An anonymous reader quotes a report from Ars Technica: About 200 million Internet-connected devices -- some that may be controlling elevators, medical equipment, and other mission-critical systems -- are vulnerable to attacks that give attackers complete control, researchers warned on Monday. In all, researchers with security firm Armis identified 11 vulnerabilities in various versions of VxWorks, a slimmed-down operating system that runs on more than 2 billion devices worldwide. Billed collectively as Urgent 11, the vulnerabilities consist of six remote code flaws and five less-severe issues that allow things like information leaks and denial-of-service attacks. None of the vulnerabilities affects the most recent version of VxWorks or any of the certified versions of the OS, including VxWorks 653 or VxWorks Cert Edition.

For the 200 million devices Armis estimated are running a version that's susceptible to a serious attack, however, the stakes may be high. Because many of the vulnerabilities reside in the networking stack known as IPnet, they can often be exploited by little more than boobytrapped packets sent from outside the Internet. Depending on the vulnerability, exploits may also be able to penetrate firewalls and other types of network defenses. The most dire scenarios are attacks that chain together multiple exploits that trigger the remote takeover of multiple devices. "Such vulnerabilities do not require any adaptations for the various devices using the network stack, making them exceptionally easy to spread," Armis researchers wrote in a technical overview. "In most operating systems, such fundamental vulnerabilities in the crucial networking stacks have become extinct, after years of scrutiny unravelled and mitigated such flaws." VxWorks-maker Wind River says the latest release of VxWorks "is not affected by the vulnerability, nor are any of Wind Rivers' safety-critical products that are designed for safety certification, such as VxWorks 653 and VxWorks Cert Edition used in critical infrastructure."

Wind River issued patches last month and is in the process of notifying affected customers of the threat.

With less than half a year to go before support ends for Windows 7, about three-quarters of computers in the UK's National Health Service (NHS) are still running the OS. From a report: Just over one million computers in the NHS are still using Windows 7, according to a written answer from the Department of Health and Social Care. Having so many machines still running Windows 7 is a problem, according to Jo Platt MP, shadow cabinet office minister, as the end of extended support in January 2020 will mean no more fixes and patches without a costly custom-support deal. "With less than six months before Windows 7 support expires, it is deeply concerning that over a million NHS computers, over three quarters of the total NHS IT estate, are still using this operating system," she says.

The Canadian government said on Wednesday it is investing C$85 million ($64.70 million) in an Ottawa-based satellite company as part of an effort to provide better broadband internet access to rural and remote communities. From a report: Innovation, Science and Economic Development Minister Navdeep Bains said the funding would be used by Telesat to build and test technologies that use low-earth-orbit (LEO) satellites to boost connectivity. "This new, space-based system will provide a dramatic and disruptive improvement over existing satellites," Telesat Chief Executive Officer Dan Goldberg said, adding that the technology will be affordable and reliable. LEO satellites operate 36 times closer to the earth than traditional telecommunications satellites. This means they take less time to send and receive information, leading to better and faster broadband service, even in rural, remote and northern areas.

Tesla car owners will soon be able to stream videos from Netflix and YouTube from the dashboard, CEO Elon Musk said. Musk wrote that the displays in cars will "soon" be able to stream YouTube and Netflix. The software feature that enables this support could arrive as soon as next month, he said in response to a tweet. The video streaming would only work when the car has stopped -- how Tesla currently handles video games playback. In another tweet, he said the dashboard would offer "an amazingly immersive, cinematic experience" because of the car's surround sound and chairs.

At least 200 law enforcement agencies around the country have entered into partnerships with Amazon's home surveillance company Ring, according to an email obtained by Motherboard via public record request. From a report: Ring has never disclosed the exact number of partnerships that it maintains with law enforcement. However, the company has partnered with at least 200 law enforcement agencies, according to notes taken by a police officer during a Ring webinar, which he emailed to himself in April. It's possible that the number of partnerships has changed since the day the email was sent. The officer who sent the email told Motherboard that the email was a transcribed version of handwritten notes that he took during a team webinar with a Ring representative on April 9. Additional emails obtained by Motherboard indicate that this webinar trained officers on how to use the "Law Enforcement Neighborhood Portal." This portal allows local police to see a map with the approximate locations of all Ring cameras in a neighborhood, and request footage directly from camera owners. Owners need to consent, but police do not need a warrant to ask for footage.

