pacopico writes: GitHub's CEO Nat Friedman traveled to Svalbard in October to stash Linux, Android, and 6,000 other open-source projects in a permafrost-filled, abandoned coal mine. It's part of a project to safeguard the world's software from existential threats and also just to archive the code for posterity. As Friedman says, "If you told someone 20 years ago that in 2020, all of human civilization will depend on and run on open-source code written for free by volunteers in countries all around the world who don't know each other, and it'll just be downloaded and put into almost every product, I think people would say, 'That's crazy, that's never going to happen. Software is written by big, professional companies.' It's sort of a magical moment. Having a historical record of this will, I think, be valuable to future generations." GitHub plans to open several more vaults in other places around the world and to store any code that people want included.

As of Tuesday afternoon, YouTube is requiring creators to label any videos of theirs that may appeal to children. If they say a video is directed at kids, data collection will be blocked for all viewers, resulting in lower ad revenue and the loss of some of the platform's most popular features, including comments and end screens. It's a major change in how YouTube works, and has left some creators clueless as to whether they're subject to the new rules. The Verge reports: Reached by The Verge, Google confirmed that this new system was the result of a landmark $170 million settlement YouTube reached with the Federal Trade Commission in September for allegedly violating children's privacy. It's the largest fine ever collected under the Children's Online Privacy Protection Act (COPPA), which forbids collecting data from children under the age of 13 without explicit consent from their parents. In this case, the ruling means YouTube can't employ its powerful ad-targeting system on anyone who might be under the age of 13 -- a dire problem for a platform with so many young users.

The new system is already sending creators reeling over what exactly is considered kids' content and what could happen if they unintentionally mislabel videos. Some of YouTube's most popular categories falls into a gray area for the policy, including gaming videos, family vlogging, and toy reviews. [...] In theory, YouTube has always been subject to COPPA, but those restrictions have taken on new urgency in the wake of the recent settlement with the FTC. Under the terms of the settlement, YouTube is required to "develop, implement, and maintain a system for Channel Owners to designate whether their Content on the YouTube Service is directed to Children." Under the system that YouTube rolled out on Tuesday, creators who strictly make children's content can also have their entire channel designated as directed at children. Once a video is labeled as kids' content, all personalized ads will be shut off, replaced with "contextualized" advertising based on the video itself. In addition to the removal of targeted ads, child-directed YouTube videos will also no longer include a comments section, click-through info cards, end screens, notification functions, and the community tab.

"The consequences for not labeling a video as 'child-directed' could be even more severe," reports The Verge. "In its September order, the FTC made it clear that it could sue individual channel owners who abuse this new labeling system. Crucially, those lawsuits will fall entirely on channel owners, rather than on YouTube itself. Under the settlement, YouTube's responsibility is simply to maintain the system and provide ongoing data updates."

An anonymous reader quotes a report from Ars Technica: Google has a long and well-documented history of launching new services only to shut them down a few months or years later. And with the launch of Stadia imminent, one launch game developer has acknowledged the prevalence of concerns about that history among her fellow developers while also downplaying their seriousness in light of Stadia's potential. "The biggest complaint most developers have with Stadia is the fear that Google is just going to cancel it," Gwen Frey, developer of Stadia launch puzzle game Kine, told GamesIndustry.biz in recently published comments. "Nobody ever says, 'Oh, it's not going to work,' or 'Streaming isn't the future.' Everyone accepts that streaming is pretty much inevitable. The biggest concern with Stadia is that it might not exist."

While concerns about Stadia working correctly aren't quite as nonexistent as Frey said, early tests show the service works well enough in ideal circumstances. As for the service's continued existence, Frey thinks such concerns among other developers are "kind of silly." "Working in tech, you have to be willing to make bold moves and try things that could fail," Frey continued. "And yeah, Google's canceled a lot of projects. But I also have a Pixel in my pocket, I'm using Google Maps to get around. I only got here because my Google Calendar told me to get here by giving me a prompt in Gmail. It's not like Google cancels every fucking thing they make." "Nothing in life is certain, but we're committed to making Stadia a success," said Stadia Director of Product Andrew Doronichev in July. "Of course, it's OK to doubt my words. There's nothing I can say now to make you believe if you don't. But what we can do is to launch the service and continue investing in it for years to come."

Facebook's latest transparency report is out. The social media giant said the number of government demands for user data increased by 16% to 128,617 demands during the first-half of this year compared to the second-half of last year. From a report: That's the highest number of government demands its received in any reporting period since it published its first transparency report in 2013. The U.S. government led the way with the most number of requests -- 50,741 demands for user data resulting in some account or user data given to authorities in 88% of cases. Facebook said two-thirds of all of the U.S. government's requests came with a gag order, preventing the company from telling the user about the request for their data. But Facebook said it was able to release details of 11 so-called national security letters (NSLs) for the first time after their gag provisions were lifted during the period. National security letters can compel companies to turn over non-content data at the request of the FBI. These letters are not approved by a judge, and often come with a gag order preventing their disclosure. But since the Freedom Act passed in 2015, companies have been allowed to request the lifting of those gag orders.

Popular health websites are sharing private, personal medical data with big tech companies, according to an investigation by the Financial Times. From a report: The data, including medical diagnoses, symptoms, prescriptions, and menstrual and fertility information, are being sold to companies like Google, Amazon, Facebook, and Oracle and smaller data brokers and advertising technology firms, like Scorecard and OpenX. The FT analyzed 100 health websites, including WebMD, Healthline, health insurance group Bupa, and parenting site Babycentre, and found that 79% of them dropped cookies on visitors, allowing them to be tracked by third-party companies around the internet. This was done without consent, making the practice illegal under European Union regulations. By far the most common destination for the data was Google's advertising arm DoubleClick, which showed up in 78% of the sites the FT tested.

In a rare interview, Boston Dynamics CEO Marc Raibert talked about the three robots the company is currently focused on (today -- Spot, tomorrow -- Handle, and the future -- Atlas), its current customers, potential applications, AI, simulation, and of course those viral videos. An excerpt from the interview: "Today," for Raibert, refers to a time period that extends over the course of the next year or so. Spot is the "today" robot because it's already shipping to early adopters. In fact, it's only been shipping for about six weeks. Boston Dynamics wants Spot to be a platform -- Raibert has many times referred to it as "the Android of robots." Spot, which weighs about 60 pounds, "is not an end-use application robot," said Raibert. Users can add hardware payloads, and they can add software that interacts with Spot through its API. In fact, Raibert's main purpose in attending Web Summit was to inspire attendees to develop hardware and software for Spot. Boston Dynamics has an arm, spectrum radio, cameras, and lidars for Spot, but other companies are developing their own sensors. The "Spot" we're talking about is technically the SpotMini. It was renamed when it succeeded its older, bigger brother Spot. "The legacy Spot was a research project. We're really not doing anything with it at the moment. We just call it 'Spot' now; it's the product."

Spot can go up and down stairs by using obstacle detection cameras to see railings and steps. It also has an autonomous navigation system that lets it traverse a terrain. While Spot can be steered by a human, the computers onboard regulate the legs and balance. Spot travels at about 3 miles per hour, which is about human walking speed. It has cameras on its front, back, and sides that help it navigate, travel autonomously, and move omnidirectionally. It has different gaits (slow, walking, running, and even show-off), can turn in place, and has a "chicken head" mode. That last one means it can decouple the motion of its hand from its body, similar to how many animals can stabilize one part while the rest of the body moves.

An anonymous reader writes: A team of academics has disclosed today two vulnerabilities known collectively as TPM-FAIL that could allow an attacker to retrieve cryptographic keys stored inside TPMs. The first vulnerability is CVE-2019-11090 and impacts Intel's Platform Trust Technology (PTT). Intel PTT is Intel's fTPM software-based TPM solution and is widely used on servers, desktops, and laptops, being supported on all Intel CPUs released since 2013, starting with the Haswell generation. The second is CVE-2019-16863 and impacts the ST33 TPM chip made by STMicroelectronics. This chip is incredibly popular and is used on a wide array of devices ranging from networking equipment to cloud servers, being one of the few chips that received a CommonCriteria (CC) EAL 4+ classification — which implies it comes with built-in protection against side-channel attacks like the ones discovered by the research team. Unlike most TPM attacks, these ones were deemed practical. A local adversary can recover the ECDSA key from Intel fTPM in 4-20 minutes depending on the access level. We even show that these attacks can be performed remotely on fast networks, by recovering the authentication key of a virtual private network (VPN) server in 5 hours.

Google will soon offer checking accounts to consumers, becoming the latest Silicon Valley heavyweight to push into finance. The Wall Street Journal: The project, code-named Cache, is expected to launch next year with accounts run by Citigroup and a credit union at Stanford University, a tiny lender in Google's backyard. Big tech companies see financial services as a way to get closer to users and glean valuable data. Apple introduced a credit card this summer. Amazon.com has talked to banks about offering checking accounts. Facebook is working on a digital currency it hopes will upend global payments. Their ambitions could challenge incumbent financial-services firms, which fear losing their primacy and customers. They are also likely to stoke a reaction in Washington, where regulators are already investigating whether large technology companies have too much clout.

The tie-ups between banking and technology have sometimes been fraught. Apple irked its credit-card partner, Goldman Sachs Group, by running ads that said the card was "designed by Apple, not a bank." Major financial companies dropped out of Facebook's crypto project after a regulatory backlash. Google's approach seems designed to make allies, rather than enemies, in both camps. The financial institutions' brands, not Google's, will be front-and-center on the accounts, an executive told The Wall Street Journal. And Google will leave the financial plumbing and compliance to the banks -- activities it couldn't do without a license anyway.

An anonymous reader quotes a report from TechCrunch: A Dutch court has ruled that Facebook can be required to use filter technologies to identify and preemptively take down fake ads linked to crypto currency scams that carry the image of a media personality, John de Mol, and other well known celebrities. The Dutch celerity filed a lawsuit against Facebook in April over the misappropriation of his and other celebrities' likeness to shill Bitcoin scams via fake ads run on its platform.

In an immediately enforceable preliminary judgement today the court has ordered Facebook to remove all offending ads within five days, and provide data on the accounts running them within a week. Per the judgement, victims of the crypto scams had reported a total of ~$1.8M in damages to the Dutch government at the time of the court summons. It's not yet clear whether the company will appeal but in the wake of the ruling Facebook has said it will bring the scam ads report button to the Dutch market early next month.

Dell is planning to offer business clients a subscription model for products like servers and personal computers, "seeking to counter the lure of cloud services from Amazon and Microsoft," reports Bloomberg. From the report: Dell and its hardware peers have been under pressure to offer corporate clients the flexibility and simplicity of infrastructure cloud services. Public cloud titans such as Amazon Web Services and Microsoft Azure have cut demand for data-center hardware as more businesses look to rent computing power rather than invest in their own server farms. Rival Hewlett Packard Enterprise said in June that it would move to a subscription model by 2022. Research firm Gartner predicts 15% of data-center hardware deals will include pay-per-use pricing in 2022, up from 1% in 2019, Dell said.

Dell is making it easier for clients to upgrade their hardware since they don't have to spend a large amount of capital expenditures upfront, but can pay a smaller amount each month that counts toward a company's operating expenditures. For the consumption programs, customers pay for the amount of storage or computing power they use. Companies can also hire Dell to completely manage their hardware infrastructure for them. While Dell's overall sales climbed 2% in the quarter that ended Aug. 2, demand for its servers and networking gear dropped 12% in a reversal from last year, when there was unprecedented customer interest in the products. Dell still expects the vast majority of customers to pay upfront for products in the next three to five years, Grocott said.

Now that we have arrived in Blade Runner's November 2019 "future," the BBC asks what the 37-year-old film got right. Slashdot reader dryriver shares the report: [B]eyond particular components, Blade Runner arguably gets something much more fundamental right, which is the world's socio-political outlook in 2019 -- and that isn't particularly welcome, according to Michi Trota, who is a media critic and the non-fiction editor of the science-fiction periodical, Uncanny Magazine. "It's disappointing, to say the least, that what Blade Runner "predicted" accurately is a dystopian landscape shaped by corporate influence and interests, mass industrialization's detrimental effect on the environment, the police state, and the whims of the rich and powerful resulting in chaos and violence, suffered by the socially marginalized."

[...] As for the devastating effects of pollution and climate change evident in Blade Runner, as well as its 2017 sequel Blade Runner 2049, "the environmental collapse the film so vividly depicts is not too far off from where we are today," says science-fiction writer and software developer Matthew Kressel, pointing to the infamous 2013 picture of the Beijing smog that looks like a cut frame from the film. "And we're currently undergoing the greatest mass extinction since the dinosaurs died out 65 million years ago. In addition, the film's depiction of haves and have-nots, those who are able to live comfortable lives, while the rest live in squalor, is remarkably parallel to the immense disparity in wealth between the world's richest and poorest today. In that sense, the film is quite accurate." [...] And it can also provide a warning for us to mend our ways. Nobody, surely, would want to live in the November 2019 depicted by Blade Runner, would they? Don't be too sure, says Kressel.

"In a way, Blade Runner can be thought of as the ultimate cautionary tale," he says. "Has there ever been a vision so totally bleak, one that shows how environmental degradation, dehumanization and personal estrangement are so harmful to the future of the world? "And yet, if anything, Blade Runner just shows the failure of the premise that cautionary tales actually work. Instead, we have fetishized Blade Runner's dystopian vision. Look at most art depicting the future across literature, film, visual art, and in almost all of them you will find echoes of Blade Runner's bleak dystopia. "Blade Runner made dystopias 'cool,' and so here we are, careening toward environmental collapse one burned hectare of rainforest at a time. If anything, I think we should be looking at why we failed to heed its warning."

An anonymous reader quotes a report from Phys.Org: Adding energy to any material, such as by heating it, almost always makes its structure less orderly. Ice, for example, with its crystalline structure, melts to become liquid water, with no order at all. But in new experiments by physicists at MIT and elsewhere, the opposite happens: When a pattern called a charge density wave in a certain material is hit with a fast laser pulse, a whole new charge density wave is created -- a highly ordered state, instead of the expected disorder. The surprising finding could help to reveal unseen properties in materials of all kinds.

The experiments made use of a material called lanthanum tritelluride, which naturally forms itself into a layered structure. In this material, a wavelike pattern of electrons in high- and low-density regions forms spontaneously but is confined to a single direction within the material. But when hit with an ultrafast burst of laser light -- less than a picosecond long, or under one trillionth of a second -- that pattern, called a charge density wave or CDW, is obliterated, and a new CDW, at right angles to the original, pops into existence. This new, perpendicular CDW is something that has never been observed before in this material. It exists for only a flash, disappearing within a few more picoseconds. As it disappears, the original one comes back into view, suggesting that its presence had been somehow suppressed by the new one. The study has been published in the journal Nature Physics.

UCLA's new mobile surgical lab is a zero-emission, all-electric vehicle that will move back and forth between two UCLA campuses, collecting, sterilizing and repairing surgical instruments for the medical staff there. TechCrunch reports: Why is that even needed? The usual process is sending out surgical instruments for this kind of service by a third-party, and it's handled in a dedicated facility at a significant annual cost. UCLA Health Center estimates that it can save as much as $750,000 per year using the EV lab from Winnebago instead. The traveling lab can operate for around eight hours, including round-trips between the two hospital campuses, or for a total distance traveled of between 85 and 125 miles on a single charge of its battery, depending on usage. It also offers "the same level of performance, productivity and compliance" as a lab in a fixed-location building, according to Winnebago.

An anonymous reader quotes a report from Motherboard: In early September, the crowdfunding platform Kickstarter fired two union organizers in 8 days. One of them was Clarissa Redwine, who considered her termination to be a blatant act of retaliation for organizing what could become the first union at a major tech company in the United States. Although Redwine lost her job, she has not given up her vision. Today, she launched "Solidarity Onboarding," a new project designed to help workers unionize the tech industry -- using her former employer's platform. A collaboration between current and former organizers at WeWork, Google, Facebook, and other tech companies and coalitions, the project consists of an onboarding kit (booklet, pin, pencil, sticker) for tech workers interested in unionizing. "This kit is passed between coworkers as an act of solidarity and a signal that there is room to organize at your company," the project states.

"Imagine the mirror image of a company's onboarding kit but for the tech labor movement," Redwine told Motherboard. "The focal point of this onboarding kit is a booklet of anti-worker statements. It's a collection of common talking point companies use to dissuade employees from taking collective action. Think of it as a union-busting artifact passed across companies from worker to worker." Within four hours of the project's launch, Redwine raised over 3 times her goal of $1000. The kit's booklet includes a collection of real anti-union quotes from tech CEOs -- including one from an email Kickstarter CEO Aziz Hasan sent to his employees in September, in response to the firings of Redwine and another union organizer: "The union framework is inherently adversarial. That dynamic doesn't reflect who we are as a company, how we interact, how we make decisions, or where we need to go." Another page includes a statement from an Amazon anti-union training video: "Our business model is built upon speed, innovation, and customer obsession -- things that are generally not associated with a union. When we lose sight of those critical focus areas we jeopardize everyone's job security: yours, mine, and the associates." "Clarissa's creative project is, of course, welcome on our platform," a spokesperson for Kickstarter said. "Kickstarter is a place where creators can share their ideas with the world and find people who want to support those ideas. We also welcome the continued dialogue among our staff members about the idea of a union at Kickstarter. We unequivocally support our staff's right to decide the unionization question for themselves."

sbinning shares a report from AppleInsider: IBM has published its latest study focusing on the benefits of Apple products in enterprise, and has found that a fleet of over 200,000 Macs leads to far lower support costs, smaller numbers of support staff, and happier employees versus a Windows deployment. In the study presented on Tuesday, IBM says that employees that used Mac machines were 22 percent more likely to exceed expectations in performance reviews compared to Windows users. Mac-using employees generating sales deals have 16% larger proceeds as well.

Turning to employee satisfaction, the first-of-its-kind study shows that Mac users were 17 percent less likely to leave IBM compared to their Windows counterparts. Mac users also were happier with the software available, with 5 percent asking for additional software compared to 11 percent of Windows users. A team of seven engineers is needed to maintain 200,000 Macs whereas a team of 20 is needed for that number of Windows PCs. During setup, the migration process was simple for 98 percent of Mac users versus only 86 percent of those moving from Windows 7 to Windows 10. Windows users were also five times as likely to need on-site support.

Tesla's European gigafactory will be built in the Berlin area, Elon Musk said Tuesday during an awards ceremony in Germany. TechCrunch reports: Musk was onstage to receive a Golden Steering Wheel Award given by BILD. "There's not enough time tonight to tell all the details," Musk said during an onstage interview with Volkswagen Group CEO Herbert Diess. "But it's in the Berlin area, and it's near the new airport." Tesla is also going to create an engineering and design center in Berlin because "I think Berlin has some of the best art in the world," Musk said.

Diess thanked Musk while onstage for "pushing us" toward electrification. Diess later said that Musk and Telsa are demonstrating that moving toward electrification works. "I don't think Germany is that far behind," Musk said when asked about why German automakers were behind in electric vehicles. He later added that some of the best cars in the world are made in Germany. "Everyone knows that German engineering is outstanding and that's part of the reason we're locating our Gigafactory Europe in Germany," Musk said. On Twitter, Musk said the Berlin-based gigafactory "Will build batteries, powertrains & vehicles, starting with Model Y."

An anonymous reader quotes a report from The New York Times: Last May, when Intel released a patch for a group of security vulnerabilities researchers had found in the company's computer processors, Intel implied that all the problems were solved. But that wasn't entirely true, according to Dutch researchers at Vrije Universiteit Amsterdam who discovered the vulnerabilities and first reported them to the tech giant in September 2018. The software patch meant to fix the processor problem addressed only some of the issues the researchers had found. It would be another six months before a second patch, publicly disclosed by the company on Tuesday, would fix all of the vulnerabilities Intel indicated were fixed in May, the researchers said in a recent interview.

The public message from Intel was "everything is fixed," said Cristiano Giuffrida, a professor of computer science at Vrije Universiteit Amsterdam and one of the researchers who reported the vulnerabilities. "And we knew that was not accurate." While many researchers give companies time to fix problems before the researchers disclose them publicly, the tech firms can be slow to patch the flaws and attempt to muzzle researchers who want to inform the public about the security issues. Researchers often agree to disclose vulnerabilities privately to tech companies and stay quiet about them until the company can release a patch. Typically, the researchers and companies coordinate on a public announcement of the fix. But the Dutch researchers say Intel has been abusing the process. Now the Dutch researchers claim Intel is doing the same thing again. They said the new patch issued on Tuesday still doesn't fix another flaw they provided Intel in May. The Intel flaws, like other high-profile vulnerabilities the computer security community has recently discovered in computer chips, allowed an attacker to extract passwords, encryption keys and other sensitive data from processors in desktop computers, laptops and cloud-computing servers. Intel says the patches "greatly reduce" the risk of attack, but don't completely fix everything the researchers submitted.

