Media

Slashdot Asks: What Did You Like/Dislike About iTunes? 131

iTunes is officially dead with the release of macOS Catalina today. Apple decided to break apart the app into separate Apple Music, Podcasts and TV apps. "Each is better at its individuals task than it was as a section within iTunes, which was teetering on collapse like the Jenga tower of various functions it supports," writes Dieter Bohn via The Verge.

"In the early days, iTunes was simply a way to get music onto Apple's marquee product, the iPod music player," reports Snopes. "Users connected the iPod to a computer, and songs automatically synced -- simplicity unheard of at the time." It was the first service to make songs available for 99 cents apiece, and $9.99 for most albums -- convincing many people to buy music legally than seek out sketchy sites for pirated downloads. "But over time, iTunes software expanded to include podcasts, e-books, audiobooks, movies and TV shows," recalls Snopes. "In the iPhone era, iTunes also made backups and synced voice memos. As the software got bloated to support additional functions, iTunes lost the ease and simplicity that gave it its charm. And with online cloud storage and wireless syncing, it no longer became necessary to connect iPhones to a computer -- and iTunes -- with a cable."

What did you like or dislike about iTunes? When you look back at the media player, what are you reminded of?
Transportation

Automatic License Plate Readers Are Making Getaway Cars Extinct (qz.com) 147

An anonymous reader shares a report: On Tuesday, Sept. 10, the Total Choice Credit Union in Laplace, Louisiana was robbed. At approximately 3:06 pm, a man in his early thirties walked in wearing jeans, a white shirt, sunglasses, and a brown dreadlock wig, according to a now-unsealed complaint filed last month in US federal court. He passed a handwritten note to one of the tellers which read: "ROBBERY. I DON'T WANT TO (HURT) OR (KILL) YOU OR ANYONE IN HERE SO I AM GOING TO GIVE YOU (FIVE SECONDS) TO (EMPTY) YOUR (REGISTER)." The teller handed over more than $7,000 to the thief, who fled on foot. Investigators canvassed the area for nearby surveillance cameras that might have picked up any clues. They found one with footage of an "older model white single-cab pickup truck stopped in the area directly behind the bank," a minute or two before the robbery went down. That's when cops turned to a tool that has rendered the concept of a getaway car all but obsolete -- the national network of automated license plate readers. These are fixed cameras with sensors that can be found in on utility poles, streetlights, overpasses, in police cars, even within traffic cones and digital speed display signs that show drivers how fast they're going.

The technology, known as ALPR, can clock roughly 2,000 plates a minute, on vehicles traveling up to 120 mph. Each license plate is photographed and the date, time, and location are recorded. Law enforcement can access a target's movements in real time, or mine the data later to track a suspect's daily patterns. ALPR systems cast an incredibly wide net that has made it far easier for cops to catch criminals. The method has also drawn harsh criticism from the American Civil Liberties Union (ACLU) and privacy advocates as "a technology deployed with too few rules," and "a form of mass surveillance." There are few accurate estimates of the exact number of ALPRs across the US, which is a hodgepodge of local, state, and federal and tribal license plate readers.

China

Getting a New Mobile Number in China Will Soon Involve a Facial-Recognition Test (qz.com) 35

China is taking every measure it can to verify the identities of its over 850 million mobile internet users. From a report: From Dec. 1, people applying for new mobile and data services will have to have their faces scanned by telecom providers, the Ministry of Industry and Information Technology said in a Sept. 27 statement. MIIT said the step was part of its efforts to "safeguard the legitimate rights and interests of citizens in the cyberspace" and to control phone and internet fraud. In addition to the facial-recognition test, phone users are also banned from passing their mobile phone numbers to others, and encouraged to check if numbers are registered under their name without their consent.
Microsoft

Linus Torvalds Isn't Worried About Microsoft Taking Over Linux (zdnet.com) 141

An anonymous reader quotes a report from ZDNet: At the 2019 Linux Plumbers Conference, I talked to Linus Torvalds and several other of the Linux kernel's top programmers. They universally agreed Microsoft wants to control Linux, but they're not worried about it. That's because Linux, by its very nature and its GPL2 open-source licensing, can't be controlled by any single third-party. Torvalds said: "The whole anti-Microsoft thing was sometimes funny as a joke, but not really. Today, they're actually much friendlier. I talk to Microsoft engineers at various conferences, and I feel like, yes, they have changed, and the engineers are happy. And they're like really happy working on Linux. So I completely dismissed all the anti-Microsoft stuff."

