An anonymous reader shares a report: elementary OS has long been viewed by many as the future of Linux on the PC thanks to its beautiful desktop environment and overall polished experience. Development of the Ubuntu-based operating system has been frustratingly slow, however. This shouldn't be surprising, really, as the team of developers is rather small, and its resources are likely much less than those of larger distributions such as the IBM-backed Fedora or Canonical's Ubuntu. And that is what makes elementary OS so remarkable -- its developers can make magic on a smaller budget. Today, the latest version of the operating system is released. Code-named "Hera," elementary OS 5.1 is now available for download. Support for Flatpak is now baked in -- this is significant, as the developers explain it is "the first non-deb packaging format we've supported out of the box." The Linux kernel now sits at a very modern 5.0. One of the most important aspects of elementary OS, the AppCenter, is now an insane 10 times faster than its predecessor.

Mozilla today released Firefox 71 for Windows, Mac, Linux, Android, and iOS. Firefox 71 includes Lockwise password manager improvements, Enhanced Tracking Protection tweaks, and Picture-in-Picture video on Windows.

Do you feel you have been receiving more spam calls of late? You are probably not wrong -- or alone. From a report: The volume of spam calls has grown by 18% globally this year, according to Truecaller. In its annual report published Tuesday, the Stockholm-based firm said users worldwide received 26 billion spam calls between January and October this year -- up from 17.7 billion during the same period last year. The United States remains the eighth most spammed country, where the volume of robocalls increased by 35% this year. In a separate report earlier this year, Truecaller estimated that 43 million Americans were scammed last year and lost about $10.5 billion. The growth is despite the efforts local carriers and authorities have made in the country. Brazil again topped the list for the most spammed country. The culprit behind the increasingly growing spam calls in the country are its own telecom operators and internet service providers. Truecaller said that in the last 12 months, calls from the operators have increased from 32% to 48%.

[...] One of the takeaways from the report is just how complex it is to understand the nature of these spam calls. There is no common thread -- or culprit -- behind these calls. In some markets, such as South Africa (ranked sixth in the report), spammers are mostly making fraudulent tech support calls and conducting job offer scams. Peru, ranked second, and Indonesia, ranked third, have seen spam calls explode in the nation. In Peru, users received more than 30 spam calls in the month. Most of these calls were made by financial services that are looking to upsell credit cards and loans.

The Department of Homeland Security wants to expand facial recognition scans in the airport to also include citizens, which had previously been exempt from the mandatory checks. TechCrunch reports: In a filing, the department has proposed that all travelers, and not just foreign nationals or visitors, will have to complete a facial recognition check before they are allowed to enter the U.S., but also to leave the country. Facial recognition for departing flights has increased in recent years as part of Homeland Security's efforts to catch visitors and travelers who overstay their visas. The department, whose responsibility is to protect the border and control immigration, has a deadline of 2021 to roll out facial recognition scanners to the largest 20 airports in the United States, despite facing a rash of technical challenges.

But although there may not always be a clear way to opt-out of facial recognition at the airport, U.S. citizens and lawful permanent residents -- also known as green card holders -- have been exempt from these checks, the existing rules say. Now, the proposed rule change to include citizens has drawn ire from one of the largest civil liberties groups in the country. "Time and again, the government told the public and members of Congress that U.S. citizens would not be required to submit to this intrusive surveillance technology as a condition of traveling," said Jay Stanley, a senior policy analyst at the American Civil Liberties Union. "This new notice suggests that the government is reneging on what was already an insufficient promise," he said. "Travelers, including U.S. citizens, should not have to submit to invasive biometric scans simply as a condition of exercising their constitutional right to travel. The government's insistence on hurtling forward with a large-scale deployment of this powerful surveillance technology raises profound privacy concerns," he said.

Under Project Verona, Microsoft is working to make Windows 10 more secure by integrating Mozilla-developed Rust for low-level Windows components. "'Memory safety' is the term for coding frameworks that help protect memory space from being abused by malware," reports ZDNet. "Project Verona at Microsoft is meant to progress the company's work here to close off this attack vector." From the report: Microsoft's Project Verona could turn out to be just an experiment that leads nowhere, but the company has progressed far enough to have detailed some of its ideas through the UK-based non-profit Knowledge Transfer Network. Matthew Parkinson, a Microsoft researcher from the Cambridge Computer Lab in the UK who's dedicated to "investigating memory management for managed programming languages," gave a talk last week focusing on what the company is doing to address these memory issues.

