teemo suggests the opt-in rates to share data with apps when not in use are often below 50%, whereas three years ago, the same rates were close to 100%. The higher rates were due to it being a time when users were largely unaware there were options to disable tracking in the first place.

Cy Guy writes: Having not learned the lessons of Jurassic Park and the Terminator, scientists from the University of Vermont and Tufts have created "reconfigurable organisms" using stem cells from frogs. But don't worry, the research was funded by the Department of Defense, so I'm sure nothing could possibly go wrong this time. "The robots, which are less than 1mm long, are designed by an 'evolutionary algorithm' that runs on a supercomputer," reports The Guardian. "The program starts by generating random 3D configurations of 500 to 1,000 skin and heart cells. Each design is then tested in a virtual environment, to see, for example, how far it moves when the heart cells are set beating. The best performers are used to spawn more designs, which themselves are then put through their paces."

"Because heart cells spontaneously contract and relax, they behave like miniature engines that drive the robots along until their energy reserves run out," the report adds. "The cells have enough fuel inside them for the robots to survive for a week to 10 days before keeling over."

The findings have been published in the Proceedings of the National Academy of Sciences.

An anonymous reader quotes a report from IEEE Spectrum: Busan-based firm Jenax has spent the past few years developing J.Flex, an advanced lithium-ion battery that is ultra-thin, flexible, and rechargeable. With the arrival of so many wearable gadgets, phones with flexible displays, and other portable gizmos, "we're now interacting with machines on a different level from what we did before," says EJ Shin, head of strategic planning at Jenax. "What we're doing at Jenax is putting batteries into locations where they couldn't be before," says Shin. Her firm demonstrated some of those new possibilities last week at CES 2020 in Las Vegas.

The devices shown by Jenax included a sensor-lined football helmet developed by UK-based firm HP1 Technologies to measure pressure and force of impact; a medical sensor patch designed in France that will be embedded in clothing to monitor a wearer's heart rate; and wearable power banks in the form of belts and bracelets for patients who must continuously be hooked up to medical devices. To make batteries flexible, companies play around with the components of a battery cell, namely the cathode, anode, electrolyte, and membrane separator. In the case of Jenax, which has more than 100 patents protecting its battery technology, Shin says the secret to its flexibility lies in "a combination of materials, polymer electrolyte, and the know-how developed over the years." J.Flex is made from graphite and lithium cobalt oxide, but its exact composition and architecture remains a secret. "J.Flex can be as thin as 0.5 millimeters (suitable for sensors), and as tiny as 20 by 20 millimeters (mm) or as large as 200 by 200 mm," the report adds. "Its operating voltage is between 3 and 4.25 volts. Depending on the size, battery capacity varies from 10 milliampere-hours to 5 ampere-hours, with close to 90 percent of this capacity remaining after 1,000 charge-discharge cycles. Each charge typically takes an hour. J. Flex's battery life depends on how it's used, Shin says -- a single charge can last for a month in a sensor, but wouldn't last that long if the battery was powering a display."

Areyoukiddingme writes: EFF has filed an amicus brief with the U.S. Supreme Court in Google v. Oracle, arguing that APIs are not copyrightable. From the press release: "The Electronic Frontier Foundation (EFF) today asked the U.S. Supreme Court to rule that functional aspects of Oracle's Java programming language are not copyrightable, and even if they were, employing them to create new computer code falls under fair use protections. The court is reviewing a long-running lawsuit Oracle filed against Google, which claimed that Google's use of certain Java application programming interfaces (APIs) in its Android operating system violated Oracle's copyrights. The case has far-reaching implications for innovation in software development, competition, and interoperability.

In a brief filed today, EFF argues that the Federal Circuit, in ruling APIs were copyrightable, ignored clear and specific language in the copyright statute that excludes copyright protection for procedures, processes, and methods of operation. 'Instead of following the law, the Federal Circuit decided to rewrite it to eliminate almost all the exclusions from copyright protection that Congress put in the statute,' said EFF Legal Director Corynne McSherry. 'APIs are not copyrightable. The Federal Circuit's ruling has created a dangerous precedent that will encourage more lawsuits and make innovative software development prohibitively expensive. Fortunately, the Supreme Court can and should fix this mess.'" Oral arguments before the U.S. Supreme Court are scheduled for March 2020, and a decision by June.