But that doesn't mean the Microsoft leopard can't change its spots. Sure, he hears, "This is the old Microsoft, and they're just biding their time." But, Torvalds said, "I don't think that's true. I mean, there will be tension. But that's true with any company that comes into Linux; they have their own objectives. And they want to do things their way because they have a reason for it." So, with Linux, "Microsoft tends to be mainly about Azure and doing all the stuff to make Linux work well for them," he explained. Torvalds emphasized this is normal: "I mean, that's just being part of the community."
James Bottomley, an IBM Research Distinguished Engineer and top Linux kernel developer, sees Microsoft as going through the same process as all other corporate Linux supporters: "This is a thread that runs through Linux. You can't work on the kernel to your own proprietary advantage. A lot of companies, as they came in with the proprietary business model, assumed they could. They have to be persuaded that, if you want something in Linux, that will assist your business -- absolutely fine. But it has to go through an open development process. And if someone else finds it useful, you end up cooperating or collaborating with them to produce this feature." That means, to get things done, even Microsoft is "eventually forced to collaborate with others."

Bottomley concluded: "So it doesn't matter if Microsoft has a competing agenda to Red Hat or IBM or anybody else. Developers are still expected to work together in the Linux kernel with a transparent agenda."
Android

The Privacy Trade-Offs of Cheap Android Smartphones (fastcompany.com) 22

Fast Company highlights some of the "privacy nightmares" surrounding low-cost Android smartphones, which can be very attractive for those on a tight budget. One example is the MYA2 MyPhone: According to an analysis by the advocacy group Privacy International, a $17 Android smartphone called MYA2 MyPhone, which was launched in December 2017, has a host of privacy problems that make its owner vulnerable to hackers and to data-hungry tech companies. First, it comes with an outdated version of Android with known security vulnerabilities that can't be updated or patched. The MYA2 also has apps that can't be updated or deleted, and those apps contain multiple security and privacy flaws. One of those pre-installed apps that can't be removed, Facebook Lite, gets default permission to track everywhere you go, upload all your contacts, and read your phone's calendar. The fact that Facebook Lite can't be removed is especially worrying because the app suffered a major privacy snafu earlier this year when hundreds of millions of Facebook Lite users had their passwords exposed.

Philippines-based MyPhone said the specs of the MYA2 limited it to shipping the phone with Android 6.0, and since then it says it has "lost access and support to update the apps we have pre-installed" with the device. Given that the MYA2 phone, like many low-cost Android smartphones, runs outdated versions of the Android OS and can't be updated due to their hardware limitations, users of such phones are limited to relatively light privacy protections compared to what modern OSes, like Android 10, offer today. The MYA2 is just one example of how cheap smartphones leak personal information, provide few if any privacy protections, and are incredibly easy to hack compared to their more expensive counterparts.

Television

Hulu Finally Adds Downloads For Offline Mobile Viewing (variety.com) 16

Hulu is finally allowing users to download TV shows and movies to their mobile devices to watch without an internet connection. Variety reports: The download feature, which has been several years in the works, gives Hulu subscribers on the $11.99 no-commercials plan the ability to download tens of thousands of TV episodes and movies. It's not available to customers who have the entry-level $5.99-per-month package with ads. For now, it's available only on Hulu's iOS app for Apple devices. The company says the feature will be coming to the Android app "soon."

The majority of Hulu's catalog, which includes some 85,000 total TV episodes, is available for offline viewing. That includes most Hulu originals, including full seasons of "The Handmaid's Tale," "Veronica Mars," "Shrill" and "The Act" as well as licensed content including "Family Guy," "Desperate Housewives," "This Is Us," "How I Met Your Mother" and "ER." A Hulu rep would not specify how much content is available to download for offline viewing, or spell out which TV shows or movies aren't included. The reason some content is excluded is that some of Hulu's past deals did not contemplate download rights. According to Hulu, customers can download a maximum of 25 titles across five different devices. Downloads are available for up to 30 days; they will expire two days after a user starts playback. After downloaded content expires, viewers can renew an expired download when they're connected online (assuming the content is still available on Hulu).
The move comes nearly three years after Netflix added the feature , and four years after Amazon Prime Video added that ability for both iOS and Android apps. Disney Plus, which is launching on November 12, will also include content downloads.
Desktops (Apple)

macOS Catalina is Available To Download Today (engadget.com) 57

It's happening a little later in the season than usual, but Apple's latest version of macOS is available to download today. From a report: Catalina arrives on the heels of iOS 13, which saw several back-to-back updates after an initially rough launch. For what it's worth, I've been using successive versions of the Catalina beta as my daily driver for months now and can assure you that the latest build is stable enough to safely install. [...] Speaking of games, today also marks the first time that Catalina beta users will have been able to play Apple Arcade games. If you're wondering how the heck you'll play those titles from your Mac, it's worth a reminder that many Arcade games support Xbox and PlayStation controllers.

Also new in this release: As you browse episodes in the podcast app, you'll see avatars for guests and hosts. Apple also says it's made some small usability tweaks to Sidecar, the feature that allows you to use an iPad as a secondary Mac display. You'll also notice more promotional Apple TV+ material in the new TV app, which makes sense -- the streaming service launches November 1st. It'll cost $4.99 a month, but Apple is offering a free year with the purchase of a new Mac, iPhone, iPad or Apple TV.
Further reading: Apple's MacOS Catalina Opens Up To iPad Apps; Apple Will Permanently Remove Dashboard In macOS Catalina; Apple Replaces Bash With Zsh as the Default Shell in macOS Catalina; and Apple Finally Kills iTunes.
Transportation

Analyst: Strike at GM 'Is Really About the Switch to Electric Cars' (marketwatch.com) 331

MarketWatch just published an interesting analysis by the head of automotive industry consulting at one of America's top business advisory firms. It argues that a strike by the United Auto Workers (UAW) union at General Motors is really about the future of the electric car: UAW members' anxieties and uncertainties are actually shared by General Motors (GM) and most other automakers, which know that it's no longer a question of when internal combustion engine cars will be replaced by electric vehicles, but how quickly the changeover will take place. The shift to electric means a fundamental transformation of what workers will do and how many are needed to do it.

Electric cars have far fewer parts, which means far fewer people are needed to put them together. When one analyst took apart a Chevrolet Bolt and Volkswagen Golf, he found that the Golf had 125 more moving parts than its electric counterpart. What's more, the electric vehicles' parts are often easier to put in place using automated machines. The UAW's own estimates that the move to electrification may cause 35,000 members to lose their jobs may not be the most scientific study ever done, but it's also probably not far off.

GM has attempted to appease the UAW with specific promises, including the construction of an electric battery plant in one of the Ohio cities hit hardest by recent factory closings. But even this tactic has only confirmed the UAW's worst fears: The battery plant won't need as many workers, and GM would prefer to pay them less than what other workers make at plants that require more complicated assembly.

The article concludes that "None of this is anyone's fault. GM is trying to respond to a global trend that it needs to follow in order to stay relevant. The UAW is trying to protect its members."

