Gaggle monitors the work and communications of almost 5 million students in the U.S., and schools are paying big money for its services. Hundreds of company documents unveil a sprawling surveillance industrial complex that targets kids who can't opt out. Caroline Haskins writes via BuzzFeed News: Using a combination of in-house artificial intelligence and human content moderators paid about $10 an hour, Gaggle polices schools for suspicious or harmful content and images, which it says can help prevent gun violence and student suicides. It plugs into two of the biggest software suites around, Google's G Suite and Microsoft 365, and tracks everything, including notifications that may float in from Twitter, Facebook, and Instagram accounts linked to a school email address. Gaggle touts itself as a tantalizingly simple solution to a diverse set of horrors. It claims to have saved hundreds of lives from suicide during the 2018-19 school year. The company, which is based in Bloomington, Illinois, also markets itself as a tool that can detect threats of violence.

But hundreds of pages of newly revealed Gaggle documentation and content moderation policies, as well as invoices and student incident reports from 17 school districts around the country obtained via public records requests, show that Gaggle is subjecting young lives to relentless inspection, and charging the schools that use it upward of $60,000. And it's not at all clear whether Gaggle is as effective in saving lives as it claims, or that its brand of relentless surveillance is without long-term consequences for the students it promises to protect. [...] [S]tudent surveillance services like Gaggle raise questions about how much monitoring is too much, and what rights minors have to control the ways that they're watched by adults. "My sense about this particular suite of products and services is that it's a solution in search of a problem," said Sarah Roberts, a UCLA professor and a scholar in digital content moderation, "which is to say that the only way that the logic of it works is if we first accept that our children ought to be captured within a digital system, basically, from the time they're sentient until further notice."

While Gaggle claims that its tool promotes a sense of "digital citizenship," BuzzFeed News says the newly revealed documents show that students often don't understand that their work and communications are being surveilled until they violate the rules.

Alaina Gassler, a 14-year-old inventor from West Grove, Pennsylvania, came up with a clever way to eliminate the blind spot created by the thick pillars on the side of a car's windshield. All it requires is some relatively inexpensive and readily available tech available at an electronics store. Gizmodo reports: Her solution involves installing an outward-facing webcam on the outside of a vehicle's windshield pillar, and then projecting a live feed from that camera onto the inside of that pillar. Custom 3D-printed parts allowed her to perfectly align the projected image so that it seamlessly blends with what a driver sees through the passenger window and the windshield, essentially making the pillar invisible.

Gassler's invention isn't quite ready to be installed in vehicles across the country just yet, but the technologies already exist that would allow it to be implemented in cars without serving as a distraction to the driver. Short-throw projectors could be installed at the base of the passenger side windshield pillar to create the image without having to worry about the passenger blocking the beam. And many cars have already replaced side mirrors with cameras, or include nearly invisible cameras in the rear for safely backing up, so adding one more on the side of the pillar would presumably be trivial. Gassler won the top prize for her invention at this year's Society for Science and the Public's Broadcom MASTERS (Math, Applied Science, Technology, and Engineering for Rising Stars) science and engineering competition.

Senator Cory Booker (D-N.J.) on Friday introduced a bill banning the use of facial recognition technology in public housing, mirroring legislation proposed in the House in July. The Hill reports: The No Biometric Barriers to Housing Act would block the tech from being installed in housing units that receive funding from the Department of Housing and Urban Development (HUD). "Using facial recognition technology in public housing without fully understanding its flaws and privacy implications seriously harms our most vulnerable communities," Booker, a 2020 presidential candidate, said in a statement. "Facial recognition technology has been repeatedly shown to be incomplete and inaccurate, regularly targeting and misidentifying women and people of color. We need better safeguards and more research before we test this emerging technology on those who live in public housing and risk their privacy, safety, and peace of mind." There is currently no federal law dictating when, how, where or why facial recognition technology can be used.

An anonymous reader quotes a report from VentureBeat: Alexa, Google Assistant, Siri, and Cortana can answer all sorts of questions that pop into users' heads, and they're improving every day. But what happens when a company like Amazon decides to crowdsource answers to fill gaps in its platform's knowledge? The result can range from amusing and perplexing to concerning. Alexa Answers allows any Amazon customer to submit responses to unanswered questions. When the web service launched in general availability a few weeks ago, Amazon gave assurances that submissions would be policed through a combination of automatic and manual review. But an analysis of public Alexa Answers data conducted by VentureBeat shows that untrue, potentially sponsored, and offensive questions and answers are accepted and served to the over 100 million Alexa-enabled devices sold to date.