As Korean firms start using AI to help hire new employees, students are going to school to learn how to beat the bots. Reuters reports: From his basement office in downtown Gangnam, careers consultant Park Seong-jung is among those in a growing business of offering lessons in handling recruitment screening by computers, not people. Video interviews using facial recognition technology to analyze character are key, according to Park. "Don't force a smile with your lips," he told students looking for work in a recent session, one of many he said he has conducted for hundreds of people. "Smile with your eyes."

Classes in dealing with AI in hiring, now being used by major South Korean conglomerates like SK Innovation and Hyundai Engineering & Construction, are still a tiny niche in the country's multi-billion dollar cram school industry. But classes are growing fast, operators like Park's People & People consultancy claim, offering a three-hour package for up to 100,000 won ($86.26). According to Korea Economic Research Institute (KERI), nearly a quarter of the top 131 corporations in the country currently use or plan to use AI in hiring. One AI video system reviewed by Reuters asks candidates to introduce themselves, during which it spots and counts facial expressions including 'fear' and 'joy' and analyses word choices. It then asks questions that can be tough: "You are on a business trip with your boss and you spot him using the company (credit) card to buy himself a gift. What will you say?" AI hiring also uses 'gamification' to gauge a candidate's personality and adaptability by putting them through a sequence of tests.

PolygamousRanchKid shares a report from The Verge: We've already seen Samsung's new rugged smartphone with a removable battery, the Galaxy XCover Pro, because the company revealed it on its Finnish website before taking it down. Today, though, the company is officially announcing the phone and that it's coming to the U.S. for $499. For that price, you're getting a phone with a swappable battery that's a meaty 4,050mAh, and the phone even supports 15W fast charging, as well as with special docks that use pogo pins. The XCover Pro is intended to be used by workers in industrial settings or out in the field, so that huge battery should theoretically let workers use their phones for longer and give them the option to swap in a fresh battery in a pinch.

Otherwise, the phone's specs are mid-range: a 6.3-inch 2220 x 1080 display (which Samsung says you can use when you have gloves on), a 2GHz octa-core Exynos 9611 processor, 4GB of RAM, and 64GB of internal storage (with support for microSD storage up to 512GB). For cameras, the phone has a 13-megapixel front-facing camera in a corner of the screen and two rear cameras: a 25-megapixel camera and an 8-megapixel camera. It'll also ship with the latest Android 10 and Samsung's One UI 2.0, contrary to information from the early reveal that indicated that the XCover Pro was running Android 9 Pie.

Visa announced today that it is buying financial services API startup Plaid for $5.3 billion, roughly double the price of its last private valuation. TechCrunch reports: Plaid develops financial services APIs. It is akin to what Stripe does for payments, but instead of facilitating payments, it helps developers share banking and other financial information more easily. It's the kind of service that makes sense for a company like Visa. The startup bought Quovo two years ago to move beyond just banking, and into broader financial services and investments. The idea was to provide a more holistic platform for financial services providers. As the founders wrote in a blog post at the time of the acquisition, "Financial applications have historically used Plaid primarily to interact with checking and savings accounts. In acquiring Quovo, we are extending our capabilities to a wider class of assets." The deal is expected to close in the next three to six months, pending regulatory approval.

An anonymous reader quotes a report from Ars Technica: On December 16, 2019, Citrix revealed a vulnerability in the company's Application Delivery Controller and Gateway products -- commercial virtual-private-network gateways formerly marketed as NetScaler and used by tens of thousands of companies. The flaw, discovered by Mikhail Klyuchnikov of Positive Technologies, could give an attacker direct access to the local networks behind the gateways from the Internet without the need for an account or authentication using a crafted Web request. Citrix has published steps to reduce the risk of the exploit. But these steps, which simply configure a responder to handle requests using the text that targets the flaw, breaks under some circumstances and might interfere with access to the administration portal for the gateways by legitimate users. A permanent patch will not be released until January 20. And as of January 12, over 25,000 servers remain vulnerable, based on scans by Bad Packets.