But he argues that the U.S. is already at risk of falling behind foreign auto-makers, and "it would just make a lot more sense if the people that we need to compete globally were working together as a team, rather than fighting each other."
Networking

Big ISPs Worry DNS-Over-HTTPS Could Stop Monitoring and Modifying of DNS Queries (arstechnica.com) 156

"Big Cable and other telecom industry groups warned that Google's support for DNS over HTTPS (DoH) 'could interfere on a mass scale with critical Internet functions, as well as raise data-competition issues,'" reports Ars Technica.

But are they really just worried DNS over HTTPS will end useful ISP practices that involve monitoring or modifying DNS queries? For example, queries to malware-associated domains can be a signal that a customer's computer is infected with malware. In some cases, ISPs also modify customers' DNS queries in-flight. For example, an easy way to block children from accessing adult materials is with an ISP-level filter that rewrites DNS queries for banned domains. Some public Wi-Fi networks use modified DNS queries as a way to redirect users to a network sign-on page. Some ISPs also use DNS snooping for more controversial purposes -- like ad targeting or policing their networks for copyright infringement. Widespread adoption of DoH would limit ISPs' ability to both monitor and modify customer queries.

It wouldn't necessarily eliminate this ability, since ISPs could still use these techniques for customers who use the ISP's own DNS servers. But if customers switched to third-party DNS servers -- either from Google or one of its various competitors -- then ISPs would no longer have an easy way to tell which sites customers were accessing. ISPs could still see which IP addresses a customer had accessed, which would give them some information -- this can be an effective way to detect malware infections, for example. But this is a cruder way to monitor Internet traffic. Multiple domains can share a single IP address, and domains can change IP addresses over time. So ISPs would wind up with reduced visibility into their customers' browsing habits.

But a switch to DoH would clearly mean ISPs had less ability to monitor and manipulate their customers' browsing activity. Indeed, for advocates that's the point. They believe users, not their ISPs, should be in charge... [I]t's hard to see a policy problem here. ISPs' ability to eavesdrop on their customers' DNS queries is little more than a historical accident. In recent years, websites across the Internet have adopted encryption for the contents of their sites. The encryption of DNS is the natural next step toward a more secure Internet. It may require some painful adjustments by ISPs, but that hardly seems like a reason for policymakers to block the change.

Mozilla

Mozilla Developer Network Launches a YouTube Channel (youtube.com) 20

An anonymous reader writes: The Mozilla Developer Network just launched their own video channel on YouTube this week. There's currently seven videos, offering tutorials like "The Secret Button to get Three Panels of Developer Tools" and "Coding a Dark Mode for your web site."

And tweets from a Mozilla Community Lead suggest it may soon feature something from the View Source Conference in Amsterdam.

Books

Consumer Expert Argues Tech Addiction Is The User's Responsibility (nytimes.com) 133

In 2014 consumer expert and Silicon Valley startup founder Nir Eyal wrote Hooked: How to Build Habit-Forming Products. But five years later, the New York Times reports he's offering consumers a new book about how to resist those habits -- even while arguing that "addiction" is the wrong way to describe technology's hold on people: There was a problem, yes, but the thinking was all wrong, he decided. Using the language of addiction gave tech users a pass. It was too easy. The issue was not screens but people's own minds, and to solve the problem they had to look within. "If I call technology something that people get addicted to, there needs to be a pusher, a dealer doing it to you," Mr. Eyal said. "But if I say technology is something that people overuse, then it's, 'Oh, crap, now I need to do something about it myself....'" The solution he proposes in Indistractable is slow. It involves self-reflection. He argues that many times we look at phones because we are anxious and bad at being alone -- and that's not the phone's fault...

Mr. Eyal has written a guide to free people from an addiction he argues they never had in the first place. It was all just sloughing off personal responsibility, he figures. So the solution is to reclaim responsibility in myriad small ways. For instance: Have your phone on silent so there will be fewer external triggers. Email less and faster. Don't hang out on Slack. Have only one laptop out during meetings. Introduce social pressure like sitting next to someone who can see your screen. Set "price pacts" with people so you pay them if you get distracted -- though be sure to "learn self-compassion before making a price pact....."

"I got myself a feature phone that had no apps. I got on eBay a word processor, and all it does is let you type. I made my phone grayscale, which only ruined my pictures," he said. "I tried a digital detox, but I missed audiobooks and GPS...."

He also argues that getting hooked on social media isn't necessarily a bad thing. "For many people, social media is a very good thing and gaming is a very good thing. It's how you use it...." But he's also predicting a "post-digital" movement will emerge in 2020.

"We will start to realize that being chained to your mobile phone is a low-status behavior, similar to smoking."
Microsoft

Microsoft Will Model the Entire Planet For 'Breathtakingly Lifelike' New Flight Simulator (eaa.org) 84

A senior editor at the Experimental Aircraft Association tells the long and storied history of Microsoft's Flight Simulator, remembering how he'd used version 1.0 of the product "when I was about 12 years old (nearly 40 years ago)" before working on it when he was a Microsoft employee for more than 10 years, until it was cancelled in 2009. But in 2020 Microsoft now plans to release a stunningly-realistic new version for the PC and Xbox.

Long-time Slashdot reader ShoulderOfOrion shared their report: After the shutdown, variations of the product lived on here and there, including the enterprise edition, which Lockheed Martin now develops and publishes as Prepar3D, and a version that was licensed by Dovetail Games in the United Kingdom and sold on the Steam marketplace. Dovetail pursued further development with a product called Flight Sim World, and Microsoft itself briefly returned to the genre in 2012 with a limited product called Flight. But it was the community of hardcore simmers and add-on developers who truly kept the product alive for the past 10 years.
The essay describes the new version as "stunning" and "breathtakingly lifelike," using 2 petabytes of data to virtually model the entire planet, "including something like 40,000 airports... The scenery is built on Bing satellite and aerial imagery, augmented with cool buzzwordy stuff like photogrammetric 3D modeling and multiple other data sources, all of which is streamed via Microsoft's Azure cloud service... Throw in 1.5 trillion trees, individual blades of grass modeled in 3D, and a complete overhaul of lighting and shadows, and the result is an unprecedented level of detail for a flight simulator of any kind."

The simulator also features realistic modelling of the weather, including temperature, air pressure, humidity, dew point, wind direction and speed, and of course, clouds and precipitation. "You'll even see rainbows when conditions are just right... Weather is automatically downloaded from real-world sources, creating accurate conditions that change over time." (Though there's a drop-down menu that finally lets you do something about the weather.) And that's just the beginning...

Microsoft is incorporating a legacy mode that it expects will provide near-complete backward compatibility, so those of us who have huge libraries of old favorites won't be starting entirely from scratch. In addition, Microsoft is committed to providing a software development kit (SDK) with the product at launch that will give developers the tools they need to build add-ons, though they caution that it is something that will be polished and expanded through post-launch updates. In other news for add-on aircraft builders, every parameter is now exposed in plain text, with no more binaries. This means it's going to be easier than ever to create high-quality add-on aircraft, or to tinker with the ones you already have. For those who like emulating glass cockpits, those displays are fully programmable based on straightforward coding instead of a library of animations, and support things like touch screens and synthetic vision. While the team is currently evaluating something like an in-sim store for supplemental content, there will be no requirements to use it, and no restrictions of any kind on downloading freeware or payware add-ons from other sources.
The article includes some fond thoughts from the software's director of technology Jorg Neumann explaining the simulator's significance. "It is in the fiber of the company's being. It is older than Windows.

"I think there is a pride that comes with it, and I think seeing it come back in a meaningful way, I think makes lots of people proud."
Facebook

Gizmodo's Disappearing Story Explains Why No One Trusts Facebook (gizmodo.com) 90

"On Friday, Gizmodo uncovered shocking new evidence that Facebook is using its platform to suppress stories about CEO Mark Zuckerberg..." reports Gizmodo, adding "or maybe his janky, busted-ass website is just bugging out again for no reason. It's hard to say, really. That's sort of the problem..." For some reason, a story about Zuckerberg we posted to our Facebook page was hidden from many readers. The post was fully visible through web browsers in incognito mode, but an unclear percentage of users were told, "Sorry, this content is not available," when they tried to view it while signed in. In short, lots of people (including several Gizmodo staffers and at least one of their parents) could not see the story.

By Friday afternoon, the issue seemed to resolve itself just as mysteriously. Was it a bug, a moderation error, or something more nefarious? Personally, I find it hard to imagine Zuckerberg furiously refreshing Gizmodo's page, just waiting to slam the giant red button on his desk labeled "WRONGTHINK." But it's easy to see why some people believe similar (if less cinematic) conspiracy theories. When Facebook acts strangely -- which is fairly often! -- users have to draw their own conclusions about what's happening. Like most big tech companies, Facebook doesn't offer a phone number to call if you're having issues. If you want a response from a social network about your specific problem, your best bet is to be a journalist, a celebrity, or someone else with the power to give headaches. To understand their experiences with social media, then, most people are left with two choices: trust the system (lol) or develop their own, potentially very wacky, explanations...

Some may believe -- as Zuckerberg himself seems to -- that companies like Facebook are just too big to explain every little thing they do to their millions of users. Maybe so, but is it any surprise, then, that no one fucking trusts them?

Advertising

How Reddit's CEO/Co-Founder Plans To 'Clean Up' Reddit (latimes.com) 196

An anonymous reader quotes the Financial Times: After what the company acknowledges as its "wild" early days, the 35-year-old co-founder is now trying to clean up the edgy website known for provocative discussions and fringe groups, while revamping its advertising offering in a bid to woo big brands and move toward profitability.... [T]empering extreme conversation while also maintaining Reddit's reputation as a radical bastion of free speech is a delicate balance, especially as many among its 330 million users are quick to accuse it of censorship... despite his optimism, the chief executive now faces the unenviable task of convincing prospective clients that their ads will not be associated with any unsuitable content -- without upsetting users who value the site for its freedom of expression....

His approach for wary advertisers is to give them control over where and how their brand is placed. Reddit now has a human-approved "whitelist" of communities that are deemed safe, while advertisers can also opt for "negative targeting" -- requesting that their content not appear near a certain keyword, for example. More broadly, Reddit is looking to clean up its content by investing in a combination of machine learning tools that recognize suspicious or badly behaved accounts, working together with human moderators who oversee the entire site, Huffman said.

The chief executive of the world's largest advertising company tells the newpaper that Reddit's new direction has now "helped make it a much more acceptable site for advertisers."
Government

Libertarian Accused of Faking 1.5M Net Neutrality Comments Using Data-Breached Addresses (buzzfeednews.com) 60

BuzzFeed says they've identified two firms which "misappropriated names and personal information as part of a bid to submit more than 1.5 million statements" pretending to oppose net neutrality regulations: The anti-net neutrality comments harvested on behalf of Broadband for America, the industry group that represented telecommunications giants including AT&T, Cox, and Comcast, were uploaded to the FCC website by Media Bridge founder Shane Cory, a former executive director of both the Libertarian Party and the conservative sting group Project Veritas. Cory has claimed credit for "20 or 30" major public advocacy campaigns in recent years, including, he says, record-setting submissions to the IRS, Environmental Protection Agency, Bureau of Land Management, Bureau of Ocean Energy Management, and "probably a handful of others." On Media Bridge's website, the company has described itself as having expertise in "overwhelming government agencies" with avalanches of public submissions, and has publicly dubbed its approach to marshaling comments the "Big Hammer." In the FCC campaign, Cory was working for Ralph Reed -- a high-powered political strategist and titan of the Christian right who himself was working for Broadband for America. Cory, in turn, enlisted LCX Digital to find the commenters...

