Netflix Hangouts is a new Chrome extension that tries to make it easier to get away with watching Netflix while you're supposed to be working. Just go to the show you want to catch up on during work hours, and press the extension's icon in your Chrome menu to bring up a fake four-person conference call. Then you can sit back and watch the show in the window's bottom right feed while three fake colleagues get down to business. The Verge reports: The extension was developed by Mschf Internet Studios, which has produced a few internet curiosities like this over the years. There was the Slack channel that offered $1,000 in prize money for the first person to correctly guess each word of the day (it was shut down by Slack after just a week), a man who ate various foods as disgusting ice cream toppings, and who could forget Tabagotchi, the lovable virtual avatar that slowly died as you opened more and more tabs? Netflix Hangouts is the latest in a long line of services designed to let you slack off at work.

In an effort to curb cyber bullying, Instagram is rolling out a new AI feature that will automatically detect whether comments are offensive and notify users before they are posted. The Hill reports: In an example included in the company release, Instagram shows a user trying to comment "You are so ugly and stupid." Instagram follows up with a message asking the user "Are you sure you want to post this?" with an "undo" button. "From early tests of this feature, we have found that it encourages some people to undo their comment and share something less hurtful once they have had a chance to reflect," Instagram said.

To further help protect users from unwanted interactions, Instagram said it will start testing a new "restrict" feature. Restricting a user will make it so the user's comments are only visible to that person; a user will be able to choose whether or not to make that the restricted person's comments available to others by approving them. Restricted users also will not be able to see when an account is active or when a person has read their direct messages.

An anonymous reader quotes a report from The Wall Street Journal: Tesco, one of the world's largest supermarket operators, is one of several grocers testing cashierless stores with cameras that track what shoppers pick (Warning: source paywalled; alternative source), so they pay by simply walking out the door. The retailers hope the technology -- similar to that pioneered by Amazon.com Inc. in its Amazon Go stores in the U.S. -- will allow them to cut costs and alleviate lines as they face an evolving threat from the e-commerce giant.

Tesco plans to open its self-styled "pick and go" or "frictionless shopping" store to the public next year after testing with employees. Eventually it wants to use the technology, developed by Israeli startup Trigo Vision, in more of its smaller grocery stores. Tesco's 4,000-square-foot test store uses 150 ceiling-mounted cameras to generate a three-dimensional view of products as they are taken off shelves. In its recent demo, Tesco's system detected shoppers as they walked around the store. It also identified a group of products when a person holding them stood in front of a screen, tallying up their total price. Tesco is considering identifying shoppers through an app or loyalty card when they enter the store and then charging their app when they leave. