PC Magazine recently interviewed Janelle Shane, the optics research scientist and AI experimenter who authored the new book "You Look Like a Thing and I Love You: How Artificial Intelligence Works and Why It's Making the World a Weirder Place."

At one point Shane explains why any "black box" AI can be a problem: I think ethics in AI does have to include some recognition that AIs generally don't tell us when they've arrived at their answers via problematic methods. Usually, all we see is the final decision, and some people have been tempted to take the decision as unbiased just because a machine was involved. I think ethical use of AI is going to have to involve examining AI's decisions. If we can't look inside the black box, at least we can run statistics on the AI's decisions and look for systematic problems or weird glitches... There are some researchers already running statistics on some high-profile algorithms, but the people who build these algorithms have the responsibility to do some due diligence on their own work. This is in addition to being more ethical about whether a particular algorithm should be built at all...

[T]here are applications where we want weird, non-human behavior. And then there are applications where we would really rather avoid weirdness. Unfortunately, when you use machine-learning algorithms, where you don't tell them exactly how to solve a particular problem, there can be weird quirks buried in the strategies they choose.
Describing a kind of worst-case scenario, Shane contributed to the New York Times "Op-Eds From the Future" series, channeling a behavioral ecologist in the year 2031 defending "the feral scooters of Central Park" that humanity had been co-existing with for a decade.

But in the interview, she remains skeptical that we'll ever acheive real and fully-autonomous self-driving vehicles: It's much easier to make an AI that follows roads and obeys traffic rules than it is to make an AI that avoids weird glitches. It's exactly that problem -- that there's so much variety in the real world, and so many strange things that happen, that AIs can't have seen it all during training. Humans are relatively good at using their knowledge of the world to adapt to new circumstances, but AIs are much more limited, and tend to be terrible at it.

On the other hand, AIs are much better at driving consistently than humans are. Will there be some point at which AI consistency outweighs the weird glitches, and our insurance companies start incentivizing us to use self-driving cars? Or will the thought of the glitches be too scary? I'm not sure.
Shane trained a neural network on 162,000 Slashdot headlines back in 2017, coming up with alternate reality-style headlines like "Microsoft To Develop Programming Law" and "More Pong Users for Kernel Project." Reached for comment this week, Shane described what may be the greatest danger from AI today. "For the foreseeable future, we don't have to worry about AI being smart enough to have its own thoughts and goals.

"Instead, the danger is that we think that AI is smarter than it is, and put too much trust in its decisions."

"Although the JavaScript library jQuery is no longer as popular as it was, it is still widely used. As a result at least six in ten websites are impacted by jQuery XSS vulnerabilities," reports I Programmer: Even more security issues are introduced by the jQuery libraries used to extend jQuery's capabilities. These findings come from open source security platform, Snyk and are included in "The state of JavaScript frameworks security report 2019". While this report is mainly devoted to a security review of the two leading JavaScript frameworks, Angular and React, it takes a "sneak peek" into the security vulnerabilities in three other frontend JavaScript ecosystem projects - Vue.js, Bootstrap and jQuery.

jQuery was downloaded more than 120 million times in the last 12 months, which is equivalent to the number of downloads for Vue.js (40 million) and Bootstrap (79 million) combined. Snyk reports that four vulnerabilities had been found for Vue.js, all of which have been fixed. Bootstrap contained seven cross-site scripting (XSS) vulnerabilities. Three of these were disclosed in 2019 and there are no security fixes or upgrade paths to avoid them. In the case of jQuery, Snyk tracked six security vulnerabilities affecting jQuery across all of its releases to date. Four are medium severity Cross-Site Scripting vulnerabilities, one is a medium severity Prototype Pollution vulnerability, and the final one is a low severity Denial of Service vulnerability.

The report concludes that unless you are using jQuery 3.4.0 and above then you are using vulnerable jQuery versions.

itwbennett writes: Security researcher Chris Kubecka has identified (and reported to Boeing and the Department of Homeland Security back in August) a number of security vulnerabilities in Boeing's networks, email system, and website. "[T]he company's failure to remedy the security failures she reported demonstrate either an unwillingness or inability to take responsibility for their information security," writes JM Porup for CSO online.

The vulnerabilities include a publicly exposed test developer network, a lack of encryption on the boeing.com website, failure to use DMARC for email security, and, perhaps most notably, an email server infected with malware.

For its part, Boeing says that the vulnerabilities Kubecka reported are "common IT vulnerabilities — the type of cyber-hygiene issues thousands of companies confront every day" and that the company has "no indication of a compromise in any aviation system or product that Boeing produces." What Porup's reporting and Kubecka's research clearly shows, however, is how poor information security practices can become aviation security risks.