In the talk, Parkinson discussed the work Microsoft has done with MemGC, which is short for Memory Garbage Collector, for Internet Explorer (IE) and Edge. MemGC addressed vulnerabilities in the standard browser feature known as a Document Object Model (DOM), a representation of the data used by browsers to interpret web pages. Google's elite Project Zero hackers were impressed with Microsoft's MemGC after canvassing major browsers. [...] The other class of bugs Microsoft is working on to address relates to uninitialized memory in a way that also doesn't kill performance. [...] Parkinson said Microsoft is rewriting some "targeted" components in Rust. His talk focused on language design and compartmentalization. "If we want compartments, and to carve up the legacy bits of our code so [attackers'] exploit code can't get out, what do we need in the language design that can help with that?" This is Project Verona and Parkinson said it was the first time he'd discussed the project, which will be made open source "soon". It is a new language for what Microsoft is calling "safe infrastructure programming." "The challenge for Microsoft is dealing with the 'application spectrum,' which spans from C# for desktop apps through to C and C# for Exchange, ASP.NET, Azure, and device drivers, to deep Windows components like memory management and boot loaders and the Windows kernel hardware abstraction layer (HAL)," the report says.

"The ownership model in Verona is based on groups of objects, not like in Rust where it's based on a single object," said Parkinson. "In C++ you get pointers and it's based on objects and it's pretty much per object. But that isn't how I think about data and grammar. I think about a data structure as a collection of objects. And that collection of objects as a lifetime. So by taking ownership at the level of ownership of objects, then we get much closer to the level of abstraction that people are using and it gives us the ability to build data structures without going outside of safety."

An anonymous reader quotes a report from Ars Technica: A vulnerability in millions of fully patched Android phones is being actively exploited by malware that's designed to drain the bank accounts of infected users, researchers said on Monday. The vulnerability allows malicious apps to masquerade as legitimate apps that targets have already installed and come to trust, researchers from security firm Promon reported in a post. Running under the guise of trusted apps already installed, the malicious apps can then request permissions to carry out sensitive tasks, such as recording audio or video, taking photos, reading text messages or phishing login credentials. Targets who click yes to the request are then compromised.

Researchers with Lookout, a mobile security provider and a Promon partner, reported last week that they found 36 apps exploiting the spoofing vulnerability. The malicious apps included variants of the BankBot banking trojan. BankBot has been active since 2017, and apps from the malware family have been caught repeatedly infiltrating the Google Play Market. The vulnerability is most serious in versions 6 through 10, which account for about 80% of Android phones worldwide. Attacks against those versions allow malicious apps to ask for permissions while posing as legitimate apps. There's no limit to the permissions these malicious apps can seek. Access to text messages, photos, the microphone, camera, and GPS are some of the permissions that are possible. A user's only defense is to click "no" to the requests. "The vulnerability is found in a function known as TaskAffinity, a multitasking feature that allows apps to assume the identity of other apps or tasks running in the multitasking environment," reports Ars Technica. While Google has removed the [unnamed] malicious apps from its Play Store, according to Promon, the vulnerability is still unfixed in all versions of Android.

"Promon is calling the vulnerability 'StrandHogg,' an old Norse term for the Viking tactic of raiding coastal areas to plunder and hold people for ransom," the report adds. "Promon researchers said they identified StrandHogg after learning from an unnamed Eastern European security company for financial institutions that several banks in the Czech Republic reported money disappearing from customer accounts."

Russian President Vladimir Putin on Monday signed legislation requiring all smartphones, computers and smart TV sets sold in the country to come pre-installed with Russian software. Reuters reports: The law, which will come into force on July 1 next year, has been met with resistance by some electronics retailers, who say the legislation was adopted without consulting them. The law has been presented as a way to help Russian IT firms compete with foreign companies and spare consumers from having to download software upon purchasing a new device. The country's mobile phone market is dominated by foreign companies including Apple, Samsung and Huawei. The legislation signed by Putin said the government would come up with a list of Russian applications that would need to be installed on the different devices.

European officials have launched a "preliminary" investigation into Facebook and Google in order to determine how people's information is used for ad purposes. The Mercury News reports: The European Commission, which oversees antitrust issues for the European Unions, said it has opened a preliminary investigation into Facebook and Google in order to determine if the two companies are adhering to new regulations meant to give individuals more power over how their personal information is used by social networks and other tech companies. That law, called General Data Protection Law (GDPR), went into effect across the European Union in 2018. "The Commission has sent out questionnaires as part of our preliminary investigations into Google's and Facebook's data practices," said an EC spokesperson in a statement given to this news organization. "These investigations concern the way data is gathered processed used and monetized, including for advertising purposes. The preliminary investigations are ongoing." A Google spokesperson said in a statement, "We use data to make our services more useful and to show relevant advertising, and we give people the controls to manage, delete or transfer their data. We will continue to engage with the Commission and others on this important discussion for our industry."