This is not surprising, considering the number of Pulse Secure VPNs that have not yet been patched over six months after a fix was made available, despite Pulse Secure executives saying that they have "worked aggressively" to get customers to patch that vulnerability. And given that vulnerable Pulse Secure servers have been targeted now for ransomware attacks, the same will likely be true for unprotected Citrix VPN servers -- especially since last week, proof-of-concept exploits of the vulnerability began to appear, including at least two published on GitHub, as ZDNet's Catalin Cimpanu reported. "The vulnerability allows the remote execution of commands in just two HTTP requests, thanks to a directory traversal bug in the implementation of the gateway's Web interface," the report adds. "The attacks use a request for the directory '/vpn/../vpns/' to fool the Apache Web server on the gateway to point to the '/vpns/' directory without authentication. The attacks then inject a command based on the template returned from the first request."

You can check for the vulnerability here.

Google announced last week the alternative search engines it will show to new Android users in the EU, with DuckDuckGo the most frequently offered choice and Bing tied for last place. From a report: EU citizens setting up Android devices from March 1 will given a choice of four search engines to use as their default, including Google. Whichever provider they chose will become the default for searches made in Chrome and through Android's home screen search box. A dedicated app for that provider will also be installed on their device.

Through its partnerships with health care providers, Google can view tens of millions of patient records in at least three-quarters of states, the Wall Street Journal reports. From a report: Some of these partnerships allow Google to access identifiable information about patients without their or their doctors' knowledge, raising fears about how this data may be used. Google is developing a new search tool -- designed to be used by doctors, nurses and potentially patients -- that stores and analyzes patient information on its servers. The company and some health systems say argue that data-sharing can improve patient outcomes. Google says its health endeavors aren't connected with its advertising business.

The last decade was a big one for artificial intelligence but researchers in the field believe that the industry is about to enter a new phase . From a report: Hype surrounding AI has peaked and troughed over the years as the abilities of the technology get overestimated and then re-evaluated. The peaks are known as AI summers, and the troughs AI winters. The 10s were arguably the hottest AI summer on record with tech giants repeatedly touting AI's abilities. AI pioneer Yoshua Bengio, sometimes called one of the "godfathers of AI", told the BBC that AI's abilities were somewhat overhyped in the 10s by certain companies with an interest in doing so. There are signs, however, that the hype might be about to start cooling off.

"I have the sense that AI is transitioning to a new phase," said Katja Hofmann, a principal researcher at Microsoft Research in Cambridge. Given the billions being invested in AI and the fact that there are likely to be more breakthroughs ahead, some researchers believe it would be wrong to call this new phase an AI winter. Robot Wars judge Noel Sharkey, who is also a professor of AI and robotics at Sheffield University, told the BBC that he likes the term "AI autumn" -- and several others agree.

The UK's National Cyber Security Centre (NCSC) is warning people of using online banking or accessing sensitive accounts from devices running Windows 7 from Tuesday, 14 January, when Microsoft ends support for the operating system. From a report: The NCSC, the government body for cybersecurity, is encouraging people to upgrade from Windows 7 as soon as possible, due to Microsoft's 2019 decision to stop providing technical support for the software. "The NCSC would encourage people to upgrade devices currently running Windows 7, allowing them to continue receiving software updates which help protect their devices," the NCSC spokesperson said. "We would urge those using the software after the deadline to replace unsupported devices as soon as possible, to move sensitive data to a supported device and not to use them for tasks like accessing bank and other sensitive accounts. They should also consider accessing email from a different device."