An anonymous reader quotes a report from Bloomberg: Singapore's welcome mat to virtual banks is going beyond its own shores. The island nation wants to become a regional hub for technology firms with advanced data expertise, said Ravi Menon, managing director of the Monetary Authority of Singapore. Doing so would improve banking services at home and in other parts of Southeast Asia, he said. "Singapore wants to be a base for these players as they grow in the region," Menon, who has led the financial regulator since 2011, said in a recent interview. "And that means anchoring them here at the early stage of their development, and allowing them access to the domestic banking market.

Singapore's traditional incumbents likeDBS Group Holdings Ltd., Oversea-Chinese Banking Corp. and United Overseas Bank Ltd. already provide digital services through mobile phones and other channels. Still, more can be done by technology firms, according to Menon. "Some of these other players use a range of other data to make very quick assessments and are able to disburse these loans in a very short space of time," Menon said. "Those kinds of things are not met adequately or as easily, or it would require tremendous additional cost or effort on the part of traditional banks." Menon said he expects non-financial firms to work with traditional banks through joint ventures and other combinations. "As with all competition, you will see some consolidation taking place, some creative destruction taking place," Menon said. "What's most important for us as policy makers is to make sure that the consumer benefits." .

The share of cryptocurrency jobs per million has risen 1,457% over the past four years, according to a study by job site Indeed.com. VentureBeat reports: Indeed analyzed millions of job postings on Indeed.com to unpack how Bitcoin, cryptocurrency, and blockchain trends have affected the job market. Searches for Bitcoin, blockchain, and cryptocurrency roles are going down -- yet employer demand has skyrocketed. According to Indeed, in the four-year period between September 2015 and September 2019, the share of these jobs per million grew by 1,457%. In that same time period, the share of searches per million increased by 469%.

In the past year, the share of cryptocurrency job postings per million on Indeed.com has increased by 26%, while the share of searches per million for jobs has decreased by 53%. Bitcoin's volatility seems to correlate with job seeker interest, and the change in Bitcoin price this year might be why job searches have declined. Employers, however, are doubling down on the technology, which uses decentralized ledgers to produce secure and transparent transactions. The report says that if you want a better chance at getting a job in this field you should be a programmer familiar with basic cryptography, P2P networks, and a language like C++, Java, Python, or JavaScript (along with certain soft crypto skills). To stand out, you should learn new blockchain development languages, like Hyperledger, Bitcoin Script, Ethereum's Solidity, the Ripple protocol, or even languages currently in development -- like Rholang.

The top hirers are as follows: Deloitte, IBM, Accenture, Cisco, Collins Aerospace, Ernst & Young, Coinbase, Overstock, Ripple, Verizon, Circle, Kraken, ConsenSys, JP Morgan Chase, and Signature Bank.

Freshly Exhumed shares a report from Securelist: Platinum is one of the most technologically advanced APT actors with a traditional focus on the APAC region. During recent analysis we discovered Platinum using a new backdoor that we call Titanium (named after a password to one of the self-executable archives). Titanium is the final result of a sequence of dropping, downloading and installing stages. The malware hides at every step by mimicking common software (protection related, sound drivers software, DVD video creation tools).

The Titanium APT has a very complicated infiltration scheme. It involves numerous steps and requires good coordination between all of them. In addition, none of the files in the file system can be detected as malicious due to the use of encryption and fileless technologies. One other feature that makes detection harder is the mimicking of well-known software. One of the methods Titanium uses to infect its targets and spread is via a local intranet that has already been compromised with malware. Another is via an SFX archive containing a Windows task installation script. A third is shellcode that gets injected into the winlogon.exe process (it's still unknown how this happens).

Gfycat is threatening to sue Archive Team for archiving the site's old, anonymously-posted images that are marked for deletion. Gfycat's CEO, Dan McEleney, says archiving the memes it hosts is a "denial of service attack" and demands compensation. From a report: The fallout is ongoing on Twitter, with users of the site panicking about their old content and the company asking for (and being refused) private negotiations with Internet Archive, which [Archive Team founder Jason Scott] points out is not the same entity as the legally-threatened Archive Team.

An anonymous reader quotes a report from Ars Technica: In August 2018, an Air Force service member noticed something strange about a body camera being used by security personnel at an Air Force base: Chinese characters on the screen. A subsequent investigation found numerous indications that the camera -- and two dozen others in the same shipment -- had been made in China. Investigators found three telling logos in the camera's firmware: an Air Force Logo, the logo of the Chinese company that made the camera, and the logo of China's ministry of public security. Forensic analysis indicated that all three images had been loaded on the camera at the same time by someone in a Chinese time zone. This suggested that not only was the camera made in China, but the Chinese knew that the body camera would be shipped to an Air Force facility.