The company's spokeswoman Leigh Rosenwald said Intel was publishing a timeline with Tuesday's patch for the sake of transparency. "This is not something that is normal practice of ours, but we realized this is a complicated issue. We definitely want to be transparent about that," she said. "While we may not agree with some of the assertions made by the researchers, those disagreements aside, we value our relationship with them."

Microsoft today started rolling out the free Windows 10 November 2019 Update. For those keeping track, this update is Windows 10 build 18363 and will bring Windows 10 to version 1909. From a report: The Windows 10 November 2019 Update (version 1909) is odd because it shares the same Cumulative Update packages as the Windows 10 May 2019 Update (version 1903). That means version 1909 will be delivered more quickly to version 1903 users -- it will install like a monthly security update. The build number will barely change: from build 18362 to build 18363. If two computers have the same servicing content, the build revision number should match: 18362.xxx and 18363.xxx. For developers, this means a new Windows SDK will not be issued in conjunction with this version of Windows (there aren't any new APIs).

Again, the Windows 10 November 2019 Update is not a typical release. It's a much smaller update, though it is still worth getting. Windows 10 version 1909 brings improvements to Windows containers, inking latency, and password recovery. User-facing features include letting third-party digital assistants to voice activate above the Lock screen, being able to create events straight from the Calendar flyout on the Taskbar, and displaying OneDrive content in the File Explorer search box. You may also notice some changes to notification management, better performance and reliability on certain CPUs, and battery life and power efficiency improvements.

Facebook said on Tuesday it was launching Facebook Pay, a unified payment service through which users across its platforms including WhatsApp and Instagram can make payments without exiting the app. From a report: The social network said the service would allow users to send money or make a payment with security options such as PIN or biometrics on their smartphones. Chief Executive Officer Mark Zuckerberg said earlier this year the company is planning to unify the messaging infrastructure across its platforms. He said the company would encrypt conversations on more of its messaging services and make them compatible as direct messaging was likely to dwarf discussion on the traditional, open platform of Facebook's news feed in a few years. Facebook said the new service will collect user information such as payment method, date, billing and contact details when a transaction is made and that it would use the data to show targeted advertisements to users.

It's not yet prime time for 5G networks, which still face logistical and technical hurdles, but they're increasingly coming online in major cities worldwide. Which is why it's especially worrying that new 5G vulnerabilities are being discovered almost by the dozen. From a report: At the Association for Computing Machinery's Conference on Computer and Communications Security in London today researchers are presenting new findings that the 5G specification still has vulnerabilities. And with 5G increasingly becoming a reality, time is running out to catch these flaws. The researchers from Purdue University and the University of Iowa are detailing 11 new design issues in 5G protocols that could expose your location, downgrade your service to old mobile data networks, run up your wireless bills, or even track when you make calls, text, or browse the web. They also found five additional 5G vulnerabilities that carried over from 3G and 4G. They identified all of those flaws with a new custom tool called 5GReasoner.

One purported benefit of 5G is that it protects phone identifiers, like your device's "international mobile subscriber identity," to help prevent tracking or targeted attacks. But downgrade attacks like the ones the researchers found can bump your device down to 4G, or put it into limited service mode, then force it to send its IMSI number unencrypted. Increasingly, networks use an alternative ID called a Temporary Mobile Subscriber Identity that refreshes periodically to stymie tracking. But the researchers also found flaws that could allow them to override TMSI resets, or correlate a device's old and new TMSI, to track devices. Mounting those attacks takes only software-defined radios that cost a few hundred dollars. The 5GReasoner tool also found issues with the part of the 5G standard that governs things like initial device registration, deregistration, and paging, which notifies your phone about incoming calls and texts. Depending on how a carrier implements the standard, attackers could mount "replay" attacks to run up a target's mobile bill by repeatedly sending the same message or command. It's an instance of vague wording in the 5G standard that could cause carriers to implement it weakly.