BuzzFeed News ran large samples of the email addresses in those files through Have I Been Pwned, a website that identifies whether an address has been exposed in any of hundreds of major data breaches. The results were stark: In one particular group of 1.9 million comments, according to BuzzFeed News' analysis, 94% of the email addresses belonged to people who had fallen victim to a hack known as the Modern Business Solutions data breach, in which millions of people's personal information, including full names, birthdates, home addresses, and email addresses, had been stolen... All these comments were uploaded by Cory, using his Media Bridge email address. (Some of the comments were full duplicates; after removing them, there were just over 1.5 million comment-and-email combinations.)

In its letter to BuzzFeed News, Media Bridge contested the idea that email addresses showing up in breached databases were a sign of improprieties. In fact, it said, a "high match rate" is a sign of validity, since most Americans appear in breached databases....

Two of the commenters were named Luke Skywalker and Boba Fett -- and yet mysteriously "the names and street addresses were exactly as they appeared in that breach... A separate spot check by BuzzFeed News of 100 randomly selected Media Bridge comments revealed a similar pattern -- even down to a street address that used underscores instead of spaces."

In addition, Buzzfeed found that "almost all" of the remaining 6% appears to just be "recycled" identities drawn from comments left in 2016 when the FCC was considering a new rule that would allow cable consumers to use their own set-top boxes -- a regulation that the cable industry opposed. "One year later, 99.9% of those exact same names and addresses appeared on the FCC's website, weighing in on an entirely different policy debate -- net neutrality. They were uploaded by Media Bridge."
Google

Google Finds Hundreds Of Data-Race Conditions In The Linux Kernel (phoronix.com) 57

Google has been testing the Linux kernel with its "sanitizer" testing software that hunts for memory corruption bugs and undefined behaviors. Now Phoronix reports on Google's newest sanitizer: Kernel Concurrency Sanitizer (KCSAN) is focused on discovering data-race issues within the kernel code. This dynamic data-race detector is an alternative to the Kernel Thread Sanitizer. In their testing just last month, in two days they found over 300 unique data race conditions within the mainline kernel.

There was a recent discussion about the Kernel Concurrency Sanitizer on the LKML.

Chrome

Chrome Promises 'No More Mixed Messages About HTTPS ' (chromium.org) 46

"Today we're announcing that Chrome will gradually start ensuring that https:// pages can only load secure https:// subresources," promises an announcement on the Chromium blog.

It notes that Chrome users already make HTTPS connections for more than 90% of their browsing time, and "we're now turning our attention to making sure that HTTPS configurations across the web are secure and up-to-date." In a series of steps outlined below, we'll start blocking mixed content (insecure http:// subresources on https:// pages) by default. This change will improve user privacy and security on the web, and present a clearer browser security UX to users...

HTTPS pages commonly suffer from a problem called mixed content, where subresources on the page are loaded insecurely over http://. Browsers block many types of mixed content by default, like scripts and iframes, but images, audio, and video are still allowed to load, which threatens users' privacy and security. For example, an attacker could tamper with a mixed image of a stock chart to mislead investors, or inject a tracking cookie into a mixed resource load. Loading mixed content also leads to a confusing browser security UX, where the page is presented as neither secure nor insecure but somewhere in between. In a series of steps starting in Chrome 79, Chrome will gradually move to blocking all mixed content by default. To minimize breakage, we will autoupgrade mixed resources to https://, so sites will continue to work if their subresources are already available over https://. Users will be able to enable a setting to opt out of mixed content blocking on particular websites...

Starting in December of 2019, Chrome 79 will include a new setting to unblock mixed content on specific sites. "This setting will apply to mixed scripts, iframes, and other types of content that Chrome currently blocks by default..."