How did a Chinese-made digital camera wind up at a US Air Force base? In a criminal complaint unsealed Thursday, federal prosecutors blamed Aventura, a New York-based company that has been fraudulently re-selling Chinese-made gear for more than a decade. On Thursday, six of the company's founders and senior officials were arrested and charged with fraud and other crimes. [...] [S]ince 2006, the feds say, Aventura has been buying Chinese-made cameras, metal detectors, and other products, slapping "Made in America" logos on them, and re-selling them in the United States -- to customers including U.S. government agencies who are legally prohibited from buying such items.

Mozilla is calling on Google and Facebook to stop "microtargeting" political ads. "Political speech is critical to democratic discourse, but against the very real circumstances of organized disinformation and organic misinformation today, microtargeting keeps ideas from being debated in the open, and fiction parades as fact," Ashley Boyd, Mozilla's advocacy vice president, said in a statement. "Online platforms can take the important step toward quelling the manipulation by limiting political ads to a scale where they facilitate a public discourse." The Hill reports: Microtargeting, a method which uses consumer data and demographics to narrowly segment audiences, is used by political campaigns to specialize ads for different voting groups. The practice's critics include Federal Election Commission Chairwoman Ellen Weintraub, who wrote in a Washington Post op-ed that microtargeting makes it "easy to single out susceptible groups and direct political misinformation to them with little accountability, because the public at large never sees the ad." Mozilla's call follows reports that Facebook has considered restricting politicians' access to microtargeting.

Candice Ciresi, GitLab's director of risk and global compliance, has resigned after less than six months on the job, apparently saying that the $2.75 billion startup is "engaging in discriminatory and retaliatory behavior." Business Insider reports: Notably, Ciresi resigned in public: GitLab espouses a culture of transparency, whereby all major product and corporate policy decisions are announced and discussed where anybody can see. She posted her resignation in response to one such discussion -- an active debate over a proposed GitLab policy, in which it would ban the hiring of people who live in China or Russia for any role that would require access to customer data. At the time of writing, Ciresi's post announcing her resignation had been reviewed and then "redacted" by GitLab, citing concerns that it would "further inflame this situation." However, Ciresi's comment went out via email to GitLab users who had subscribed to this particular discussion.

Per a screenshot posted to Reddit, Ciresi wrote: "As I believe GitLab is engaging in discriminatory and retaliatory behavior, I have tendered my resignation." "We did decide to moderate this post for review, as there have already been credible personal and physical threats against GitLab employees in this issue thread," GitLab says, in part, in place of Ciresi's comment. "While this particular post did not contain a personal threat to anyone, we were concerned it would further inflame this situation." GitLab confirmed Ciresi's departure but didn't comment any further.

Google's proposal to create a level playing field for price comparison shopping rivals to stave off fresh fines has not led to more traffic for its competitors, Europe's antitrust chief said this week. From a report: European Competition Commissioner Margrethe Vestager two years ago slapped Google with a $2.65 billion fine for favoring its own price comparison shopping service and told it to stop its anti-competitive business practices. The world's most popular internet search engine subsequently offered to allow competitors to bid for advertising space at the top of a search page, giving them the chance to compete on equal terms.

The proposal does not seem to be doing the trick, Vestager said. "We may see a show of rivals in the shopping box. We may see a pickup when it comes to clicks for merchants. But we still do not see much traffic for viable competitors when it comes to shopping comparison," she told a Web Summit conference. British price comparison service Foundem, whose original complaint triggered the EU case against Google

harrymcc writes: On November 9 2004, a new version of Mozilla's browser called Firefox shipped. It was taking on one of the most daunting monopolies in tech: Microsoft's Internet Explorer, which had more than 90 percent market share. But Firefox was really good, and it became an instant hit, ending Microsoft's dominance of the web. Over at Fast Company, Sean Captain took a look at the browser's original rise, the challenges it faced after Google's Chrome arrived on the scene, and the moves it's currently making to put user privacy first.