Ever-faster processors led to bloated software, but physical limits may force a return to the concise code of the past. John Naughton: Moore's law is just a statement of an empirical correlation observed over a particular period in history and we are reaching the limits of its application. In 2010, Moore himself predicted that the laws of physics would call a halt to the exponential increases. "In terms of size of transistor," he said, "you can see that we're approaching the size of atoms, which is a fundamental barrier, but it'll be two or three generations before we get that far -- but that's as far out as we've ever been able to see. We have another 10 to 20 years before we reach a fundamental limit." We've now reached 2020 and so the certainty that we will always have sufficiently powerful computing hardware for our expanding needs is beginning to look complacent. Since this has been obvious for decades to those in the business, there's been lots of research into ingenious ways of packing more computing power into machines, for example using multi-core architectures in which a CPU has two or more separate processing units called "cores" -- in the hope of postponing the awful day when the silicon chip finally runs out of road. (The new Apple Mac Pro, for example, is powered by a 28-core Intel Xeon processor.) And of course there is also a good deal of frenzied research into quantum computing, which could, in principle, be an epochal development.

But computing involves a combination of hardware and software and one of the predictable consequences of Moore's law is that it made programmers lazier. Writing software is a craft and some people are better at it than others. They write code that is more elegant and, more importantly, leaner, so that it executes faster. In the early days, when the hardware was relatively primitive, craftsmanship really mattered. When Bill Gates was a lad, for example, he wrote a Basic interpreter for one of the earliest microcomputers, the TRS-80. Because the machine had only a tiny read-only memory, Gates had to fit it into just 16 kilobytes. He wrote it in assembly language to increase efficiency and save space; there's a legend that for years afterwards he could recite the entire program by heart. There are thousands of stories like this from the early days of computing. But as Moore's law took hold, the need to write lean, parsimonious code gradually disappeared and incentives changed.

VeriSign has released a "proposed agreement" with ICANN to amend their exclusive .com registry agreement to allow them to raise the price of dotcom registrations up to 28% every six years.

Those new terms "are now open to public comment" -- and the Register points out that ICANN's decision seems to come with a corresponding $20 million for ICANN: Operator of the dot-com registry, Verisign, has decided to pay DNS overseer ICANN $4 million a year for the next five years in order to "educate the wider ICANN community about security threats."

Even though the generous $20 million donation has nothing to do with ICANN signing off on an extension of the dot-com contract until 2024, the "binding letter of intent" [PDF] stating the exact amount of funding will be appended to the registry agreement that Verisign has with ICANN to run the dot-com registry.

That extension lifts a price freeze put in place several years ago and will allow Verisign to increase prices by seven per cent a year [in each of the last four years of each six year contract renewal]. It's an increase that we calculated was worth $993 million and which the stock market appeared to agree with when it raised the company's share price by 16 per cent when the agreement was first flagged in November 2018...

ICANN explains the $20 million this time will be used to "support ICANN's initiatives to preserve and enhance the security, stability and resiliency of the DNS, including root server system governance, mitigation of DNS security threats, promotion and/or facilitation of DNSSEC deployment, the mitigation of name collisions, and research into the operation of the DNS."

Which is all entirely above board and not at all shady.

ZDNet's UK editor-in-chief Steve Ranger argues the end of Windows 7 "marks the end of the PC era, too." When Windows 7 launched, the iPhone and its app store were around but were still novelties, while the iPad hadn't arrived yet. If you wanted to get work -- or pretty much anything -- done on a computer, you needed a PC. Just over a decade later, the picture is much more complicated.

PC sales have been in decline for the last seven years; a slide which only ended with a small increase last year, largely because businesses needed to buy new PCs to run Windows 10, after bowing to the inevitable and upgrading. In many scenarios and use cases the PC has been superseded by the smartphone, the tablet or digital assistants embodied in various other devices. And it's not just the PC -- Windows is no longer the defining product for Microsoft that it once was.

That's not to say the PC is dead, of course: I'm typing on one now, and it will remain the primary device I use to do my job for the foreseeable future. Many office and knowledge workers will feel the same. But there are now plenty of other options: I could be using a tablet or dictating to my phone... And outside of work I barely touch a PC at all.

And even the definition of the PCs is getting blurry. PC makers have come up with a late burst of creativity that has delivered all manner of weird and occasionally wonderful new shapes and sizes. Microsoft's Surface is a PC that looks a lot like a tablet; Lenovo's X1 Fold is a folding screen that can be a tablet, or a mini laptop or a desktop. Folding and detachable PCs are now mainstream.