Then in Chrome 80, mixed audio and video resources will be autoupgraded to https://, and if they fail to load Chrome will block them by default.
Transportation

Cars All But Banned On One of Manhattan's Busiest Streets (nytimes.com) 149

An anonymous reader shares a report from The New York Times: On Thursday, New York City transformed one of its most congested streets into a "busway" that delighted long frustrated bus riders and transit advocates but left many drivers and local businesses fuming that the city had gone too far. Passenger cars, including taxis and Ubers, were all but banned from 14th Street, a major crosstown route for 21,000 vehicles a day that links the East and West Sides of Manhattan. It was New York's most ambitious stand yet against cars since the first pedestrian plazas were carved out of asphalt more than a decade ago. Roads that were once the exclusive domain of cars have been squeezed to make way for bike and bus-only lanes. Prime parking spots have been turned into urban green spaces. Traffic lights give pedestrians a head start crossing intersections. And making a vital artery nearly off limits to cars could be the beginning of a new wave of sweeping moves. "From now on, drivers are allowed onto 14th Street only to make deliveries and pick up and drop off passengers from 6 a.m. to 10 p.m., seven days a week," the report adds. "They can travel just a block or two before they have to turn right off the street. No left turns are allowed. The police will give out warnings at first and surveillance cameras will be watching."
Bitcoin

PayPal Withdraws Support For Facebook's Libra Cryptocurrency (theverge.com) 29

PayPal is withdrawing from the Libra Association, the 28-member nonprofit organization formed in June 2019 to oversee the cryptocurrency's creation and eventual consumer rollout. The Verge reports: The company doesn't cite a specific reason, saying only in a statement to The Verge that it decided "to forgo further participation in the Libra Association at this time and to continue to focus on advancing our existing mission and business priorities as we strive to democratize access to financial services for underserved populations." "We remain supportive of Libra's aspirations and look forward to continued dialogue on ways to work together in the future," the statement continues. "Facebook has been a longstanding and valued strategic partner to PayPal, and we will continue to partner with and support Facebook in various capacities."

However, a report published by the Financial Times yesterday said PayPal had begun distancing itself from the project amid increasing regulatory scrutiny. The company reportedly signaled its intention to skip a meeting in Washington, DC scheduled for today, and the FT reports that at least one primary concern for PayPal has been the lack of attention Facebook executives have paid to Libra's considerable backlash. Another key concern is how the platform will combat money laundering activity.

Facebook

Facebook Removes Hundreds of Propaganda Accounts Targeting Iran and Qatar (buzzfeednews.com) 18

According to BuzzFeed News, a network of websites and accounts have been using Facebook, Twitter, YouTube, and other social platforms to sow propaganda targeting Iran and Qatar. "The accounts, which have now been taken down, appear to have been professionally run by PR firms based in the Middle East and Africa," the report says. From the report: In August, Facebook announced the removal of more than 350 pages and accounts it said were engaged in coordinated inauthentic activity and operated by marketing firms in Egypt and the UAE. Now, after being contacted by BuzzFeed News about another network of pages, accounts, and websites connected to those it had previously removed, Facebook has announced additional takedowns, saying the accounts removed in August were, in fact, part of larger operations run by PR firms in UAE and Nigeria.

This follows a September announcement by Twitter that it had removed 241 additional accounts linked to Egypt and the UAE. It's now clear that these accounts were also connected to the larger operation uncovered by BuzzFeed News and targeted by Facebook today. In total, the company removed 211 Facebook accounts, 107 Facebook Pages, 43 Facebook Groups, and 87 Instagram accounts "for engaging in coordinated inauthentic behavior that originated in the UAE, Egypt and Nigeria," according to today's announcement. Additionally, 62 Twitter accounts and 12 YouTube accounts uncovered by BuzzFeed News were taken down. Facebook also announced today that it had removed accounts and pages connected to separate information operations stemming from Egypt and Indonesia.
Facebook's announcement says that the UAE-Nigeria network spent close to $150,000 promoting its content on Facebook, and attracted close to 1.4 million followers for the associated pages. The Instagram profiles were followed by nearly 70,000 people.

Slashdot Top Deals