All major browsers -- including Chrome, Firefox, Safari, Opera, Microsoft Edge, Vivaldi, Brave -- have plans to support DNS-over-HTTPS (or DoH), a protocol that encrypts DNS traffic and helps improve a user's privacy on the web. From a report: The DoH protocol has been one of the year's hot topics. It's a protocol that, when deployed inside a browser, it allows the browser to hide DNS requests and responses inside regular-looking HTTPS traffic. Doing this makes a user's DNS traffic invisible to third-party network observers, such as ISPs. But while users love DoH and have deemed it a privacy boon, ISPs, networking operators, and cyber-security vendors hate it. A UK ISP called Mozilla an "internet villain" for its plans to roll out DoH, and a Comcast-backed lobby group has been caught preparing a misleading document about DoH that they were planning to present to US lawmakers in the hopes of preventing DoH's broader rollout. However, this may be a little too late. ZDNet has spent the week reaching out to major web browser providers to gauge their future plans regarding DoH, and all vendors plan to ship it, in one form or another.

Facebook employees repeatedly chafed at what they viewed as anti-competitive or unethical practices by the company, internal chats show. But their concerns, voiced in 2012 and 2013, were overruled by senior managers including Chief Executive Officer Mark Zuckerberg, who argued that the survival of the social network was more important. From a report: The messages come from a roughly 7,000-page trove of leaked documents that were part of a years-old lawsuit in San Mateo County, California. The interactions are likely to be scrutinized further as Facebook faces ongoing antitrust investigations. In multiple discussions found in the documents, employees, including some top executives, argued against policies that would cut off competitors' ability to advertise on the platform and access Facebook's audience and user information, which it provided to non-competing companies.

Zuckerberg, in a November 2012 email, justified the decision to not provide services to competitors. Facebook software that helped app developers increase sharing "may be good for the world but it's not good for us unless people also share back to Facebook and that content increases the value of our network," Zuckerberg wrote. The company's ultimate goal should be "to increase sharing back into Facebook," he added. In later messages, Zuckerberg also argued against giving competing companies access to other Facebook services.

Bill Gates has revealed that he thinks everyone would be using Windows Mobile right now if Microsoft hadn't have been caught up in a US Justice Department antitrust investigation. From a report: Speaking at The New York Times' DealBook Conference earlier this week, Gates revealed his thoughts on Microsoft's mobile mistakes. "There's no doubt that the antitrust lawsuit was bad for Microsoft, and we would have been more focused on creating the phone operating system and so instead of using Android today you would be using Windows Mobile," claimed Gates. "If it hadn't been for the antitrust case... we were so close, I was just too distracted. I screwed that up because of the distraction."

Microsoft's messy move from Windows Mobile to Windows Phone allowed Android to thrive, but at the time the company had the biggest opportunity in mobile and gave it away. Gates also revealed that Microsoft also missed the opportunity to launch Windows Mobile on a key Motorola handset. "We were just three months too late on a release Motorola would have used on a phone, so yes it's a winner takes all game," explained Gates. "Now nobody here has ever heard of Windows Mobile, but oh well. That's a few hundred billion here or there."

Boeing engineers were nearly done redesigning software on the grounded 737 Max in June when some pilots hopped into a simulator to test a few things. It didn't go well. From a report: A simulated computer glitch caused it to to dive aggressively in a way that resembled the problem that had caused deadly crashes off Indonesia and in Ethiopia months earlier. That led to an extensive redesign of the plane's flight computers that has dragged on for months and repeatedly pushed back the date of its return to service, according to people briefed on the work. The company -- which initially expressed confidence it could complete its application to recertify the plane with the Federal Aviation Administration within months -- now says it hopes to do that before the end of the year.

Changing the architecture of the jet's twin flight computers, which drive autopilots and critical instruments, has proven far more laborious than patching the system directly involved in 737 Max crashes, said these people, who asked not to be named speaking about the issue. The redesign has also sparked tensions between aviation regulators and the company. As recently as this week, the FAA and European Aviation Safety Agency asked for more documentation of the changes to the computers, said one of the people, potentially delaying the certification further. Developing and testing software on airliners is an exacting process. Manufacturers may have to demonstrate with extensive testing that a software failure leading to a crash would be as rare as one in a billion. Further reading: Boeing Has So Many Grounded 737 Max Planes Waiting To Be Fixed They're Parking Them in the Employee Parking Lot.

Small-satellite startup Kepler and its nanosatellites have successfully demonstrated achieving over 100Mbps of network speed to a Germany icebreaker sea vessel that acts as a mobile lab for the MOSAiC research expedition. TechCrunch reports: This is the first time there's been a high-bandwidth satellite network for any central Arctic ground-based use, Kepler says, and this connection isn't just a technical demo: it's being used for the researchers in the MOSAiC team, which is made up of hundreds of individuals, to transfer data back and forth between the ship and shore-based research stations, which improves all aspects of working with the considerable quantities of data being gathered by the team. On the icebreaker floating research ship, Kepler has demonstrated 38Mbps down, and 120Mbps up.