Facebook didn't comment on the matter.

An anonymous reader quotes a report from TechCrunch: The U.S. government may be in the process of formally withdrawing from the term of the Paris Agreement, an international accord on targets to fight climate change, but major U.S. employers say they'll stay the course in a new statement jointly signed by a group of around 80 chief executives and U.S. labor organization leaders. The statement, posted at UnitedForTheParisAgreement.com, represents a group that either directly employs more than 2 million people in the U.S., or represents a larger group of 12.5 million through labor organizations.

The group collectively says they are "still in" on the Agreement, which many of the undersigned also supported vocally back in 2017 when the Trump administration announced its intent to formally remove itself. They also "urge the United States" to reconsider its current course and also agree to remain committed to the agreement. The Agreement will not only help to potentially counter the ongoing impacts of global climate change, the group says in the letter, but also prepare the way for a "just transition" of the U.S. workforce to "new decent, family supporting jobs and economic opportunity," implying that bowing out of the Agreement will actually impede the U.S. workforce's ability to compete on a global scale. Some of the prominent tech executives that have signed the statement include Microsoft's Satya Nadella, Tesla's Elon Musk, Google's Sundar Pichai and Adobe's Shantanu Narayen. "Chief executives from other powerful U.S. companies across industries are also represented, including Coca-Cola's James Quincey, Patagonia's Rose Marcario, Unilever's Alan Jope and Walt Disney's Robert Iger," reports TechCrunch.

Amazon Web Services (AWS) is helping to bring quantum computing to the cloud, with the company lifting the lid off three initiatives at AWS re:Invent in Las Vegas. ZDNet reports: The first is Amazon Braket. Amazon Braket is a new, fully managed AWS service that the company has touted as enabling scientists, researchers, and developers to begin experimenting with computers from quantum hardware providers, such as D-Wave, IonQ, and Rigetti. AWS said the service lets customers explore, evaluate, and experiment with quantum computing hardware to gain in-house experience as they plan for the future. It's a single development environment to build quantum algorithms, test them on simulated quantum computers, and try them on a range of different quantum hardware architectures.

Furthering its quantum mission, the company's new AWS Center for Quantum Computing aims to bring together quantum computing experts from Amazon, the California Institute of Technology (Caltech), and other academic research institutions to work together on the research and development of new quantum computing technologies. The cloud giant hopes the R&D will result in the solving of real-world problems through quantum technologies. The centre, hosted at Caltech, is aiming to provide the opportunity for customers to develop the necessary skills, and identify when quantum is an appropriate solution, as well as learn how they can design algorithms and discover new applications.

Meanwhile the new Amazon Quantum Solutions Lab is a program that connects customers with quantum computing experts from Amazon and its technology and consulting partners. It is expected the lab will help all involved identify practical uses of quantum computing, and accelerating the development of quantum applications. Lab programs will combine hands-on educational workshops with brainstorming sessions to help customers "work backwards" from business challenges, and then go step-by-step through the process of using quantum computers, AWS said.

An anonymous reader quotes a report from MIT Technology Review: Customers in China who buy SIM cards or register new mobile-phone services must have their faces scanned under a new law that came into effect yesterday. China's government says the new rule, which was passed into law back in September, will "protect the legitimate rights and interest of citizens in cyberspace." It can be seen as part of an ongoing push by China's government to make sure that people use services on the internet under their real names, thus helping to reduce fraud and boost cybersecurity. On the other hand, it also looks like part of a drive to make sure every member of the population can be surveilled. The Financial Times reported yesterday that tech companies in China are helping to create influential United Nations standards for the facial recognition technology, which will help shape rules on how facial recognition is used around the world.

harrymcc writes: As the federal government plods along on developing privacy laws, some cities are taking matters into their own hands -- with facial recognition technology at the top of the list. Now, Portland, Oregon, has plans to ban the use of facial recognition for both the government and private businesses in the city, a move that could make Portland's ban the most restrictive in the United States. The proposed ban comes after cities including San Francisco, Oakland, and Berkeley in California, and Somerville in Massachusetts, have already banned the use of facial recognition by their city government agencies, including police departments. But Portland's ban goes a step further by expanding to private businesses -- if it makes it into law and takes effect in spring 2020, as planned. It could be a preview of what to expect across the country. "I think we're going to start to see more and more [private sector bans]," says ACLU of Northern California attorney Matt Cagle, who helped draft the San Francisco legislation that later served as the model for Oakland and Berkeley. "People are really concerned about facial recognition use and the tracking of their innate features by governments and private corporations."