We've asked Amazon for more information about how Alexa Answers works, but the company has so far been cagey about the details. It's unclear why some questions designated "live" on the Alexa Answers dashboard are served to Alexa users while others aren't. In our testing, most questions and answers worked when we tried them, regardless of their status. Some questions and answers we submitted to Amazon during our investigation have since been removed, and we expect that at least some of the examples [mentioned in the article] will be, too. When contacted for comment, an Amazon spokesperson said: "High quality answers are important to us, and this is something we take seriously -- we will continue to evolve Alexa Answers."

schwit1 writes: A private DNA ancestry database that's been used by police to catch criminals is a security risk from which a nation-state could steal DNA data on a million Americans, according to security researchers. Security flaws in the service, called GEDmatch, not only risk exposing people's genetic health information but could let an adversary such as China or Russia create a powerful biometric database useful for identifying nearly any American from a DNA sample. GEDMatch, which crowdsources DNA profiles, was created by genealogy enthusiasts to let people search for relatives and is run entirely by volunteers. It shows how a trend toward sharing DNA data online can create privacy risks affecting everyone, even people who don't choose to share their own information.

"You can replace your credit card number, but you can't replace your genome," says Peter Ney, a postdoctoral researcher in computer science at the University of Washington. Ney, along with professors and DNA security researchers Luis Ceze and Tadayoshi Kohno, described in a report posted online how they developed and tested a novel attack employing DNA data they uploaded to GEDmatch. Using specially designed DNA profiles, they say, they were able to run searches that let them guess more than 90% of the DNA data of other users. The founder of GEDmatch, Curtis Rogers, confirmed that the researchers alerted him to the threat during the summer. "The same attack wouldn't work on other genealogy sites, like 23andMe, because they don't permit data uploads," the report notes. "Others, like MyHeritage, do allow uploads but don't give users as much information about their matches."

"The problem with GEDmatch is the browser is too good, and searches too deeply," says Erlich. "If I were them, I would remove it, fix it, then put it back."

dryriver shares a report from CNN: Several rival companies may be hard at work trying to get Elon Musk's Hyperloop concept off the ground, but hurtling across country -- maybe even across continents -- at 600 miles per hour in a low-pressure steel tube still feels far from reality. But 13-year-old New York student Caroline Crouchley may have invented a more economically viable and eco-friendly Hyperloop solution. Crouchley's idea, which just won second place in the annual 3M Young Scientist Challenge, is to build pneumatic tubes next to existing train tracks. Magnetic shuttles would travel through these vacuum tubes, connected via magnetic arm to trains traveling on the existing tracks. This system would utilize current train tracks, thereby cutting infrastructure costs and, Crouchley says, eradicating the potential safety risk posed by propelling passengers in a vacuum. There'd be no need for trains to use diesel or electric motors, making the trains lighter and more fuel-efficient. This is important to Crouchley, who aims to devise active solutions to the climate crisis. "I pinpointed transportation as something I wanted to work on because if we can make trains more efficient, then we can eliminate the amount of cars, trucks and buses on the road," Crouchley tells CNN Travel.

Last week, NordVPN disclosed a server hack that leaked crypto keys. While the scope of the breach is still being determined, Ars Technica's Dan Goodin reports that NordVPN users' passwords were exposed and at least one site still features user credentials, which include email addresses, plain-text passwords, and expiration dates associated with the accounts. An anonymous Slashdot reader shares an excerpt from his report: I received a list of 753 credentials on Thursday and polled a small sample of users. The passwords listed for all but one were still in use. The one user who had changed their password did so after receiving an unrequested password reset email. It would appear someone who gained unauthorized access was trying to take over the account. Several other people said their accounts had been accessed by unauthorized people. Over the past week, breach notification service Have I Been Pwned has reported at least 10 lists of NordVPN credentials similar to the one I obtained. While it's likely that some accounts are listed in multiple lists, the number of user accounts easily tops 2,000. What's more, a large number of the email addresses in the list I received weren't indexed at all by Have I Been Pwned, indicating that some compromised credentials are still leaking into public view. Most of the Web pages that host these credentials have been taken down, but at the time this post was going live, at least one remained available on Pastebin, despite the fact Ars brought it to NordVPN's attention more than 17 hours earlier.

Without exception, all of the plain-text passwords are weak. In some cases, they're the string of characters to the left of the @ sign in the email address. In other cases, they're words found in most dictionaries. Others appear to be surnames, sometimes with two or three numbers tacked onto the end. These common traits mean that the most likely way these passwords became public is through credential stuffing. That's the term for attacks that take credentials divulged in one leak to break into other accounts that use the same username and password. Attackers typically use automated scripts to carry out these attacks.

Microsoft has been slowly dismantling its MSDN and TechNet blogging platforms for the past year-plus. This week, Microsoft introduced something meant to replace the MSDN and TechNet forums: A preview of Microsoft Q&A. From a report: Microsoft officials said they are making the switch because its MSDN and TechNet forums are outdated, according to a Frequently Asked Questions page about the new Q&A site. The new Q&A experience is part of the larger docs.microsoft.com platform. It is designed to offer "relevant and timely answers to your technical problems from a community of experts and Microsoft engineers." The new service will allow users to follow posts, tags or people to get information; provide suggested answers as users type their questions; and the ability to bookmark content for future reference. Q&A uses the same user authentication as Microsoft Docs and Learn. Experts will earn Reputation Points for answers they provide.

Amazon must decide soon if it will protest the Pentagon's awarding of a $10 billion cloud computing contract to rival Microsoft, with one possible grievance being the unusual attention given the project by President Donald Trump. From a report: Amazon was long thought to be the front-runner in the competition for the huge military contract. Its Amazon Web Services division is far ahead of second-place Microsoft in cloud computing, and Amazon has experience handling highly classified government data. It survived earlier legal challenges after the Defense Department eliminated rival bidders Oracle and IBM and whittled the competition down to the two Seattle area tech giants before choosing Microsoft last week. And what else distinguishes the losing bidder? Amazon and its CEO Jeff Bezos, who also owns The Washington Post, have been frequent targets of Trump's criticism. The Pentagon was preparing to make its final decision when Trump publicly waded into the fray in July, saying he had heard complaints about the process and that the administration would "take a very long look." He said other companies told him that the contract "wasn't competitively bid." Oracle, in particular, had argued that Pentagon officials unfairly favored Amazon for the winner-take-all contract.

Even as Facebook has cracked down on anti-vaxxers and peddlers of snake oil cure-alls, a particularly grotesque form of fake cancer treatment has flourished in private groups on Facebook. From a report: Black salve, a caustic black paste that eats through flesh, is enthusiastically recommended in dedicated groups as a cure for skin and breast cancer -- and for other types of cancer when ingested in pill form. There's even a group dedicated to applying the paste to pets. A Facebook spokesperson told BuzzFeed News that these groups don't violate its community guidelines. This summer, it launched an initiative to address "exaggerated or sensational health claims" and will downrank that content in the News Feed, similar to how it handles clickbait. But it's not clear how it defines what a "sensational" health claim is. Citing user privacy, Facebook would not say whether or not it had downranked the black salve groups in the News Feed. Other platforms have taken a different approach. When BuzzFeed News asked YouTube about several videos where people discussed using black salve, YouTube said the videos were in violation and removed them. Amazon, which does not sell the salve itself, removed a book about black salve when BuzzFeed News asked about it.

The U.S. government has launched a national security review of TikTok owner ByteDance's $1 billion acquisition of U.S. social media app Musical.ly, Reuters reported on Friday, citing people familiar with the matter. From the report: While the $1 billion acquisition was completed two years ago, U.S. lawmakers have been calling in recent weeks for a national security probe into TikTok, concerned the Chinese company may be censoring politically sensitive content, and raising questions about how it stores personal data. TikTok has been growing more popular among U.S. teenagers at a time of growing tensions between the United States and China over trade and technology transfers. About 60% of TikTok's 26.5 million monthly active users in the United States are between the ages of 16 and 24, the company said earlier this year. The Committee on Foreign Investment in the United States (CFIUS), which reviews deals by foreign acquirers for potential national security risks, has started to review the Musical.ly deal, the sources said. TikTok did not seek clearance from CFIUS when it acquired Musical.ly, they added, which gives the U.S. security panel scope to investigate it now.

The steering council of Python said it is adopting a 12-month release cycle as it seeks to bring more consistency to schedule. In their mailing list they announced the change would mean developers would: 1. Know when to start testing the beta to provide feedback.
2. Know when the expect the RC so the community can prepare their projects for the final release.
3. Know when the final release will occur to coordinate their own releases (if necessary) when the final release of Python occurs.
4. Allow core developers to more easily plan their work to make sure work lands in the release they are targeting.
5. Make sure that core developers and the community have a shorter amount of time to wait for new features to be released. They added: It should also fit into the release schedule of Linux distributions like Fedora better than previously proposed so the distributions can test the RC when they start preparing for their own October releases. If this turns out to be a mistake after we try it out for Python 3.9 we can then discuss going back to longer betas and shorter RCs for the release after that. This will not change when feature development is cut off relative to PyCon US nor the core dev sprints happening just before the final release or the alpha of the next version.

Facebook, Mozilla, and Cloudflare announced today a new technical specification called TLS Delegated Credentials, currently undergoing standardization at the Internet Engineering Task Force (IETF). From a report: The new standard will work as an extension to TLS, a cryptographic protocol that underpins the more widely-known HTTPS protocol, used for loading websites inside browsers via an encrypted connection. The TLS Delegate Credentials extension was specifically developed for large website setups, such as Facebook, or for website using content delivery networks (CDNs), such as Cloudflare. For example, a big website like Facebook has thousands of servers spread all over the world. In order to support HTTPS traffic on all, Facebook has to place a copy of its TLS certificate private key on each one. This is a dangerous setup. If an attacker hacks one server and steals the TLS private key, the attacker can impersonate Facebook servers and intercept user traffic until the stolen certificate expires. The same thing is also valid with CDN services like Cloudflare. Anyone hosting an HTTPS website on Cloudflare's infrastructure must upload their TLS private key to Cloudflare's service, which then distributes it to thousands of servers across the world. The TLS Delegate Credentials extension allows site owners to create short-lived TLS private keys (called delegated credentials) that they can deploy to these multi-server setups, instead of the real TLS private key.

Google announced this morning that it has entered an agreement to buy Fitbit for $2.1 billion. In a blog post, Google's Senior Vice President of Devices & Services, Rick Osterloh, said the company sees "an opportunity to invest even more in Wear OS as well as introduce Made by Google wearable devices into the market." He added, "Fitbit has been a true pioneer in the industry and has created engaging products, experiences and a vibrant community of users. By working closely with Fitbit's team of experts, and bringing together the best AI, software and hardware, we can help spur innovation in wearables and build products to benefit even more people around the world." From a report: Google's Wear OS wearable platform has been in something of a rut for the last few years. The company introduced the Android Wear to Wear OS rebrand in 2018 to revitalize its branding/image, but the hardware offerings have still been pretty ho-hum. Third-party watches like the Fossil Gen 5 have proven to be quite good, but without a proper "Made by Google" smartwatch and other major players, such as Samsung, ignoring the platform, it's been left to just sort of exist.

An anonymous reader quotes a report from ZDNet: Mozilla has announced today plans to discontinue one of the three methods through which extensions can be installed in Firefox. Starting next year, Firefox users won't be able to install extensions by placing an XPI extension file inside a special folder inside a user's Firefox directory. The method, known as sideloading, was initially created to aid developers of desktop apps. In case they wanted to distribute a Firefox extension with their desktop app, the developers could configure the app's installer to drop a Firefox XPI extension file inside the Firefox browser's folder.

This method has been available to Firefox extension developers since the browser's early days. However, today, Mozilla announced plans to discontinue supporting sideloaded extensions, citing security risks. Mozilla plans to stop supporting this feature next year in a two-phase plan. The first will take place with the release of Firefox 73 in February 2020. Firefox will continue to read sideloaded extensions, but they'll be slowly converted into normal add-ons inside a user's Firefox profile, and made available in the browser's Add-ons section. By March 2020, with the release of Firefox 74, Mozilla plans to completely remove the ability to sideload an extension. By that point, Mozilla hopes that all sideloaded extensions will be moved inside users' Add-ons section.