The latest version of Chrome OS, version 78, adds separate browser and device settings, click-to-call, and picture-in-picture support for YouTube. It also introduces virtual desktop support for the operating system with a feature called Virtual Desks. 9to5Google reports: Chrome is getting another cross-device sharing feature after "Send this page" widely rolled in September. With "click-to-call," you can right-click on phone number links -- like tel:800-800-8000 -- to have them sent to your Android device. It's quicker than manually entering those digits or transferring via email. Chrome OS 78 will separate browser and device settings. The former is accessible directly at chrome://settings and what opens when clicking "Settings" at the bottom of the Overflow menu in the top-right corner of any browser window. It opens as a tab and provides web-related preferences. Meanwhile, chrome://os-settings opens as its own window, and can be accessed from the quick settings sheet. It provides device options like Wi-Fi, Bluetooth, and Assistant in a white Material Theme UI with an icon in the launcher/app shelf.

YouTube for Android now supports picture-in-picture with Chrome OS 78. After starting a video in the mobile client, switching to another window, covering, or minimizing the app will automatically open a PiP in the bottom-right corner. Available controls include switching to audio, play/pause, and skipping to the next track. In the top-left, you can expand the window and a settings gear on the other side allows you to open system settings. Tapping in the center expands and returns you to the YouTube Android app. Chrome OS 78 simplifies the printing experience by automatically listing compatible printers without any prior setup required. There are also a number of Linux on Chrome OS enhancements in this version:

- Backups of Linux apps and files can now be saved to local storage, external drive, or Google Drive. That copy can be then restored when setting up a new computer.
- Crostini GPU support will be enabled by default for a "crisp, lower-latency experience."
- You'll be warned when using a Linux app that does not support virtual keyboard in tablet mode.

Freshly Exhumed shares a report from ZDNet: A mysterious hacker has published today a database dump of one of the internet's most infamous neo-nazi meeting places -- the IronMarch forum. The data published today includes a full copy of its content, including sensitive details such as emails, IP addresses, usernames, and private messages. The database dump is currently being analyzed by a multitude of entities, including law enforcement, in the hopes of linking forum members to accounts on other sites and potentially exposing their real-world identities. The drive to unmask forum members comes from the fact that IronMarch, while a little-known site to most internet users, has been the birthplace of two of today's most extreme far-right neo-nazi movements -- the Atomwaffen Division and SIEGE Culture -- with the first being accused of orchestrating at least eight murders around the world. The forum's data was published earlier today via the Internet Archive portal.

"The published information includes a carbon copy of the site, from user details to forum posts, and from private messages to multi-factor authentication settings and forum management logs," reports BleepingComputer. "The forum's database includes details on 3,548 registered profiles. The last user's database ID is 15,218; however, the dump only included details on 3,548 accounts -- most likely due to spam or deleted profiles. The registration date for the last user is November 20, 2017, suggesting the database is a copy of the site near the time it went offline."

The T-Mobile and Sprint merger hasn't been officially completed yet, but that hasn't stopped the "Un-carrier" from talking about what it will do with its newfound resources. T-Mobile announced today that it plans to launch the company's cheapest phone plan ever and roll out its 5G network starting December 6th. Gizmodo reports: Starting at just $15 a month, the new T-Mobile Connect plan offers unlimited talk and text plus 2GB of 4G or 5G data. Now admittedly, 2GB of data per month isn't all that much, but considering the T-Mobile's current least expensive plans start at $30 a month (and that's including a discount for having four lines), T-Mobile Connect could provide some much-needed savings for low-income families -- at least temporarily while it gathers all the goodwill it can muster in the merger process. Additionally, T-Mobile also teased two other new programs with its Connecting Heroes Initiative, which promises to give unlimited talk, text and 5G access to every first responder in the U.S. for the next 10 years. This includes public and non-profit fire, police, and EMS personnel. Then there's T-Mobile's Project 10 Million, which promises to handout 10 million hotspots to students across the country that will provide up to 100GB of free mobile data per year. With Project 10 Million, T-Mobile is hoping to give children and students greater access to broadband internet in order to make completing homework just a bit easier.

Also, next month T-Mobile says it will turn on its nationwide 5G network on December 6th, which promises to bring 5G coverage to over 200 million Americans in more than 5,000 cities. That said, this 5G network won't have the combined resources of both T-Mobile and Sprint until sometime in 2020 when T-Mobile can integrate its mmWave and sub-6GHz spectrum with Sprint's mid-brand spectrum. Looking even further ahead, T-Mobile claims its new 5G network will offer 14 times more capacity than it could on its own, and that the combined T-Mobile/Sprint network will cover 85 percent of the rural U.S. within three years, and 90 percent coverage after six years.