T-Mobile's nationwide 5G network launches on Friday, the company announced Monday morning. But don't fall for the marketing hype. From a report: It's still too early to buy a 5G phone, even though T-Mobile is now taking orders for two new ones, including the Samsung Galaxy Note 10+ and OnePlus 7T Pro McLaren. It's still a big step, though. T-Mobile will turn on its 600 Mhz 5G network, which will cover most of the country. That's impressive, since most of the 5G networks you've heard about so far are only available in limited areas in a small number of cities. The trade-off though, is T-Mobile's network is using low-band 5G, which means it's good at providing slightly boosted speeds inside buildings and is available in far more places than what competitors offer. Some of the 5G Ultra Wideband networks you've heard about from AT&T and Verizon provide the opposite. They have super fast speeds, but only work in really small pockets when you're standing near a tower outside.

Security researcher Ivan Rodriguez has proposed a new security standard for iOS apps, which he named Security.plist. From a report: The idea is simple. App makers would create a property list file (plist) named security.plist that they would embed inside the root of their iOS apps. The file would contain all the basic contact details for reporting a security flaw to the app's creator. Security researchers analyzing an app would have an easy way to get in contact with the app's creators. Rodriguez said the idea for Security.plist came from Security.txt, a similar standard for websites, that was proposed in late 2017. Security.txt is currently going through an official standardization process at the Internet Engineering Task Force (IETF), but it has been widely adopted already, and companies like Google, GitHub, LinkedIn, and Facebook, all have a security.txt file hosted on their sites, so bug hunters can get in touch with their respective security teams. Rodriguez, who is an amateur bug hunter in iOS apps, said he decided to propose a similar thing for iOS apps because getting in touch with an app's dev or security team has been a problem in the past. "I spend most of my free time poking mobile applications which has lead me to find many vulnerabilities and I have yet to find one that has an easy way to find the correct channel to responsibly disclose these issues,"Rodriguez told ZDNet.

Amazon's next big step in health care is with voice transcription technology that's designed to allow doctors to spend more time with patients and less time at the computer. At Amazon Web Services' re:Invent conference on Tuesday, the company is launching a service called Amazon Transcribe Medical, which transcribes doctor-patient interactions and plugs the text straight into the medical record. From a report: "Our overarching goal is to free up the doctor, so they have more attention going to where it should be directed," said Matt Wood, vice president of artificial intelligence at AWS. "And that's to the patient." At last year's re:Invent, AWS introduced a related service called Amazon Comprehend Medical, which "allows developers to process unstructured medical text and identify information such as patient diagnosis, treatments, dosages, symptoms and signs, and more," according to a blog post. Wood said the two services are linked and can be used together. Voice-to-text transcription is one of the many areas where Amazon is battling with cloud rivals Microsoft and Google. All three companies operate speech assistants that can in real time translate spoken words and sentences and offer text translation. Businesses can use the technology in a variety of ways to weave into their applications.

[...] A big challenge for Amazon, a huge consumer company with tons of customer data, is ensuring that its health-care tools are compliant with privacy rules and regulations under the Health Insurance Portability and Accountability Act and when it comes to transcription, maintaining an extremely high level of accuracy to avoid problematic outcomes or potential liability. Imagine, for instance, if the machine learning system inputs the term "hyper" instead of "hypo," or if doctors noticed so many inaccuracies that they ended up doing the work manually anyway. Wood said the service is HIPAA compliant. He said it took a lot of work for the technology to correctly annotate the "domain specific language and abbreviations" that are common in the medical field, and added that the accuracy is very high. Amazon hasn't published research showing how its accuracy compares with other offerings, but Wood said the company hasn't ruled it out.

The way Google is indexing JavaScript content is "still a massive issue," reports Search Engine Journal: As much as 60% of the JavaScript content is indexed within the first 24 hours after indexing HTML. But there is also bad news. As much as 32% of the tested pages have unindexed JavaScript content after one month, due to a variety of reasons...

Indexing delays can cause Google to take a lot more time in discovering newly added pages on your news website... If it takes ages for Google to index your JS-dependent product description, your competitors will be taking the top positions for prominent queries....

We also checked a random sample of URLs from popular ecommerce and news websites. On average, JavaScript content is not indexed in Google in 25% of these websites' pages. This is one of the results of the two waves of indexing. The second wave is not guaranteed. Indexing JavaScript can fail due to many reasons, or may not happen at all....