New submitter jklappenbach writes: Further cementing Kyle Hill's nerd creds, he's just released a YouTube video [via Because Science] where he demonstrates how Magic: The Gathering can be used to construct a Turing Machine, using both a specifically-constructed deck and the current rules of the game (except the ability to pull cards from all of history). Kyle posted the full setup of the deck in a comment below the video, with a link to the paper that can be found via arXiv.

iFixit's teardown of Apple's latest AirPods reveals just how difficult it will be to fix them if they break. "The organization awarded the noise-canceling buds a big fat zero repairability score, noting that their 'non-modular, glued-together design and lack of replacement parts makes repair both impractical and uneconomical,'" reports The Verge. "That's the same score as both versions of the original AirPods." From the report: The teardown does reveal a couple of interesting details about the design of the earbuds. First is the fact that they're a whole third heavier than the original AirPods, thanks to new features like active noise-cancellation, and an inward-facing microphone. The teardown also notes that the one user-replaceable part of the earbuds, the silicone ear-tip, uses a custom design that makes them incompatible with third-party models. That said, the popularity of the AirPods all but guarantees other companies will be making third-party tips soon. Most intriguing is the discovery of a watch-style battery inside each earbud. iFixit notes that it's a similar battery to what it found in Samsung's Galaxy Buds which could be replaced. However, the same is not true of the AirPods Pro, whose battery is tethered by a soldered cable. TL;DR: If your $249 AirPods Pro die you'll have to send them back to Apple for recycling, or take part in Apple's "battery service" program at a cost of $49-per-earbud out of warranty.

Incognito Mode for Google Maps is rolling out to Android users to prevent your search queries and real-time tracked location from being recorded onto your Google account. Engadget reports: It's not something you'll want to use all the time as some features will be disabled, and it's important to note that it doesn't turn off all tracking. The places you go won't be saved to your Location History (if you have that enabled), your searches won't be saved to your account and it won't use your information to personalize the experience. Still, you could be tracked by internet service providers, other apps, or if you're using Assistant and other Google services. Similar to incognito on Chrome, it's more useful as a depersonalized look at recommendations than as a full-fledged privacy protector, and a way to make sure that whatever you're searching for in this instance doesn't affect your recommendations later -- don't worry, we're not judging.

Freshly Exhumed shares a report from Fast Company: Hold your favorite graphic design tome close. We now know what the classic typeface Helvetica would look like if it came from the underworld. Yes, it will keep type enthusiasts up at night. The design darling Helvetica -- that ubiquitous sans-serif typeface developed by Max Miedinger in 1957, representative of the crisp Swiss design aesthetic of that period, and star of its own documentary by the same name -- has made a deal with the kerning devil. The results aren't pretty. They're not meant to be.

Zack Roif and Matthew Woodward, both associate creative directors at the international advertising agency R/GA, have released a new typeface available free to download, Hellvetica, and it will make all your worst kerning nightmares come true. While each character has the same form as the classic typeface it's riffing on, Hellvetica utilizes inconsistent, variable spacing between each letterform to give an overall effect that something has gone terribly astray. Nope, that wasn't a mistake. You might just say it was intentionally erroneous. The project is a study in playfulness and rule-breaking, "an exercise in going against the 'designer instincts' to fix up that awful kerning. Hundred percent break the rules," says Woodward. "Don't listen to your gut. Forget your training... and make that logo kern in hell!"

An anonymous reader quotes a report from CBS News: New details about how Uber responded to a massive hack attack in 2016 raise questions about the way it handled sensitive customer information. Instead of reporting the hackers to police, the company allegedly paid $100,000 in exchange for a promise to delete 57 million user files the men stole off a third party server, prosecutors said. Within weeks of paying the ransom, Uber employees showed up at Brandon Glover's Winter Park, Florida, home and found Vasile Mereacre at a hotel restaurant in Toronto, Canada, the Justice Department said. The pair admitted their crimes, but Uber didn't turn them over to the cops. Instead, they had the hackers sign non-disclosure agreements, promising to keep quiet. The two hackers pleaded guilty on Wednesday.

But there was a third person involved who was unknown to Uber, U.S. attorney for Northern California Dave Anderson told CBS News correspondent Kris Van Cleave in an exclusive interview. Anderson, who investigated the hack, said there's "no way to know definitively" what actually happened to the stolen data. [...] The hackers also targeted a company owned by LinkedIn in December of 2016, but prosecutors say LinkedIn did not pay and promptly reported the hack to police. Uber eventually did as well -- a year after the hack, when new CEO, Dara Khosrowshahi, publicly disclosed the attack. The two known hackers were eventually arrested and pleaded guilty on Wednesday to conspiracy to commit extortion charges. They face a maximum of five years in prison. The third person involved remains at large.