Companies around the world are still failing to see the benefits of implementing DMARC, an email security protocol designed to prevent email spoofing, the primary trick used by cybercriminals to deliver phishing emails and BEC scams. From a report: Around 79.7% don't use DMARC, according to a report that surveyed the DMARC policies deployed with 21,075 business and government domains. The survey, carried out by email security and analytics firm 250ok, analyzed domains from sectors such as Fortune 500, US government (Executive, Legislative and Judicial), the China Hot 100, the top 100 law firms, international nonprofits, the SaaS 1000, education, e-commerce, financial services, and travel sectors. The survey looked specifically at DMARC adoption because of the protocol's importance.

Authorities in the United Kingdom have made unauthorized copies of data stored inside a EU database for tracking undocumented migrants, missing people, stolen cars, or suspected criminals. From a report: Named the Schengen Information System (SIS), this is a EU-run database that stores information such as names, personal details, photographs, fingerprints, and arrest warrants for 500,000 non-EU citizens denied entry into Europe, over 100,000 missing people, and over 36,000 criminal suspects. The database was created for the sole purpose of helping EU countries manage access to the passport-free Schengen travel zone. The UK was granted access to this database in 2015, even if it's not an official member of the Schengen zone. Further reading: EU Votes To Create Gigantic Biometrics Database.

Lithium miners are bulking up for a booming future when electric cars go mainstream. But speed bumps loom, with prices tumbling on a burst of new production and demand growth slowing in China. From a report: Between mid-2015 and mid-2018, prices for lithium, the soft, silvery-white metal crucial for rechargeable batteries, almost tripled as the world's fleet of electric vehicles hit the 5 million mark, and the auto industry began to fret over the supply of raw materials. That sparked the opening of six lithium mines in Australia since 2017 as companies raced to gain from an evolving technology. But while the EV boom is coming, it isn't here yet. Sales growth is slowing in China, the top market, and the drive to fill the battery supply chain has cooled. The result: A 30% price plunge for lithium that's spurring concern over where the bottom may lie. "The latest EV data did reveal slowing growth, inferring that on top of excess supply, demand is now a problem," Vivienne Lloyd and other analysts at Macquarie Capital wrote in a report this month. "The key interest for investors should be who is likely to survive."

Craig Mod: I love fast software. That is, software speedy both in function and interface. Software with minimal to no lag between wanting to activate or manipulate something and the thing happening. Lightness. Software that's speedy usually means it's focused. Like a good tool, it often means that it's simple, but that's not necessarily true. Speed in software is probably the most valuable, least valued asset. To me, speedy software is the difference between an application smoothly integrating into your life, and one called upon with great reluctance. Fastness in software is like great margins in a book -- makes you smile without necessarily knowing why. [...]

Speed and reliability are often intuited hand-in-hand. Speed can be a good proxy for general engineering quality. If an application slows down on simple tasks, then it can mean the engineers aren't obsessive detail sticklers. Not always, but it can mean disastrous other issues lurk. I want all my craftspeople to stickle. I don't think Ulysses (a popular text editing application) is badly made, but I am less confident in it than if it handled input and interface speed with more grace. Speed would make me trust it more.

"A consumer privacy group has filed a challenge to Facebook's $5 billion settlement with the Federal Trade Commission, saying it is not 'adequate, reasonable or appropriate' and lets the social media giant off the hook for years of violations," reports the AP.

The Verge argues that the current consensus is "the FTC gave the company a slap on the wrist, and Facebook's latest earnings report showed the social network earning three times as much in revenue as the FTC fine in just three months." Now, EPIC wants to potentially force the agency to alter the terms of the deal to better address complaints filed by individuals and consumer groups. EPIC takes issue not just with the relatively low size of the fine, which, while the biggest ever for a tech company, is barely a drop in the bucket for the $571 billion company. The group is also upset with how Facebook effectively avoided culpability for its actions, as part of the settlement allowed the company to avoid admitting any guilt over massive privacy and data security scandals, like Cambridge Analytica, that landed it in hot water with the agency.

EPIC also wants a court to decide whether the FTC should have granted Facebook blanket immunity from past legal challenges and if the scope of the settlement can be broadened to include issues like Facebook's widespread use of facial recognition on users without their consent and violations of children's privacy.
EPIC complains that the deal would extinguish more than 26,000 consumer complaints against Facebook that are currently pending at the FTC.

To buy his favorite oatmeal, Gregory Kelly drives to a city 40 miles away rather than sharing his data with an online retailer, or purchasing it from the company's web site, "which he says is riddled with tracking software from Google," according to the Washington Post: "I'm just not sure why Google needs to know what breakfast cereal I eat," the 51-year-old said. Kelly is one of a hearty few who are taking the ultimate step to keep their files and online life safe from prying eyes: turning off Google entirely. That means eschewing some of the most popular services on the Web, including Gmail, Google search, Google Maps, the Chrome browser, Android mobile operating software and even YouTube. Such never-Googlers are pushing friends and family to give up the search and advertising titan, while others are taking to social media to get the word out. Online guides have sprouted up to help consumers untangle themselves from Google.

These intrepid Web users say they'd rather deal with daily inconveniences than give up more of their data. That means setting up permanent vacation responders on Gmail and telling friends to resend files or video links that don't require Google software. More than that, it takes a lot of discipline.
While there's no data on how many people are avoiding Google, the article points out that DuckDuckGo is now averaging 42.4 million searches every day -- up from 23.5 million a year ago.

But at least one Berkeley tech consultant acknowledged that "the improvement is mostly in the category of self-righteousness." Seeking an office software with better privacy protections, he's now paying $100 a year for a subscription to Microsoft Office 365.

Forbes contributor Kalev Leetaru argues that "the encryption debate is already over -- Facebook ended it earlier this year." The ability of encryption to shield a user's communications rests upon the assumption that the sender and recipient's devices are themselves secure, with the encrypted channel the only weak point... [But] Facebook announced earlier this year preliminary results from its efforts to move a global mass surveillance infrastructure directly onto users' devices where it can bypass the protections of end-to-end encryption. In Facebook's vision, the actual end-to-end encryption client itself such as WhatsApp will include embedded content moderation and blacklist filtering algorithms. These algorithms will be continually updated from a central cloud service, but will run locally on the user's device, scanning each cleartext message before it is sent and each encrypted message after it is decrypted. The company even noted that when it detects violations it will need to quietly stream a copy of the formerly encrypted content back to its central servers to analyze further, even if the user objects, acting as true wiretapping service...

If Facebook's model succeeds, it will only be a matter of time before device manufacturers and mobile operating system developers embed similar tools directly into devices themselves, making them impossible to escape... Governments would soon use lawful court orders to require companies to build in custom filters of content they are concerned about and automatically notify them of violations, including sending a copy of the offending content. Rather than grappling with how to defeat encryption, governments will simply be able to harness social media companies to perform their mass surveillance for them, sending them real-time alerts and copies of the decrypted content.

Putting this all together, the sad reality of the encryption debate is that after 30 years it is finally over: dead at the hands of Facebook. If the company's new on-device content moderation succeeds it will usher in the end of consumer end-to-end encryption and create a framework for governments to outsource their mass surveillance directly to social media companies, completely bypassing encryption.

In the end, encryption's days are numbered and the world has Facebook to thank.

UPDATE: 8/2/2019 Will Cathcart, WhatsApp's vice president of product management, took to the internet with this forceful response. "We haven't added a backdoor to WhatsApp. To be crystal clear, we have not done this, have zero plans to do so, and if we ever did, it would be quite obvious and detectable that we had done it. We understand the serious concerns this type of approach would raise, which is why we are opposed to it."

An activism director and a legislative analyst at the EFF have co-authored an essay arguing that the key to children's safetly online "is user empowerment, not censorship," reporting on a recent hearing by the U.S. Senate's Judiciary Commitee: While children do face problems online, some committee members seemed bent on using those problems as an excuse to censor the Internet and undermine the legal protections for free expression that we all rely on, including kids. Don't censor users; empower them to choose... [W]hen lawmakers give online platforms the impossible task of ensuring that every post meets a certain standard, those companies have little choice but to over-censor.

During the hearing, Stephen Balkam of the Family Online Safety Institute provided an astute counterpoint to the calls for a more highly filtered Internet, calling to move the discussion "from protection to empowerment." In other words, tech companies ought to give users more control over their online experience rather than forcing all of their users into an increasingly sanitized web. We agree.

It's foolish to think that one set of standards would be appropriate for all children, let alone all Internet users. But today, social media companies frequently make censorship decisions that affect everyone. Instead, companies should empower users to make their own decisions about what they see online by letting them calibrate and customize the content filtering methods those companies use. Furthermore, tech and media companies shouldn't abuse copyright and other laws to prevent third parties from offering customization options to people who want them.
The essay also argues that Congress "should closely examine companies whose business models rely on collecting, using, and selling children's personal information..."

"We've highlighted numerous examples of students effectively being forced to share data with Google through the free or low-cost cloud services and Chromebooks it provides to cash-strapped schools. We filed a complaint with the FTC in 2015 asking it to investigate Google's student data practices, but the agency never responded."

Facebook cofounder Chris Hughes isn't just idly wondering if regulators might break up the tech behemoth he helped launch. He's going on a personal tour, meeting with state and federal officials to lay out in detail the way he thinks it could be done.

Hughes has met with members of Congress, the Justice Department's Antitrust Division, the Federal Trade Commission, and the office of New York Attorney General Letitia James to make a detailed case arguing Facebook is too big for its own good, according to separate reports from The Washington Post and The New York Times. The breakup tour went public in May, when Hughes penned a lengthy op-ed in The New York Times saying his former colleague Mark Zuckerberg wielded too much power. "I'm disappointed in myself and the early Facebook team for not thinking more about how the News Feed algorithm could change our culture, influence elections and empower nationalist leaders," Hughes wrote at the time. "And I'm worried that Mark has surrounded himself with a team that reinforces his beliefs instead of challenging them."

Tech and antitrust law experts Scott Hemphill and Tim Wu had already been working on a detailed case against Facebook, and they reached out to Hughes following his public turn. The trio now work together to make their case.
They're now arguing that Facebook's "serial defensive acquisitions" are preventing competition. The article points out Facebook has acquired more than 75 smaller companies over the last 15 years, and cites one negotiator who told the Economist that "Big tech firms have been known to intimidate startups into agreeing to a sale..."

The New Yorker reviews linguist Gretchen McCulloch new book Because Internet: Understanding the New Rules of Language For McCulloch, the primary feat of the digital writer has been to enlist typography to convey tone of voice. We've used technology to "restore our bodies to writing": to infuse language with extra-textual meaning, in the same way that we might wave our hands during a conversation. One general principle is that communication leans toward the efficient, so any extra markings (sarcastic tildes, for instance, or a period where a line break will do) telegraph that there's more to the message than its literal import. That's how the period, in text messaging, earned its passive-aggressive reputation, and why so many visual flourishes default to implying irony. Similarly, the expressive lengthening of words like "yayyyy" or "nooo" confers a friendly intimacy, and technical marks (like the forward slash that ends a command in a line of code) find new life as social in-jokes ("/rant"). Typography, McCulloch writes, does not simply conjure the author's mood. It instructs the reader about the purpose of the statement by gesturing toward the spirit in which the statement was conceived.

McCulloch's project is, at heart, a corrective: she wants to puncture the belief that the Internet de-civilizes discourse. She brandishes research that shows that we become more polite as we get better at typing. (As with online irony, online civility emerges from linguistic superfluity, the perception that an extra effort has been made, whether through hedges, honorifics, or more over-all words....) Through gifs, emojis, and the playful repurposing of standard punctuation, McCulloch insists, Internet natives are bringing an unprecedented delicacy and nuance to bear on their prose. To back up this (strong) claim, the book proposes that the Internet's informal English actually draws from a variety of registers, using tools old and new to create finely calibrated washes of meaning. Considering a real text from a teen-ager's phone -- "aaaaaaaaagh the show tonight shall rock some serious jam" -- McCulloch highlights the archaic "shall" next to the casual "aaaaaaaaagh." Such intermixing, she argues, makes Internet-ese "a distinct genre with its own goals. . . . to accomplish those goals successfully requires subtly tuned awareness of the full spectrum of the language..."

"We no longer accept," she writes, "that nuanced writing is the exclusive domain of professionals...." Her book's almost political thesis -- the more voices, the better -- rebukes both the elitism of traditional grammar snobs and the cliquishness of, say, Tumblr. It's a vision of language as one way to make room for one another.
`

"The upcoming version of the Android operating system is taking a strong focus on privacy," reports SD Times, "but the Electronic Frontier Foundation (EFF) believes it could still do better." Android Q's new privacy features include: user control over app access to device location, new limits on access to files in shared external storage, restrictions on launching activities, and restrictions on access to the device's hardware and sensors... "However, in at least one area, Q's improvements are undermined by Android's continued support of a feature that allows third-party advertisers, including Google itself, to track users across apps," Bennett Cyphers, engineer for the EFF, wrote in a post. "Furthermore, Android still doesn't let users control their apps' access to the Internet, a basic permission that would address a wide range of privacy concerns."

According to Cyphers, while Android Q has new restrictions on non-resettable device identifies, it will allow unrestricted access for its own tracking identifier [called "advertising ID"]... "Facebook and other targeting companies allow businesses to upload lists of ad IDs that they have collected in order to target those users on other platforms," he wrote... "On Android, there is no way for the user to control which apps can access the ID, and no way to turn it off. While we support Google taking steps to protect other hardware identifiers from unnecessary access, its continued support of the advertising ID -- a "feature" designed solely to support tracking -- undercuts the company's public commitment to privacy," he wrote...

Cypher also noted that while Apple's iOS has similar identifiers for advertisers that contradict with its privacy campaign, it does enable users to turn off the tracking.
In fact, Android Q also ships with an "opt out of ad personalization" checkbox where users can indicate that they don't want Google's identifier to track them, Cyphers reports -- but "the checkbox doesn't affect the ad ID in any way.

"It only encodes the user's 'preference', so that when an app asks Android whether a user wants to be tracked, the operating system can reply 'no, actually they don't.' Google's terms tell developers to respect this setting, but Android provides no technical safeguards to enforce this policy."

Boeing's 737 Max was built with "effectively neutered" oversight, writes the New York Times, citing interviews with over a dozen current and former employees at America's Federal Aviation Agency.

Their damning conclusion? The agency "had never independently assessed the risks of the dangerous software known as MCAS when they approved the plane in 2017." The regulator had been passing off routine tasks to manufacturers for years, with the goal of freeing up specialists to focus on the most important safety concerns. But on the Max, the regulator handed nearly complete control to Boeing, leaving some key agency officials in the dark about important systems like MCAS, according to the current and former employees...The company performed its own assessments of the system, which were not stress-tested by the regulator.

Turnover at the agency left two relatively inexperienced engineers overseeing Boeing's early work on the system. The F.A.A. eventually handed over responsibility for approval of MCAS to the manufacturer. After that, Boeing didn't have to share the details of the system with the two agency engineers...

Late in the development of the Max, Boeing decided to expand the use of MCAS, to ensure the plane flew smoothly. The new, riskier version relied on a single sensor and could push down the nose of the plane by a much larger amount. Boeing did not submit a formal review of MCAS after the overhaul. It wasn't required by F.A.A. rules... The agency ultimately certified the jet as safe, required little training for pilots and allowed the plane to keep flying until a second deadly Max crash, less than five months after the first.... By 2018, the F.A.A. was letting the company certify 96 percent of its own work, according to an agency official.
The article ends by describing the days after the first 737 Max crash, when Boeing executives visited the regulatory agency's headquarters in Seattle.

"The officials sat incredulous as Boeing executives explained details about the system that they didn't know."

"Google is giving Chrome extension makers until October 15 to minimize the amount of data they collect during browser sessions or face expulsion from the Chrome Web Store," reports PC Magazine: The change addresses how the extensions generally need to request certain permissions from your browser in order to function. However, some of these permissions can be pretty powerful; they can include the ability to take desktop screenshots, capture audio from a microphone, and collect data from the local file system, among other things, which can open the door to potential abuse.

The risks prompted Google to work toward securing the 180,000+ Chrome extensions on the company's official web store. "We're requiring extensions to only request access to the least amount of data," the company said in a Tuesday blog post. "While this has previously been encouraged of developers, now we're making this a requirement for all extensions."

An anonymous reader quotes Vice: In May, Microsoft released a patch for a bug in several versions of Windows that is so bad that the company felt it even had to release a fix for Windows XP, an operating system that (has been unsupported) for five years. That vulnerability is known as BlueKeep, and it has kept a lot of security researchers up at night. They are worried that someone could write an exploit for it and make a worm that could wreak havoc the way WannaCry or NotPetya -- two viruses that spread almost uncontrollably all over the world locking thousands of computers -- did.... Researchers were so worried about this vulnerability that for months, no one has published the code for a proof-of-concept exploit. In other words, no one wanted to be the guy to even prove that this type of malware was even possible to write.

Until now.

On Tuesday, Immunity, a long time US government contractor, announced that it had developed an exploit for BlueKeep and included it into its penetration testing toolkit Canvas, which is available only to paying subscribers. Canvas customers, can now exploit this bug using Immunity's own code.
ZDNet notes that Canvas licenses "cost between thousands and tens of thousands of US dollars," but also adds that "hackers have been known to pirate or legitimately buy penetration testing tools."

New research from the USC Viterbi School of Engineering could be key to our understanding of how the aging process works. The findings potentially pave the way for better cancer treatments and revolutionary new drugs that could vastly improve human health in the twilight years. ScienceDaily reports: "To drink from the fountain of youth, you have to figure out where the fountain of youth is, and understand what the fountain of youth is doing," said Nick Graham, Assistant Professor of Chemical Engineering and Materials Science. "We're doing the opposite; we're trying to study the reasons cells age, so that we might be able to design treatments for better aging." To achieve this, lead author Alireza Delfarah, a graduate student in the Graham lab, focused on senescence, a natural process in which cells permanently stop creating new cells. This process is one of the key causes of age-related decline, manifesting in diseases such as arthritis, osteoporosis and heart disease.

The research team discovered that the aging, senescent cells stopped producing a class of chemicals called nucleotides, which are the building blocks of DNA. When they took young cells and forced them to stop producing nucleotides, they became senescent, or aged. "This means that the production of nucleotides is essential to keep cells young," Delfarah said. "It also means that if we could prevent cells from losing nucleotide synthesis, the cells might age more slowly." Graham said that the team's research has applications in the emerging field of senolytics, the development of drugs that may be able to eliminate aging cells. He said that human clinical trials are still in early stages, but studies with mice have shown that by eliminating senescent cells, mice age better, with a more productive life span. The study has been published in the Journal of Biological Chemistry.