If you are using JavaScript for generating important content, you have to implement it wisely and keep it under control.

An anonymous reader quotes SiliconValley.com: Twitter said Wednesday it is putting the brakes, for now, on a plan to start deleting inactive accounts that was set to begin next month.

Twitter said it would hold back on the plan to clear out accounts that had been inactive for at least six months after hearing from multiple users about whether or not they would be able to access the accounts of deceased family members after the Dec. 11 deadline Twitter had established.

Twitter had already begun informing users that their accounts and usernames were in danger of being deleted if they didn't log in at least once by Dec. 11. However, less than 24 hours after announcing the new policy, Twitter took to Twitter to say it had changed its plans. "We've heard from you on the impact that this would have on the accounts of the deceased," Twitter said. "This was a miss on our part. We will not be removing any inactive accounts until we create a new way for people to memorialize accounts."
Twitter had originally said they were worried that inactive users couldn't agree to the recently-updated terms of service. And they've also said the move would help them "present more accurate, credible information people can trust across Twitter."

This raises some interesting metaphysical questions. Would you want your Twitter accounts to live on forever, even after your death? And should Twitter be allowed to choose a default answer for everyone? Leave your own thoughts in the comments.

Should Twitter delete the accounts of dead people?

"Kali Linux 2019.4 was released last week and with it comes an 'Undercover' mode that can be used to quickly make the Kali desktop look like Windows 10," reports Bleeping Computer: Kali is a Linux distribution created for ethical hacking and penetration testing and is commonly used by researchers and red teamers to perform security tests against an organization. As most people are used to seeing Windows and macOS devices being used, it may look suspicious to see a user running Kali Linux with it's distinctive dragon logo and a Linux environment in an office lobby or other public setting.

With this in mind, in Kali Linux 2019.4 the developers created a new 'Undercover' mode that will make the desktop look similar to Windows 10 in order to draw less suspicion.
The script even hides Kali's dragon logo, explains a post on the Kali blog, so "you can work a bit more incognito. After you are done and in a more private place, run the script again and you switch back to your Kali theme. Like magic...!"

"Thanks to Robert, who leads our penetration testing team, for suggesting a Kali theme that looks like Windows to the casual view..."

Long-time Slashdot reader sosume quotes the Register: Redox OS, written in Rust and currently under development, is only "a few months of work away" from self-hosting, meaning that the Rustc compiler would run on Redox itself, according to its creator Jeremy Soller...

Redox has a POSIX-compliant C library written in Rust, called relibc. It is Linux-compatible both at the syscall API level and at the syscall ABI (Application binary interface) level, subject to the same architecture.
The article notes that the OS's latest release was version 0.5 last March, arguing that it's "best described as experimental..."

"Still, if Rust continues to grow in popularity, its characteristics of safety and unimpeded performance seem ideal for creating a new operating system, so perhaps Redox will become more prominent."

An anonymous reader writes: The New York Times just profiled 15-year-old "businessman" Rowan Winch, who made up to $10,000 a month from his Instagram feed. ("He planned to purchase a Tesla next year, when he's eligible to get his driver's license.") Rowan started by re-selling goods he'd bought online, eventually creating an online storefront that acted as a middleman for third-party retailers, but it was his meme accounts that brought him online fame, and what he really wanted: clout. "Rack up enough while you're young, and doors everywhere begin to open," the Times notes. "College recruiters notice you. Job opportunities and internships come your way. Your social status among peers rises, money flows in. Even fame becomes a possibility, if that's what you're after...."

His Instagram account gave him a feeling of helping others on a daily basis. ("His mother said that when she would try to restrict Rowan's phone use, his followers would send DMs protesting her parenting decisions...") Then in July his account was shut down as part of Instagram's great meme page purge. "A lot of my friends think I've become depressed, and I think that's right," Rowan said. (His mother tells the Times "he's not in a healthy state.")

From the article:

His parents have tried to get him to engage with life offline. They've urged him to get an hourly job at the hot dog shop by their house, just for social connection. "Any extracurricular activity, sports or a physical job, not selling something on the internet," Ms. Winch said.

But he loves the internet. He created a Discord server called The Fallen with over 200 other teenagers whose meme accounts were also deactivated, mostly in two major waves over the last 12 months. He started a podcast. He still posts to his personal Instagram account, with 60,000 followers, and two other meme pages with 120,000 followers and 197,000 followers. But losing [his Instagram account] was like suddenly getting fired from a big job. Rowan's identity was so intertwined with the page, he's still trying to figure out who he is without it.

Lately, he's been thinking he might become a YouTuber...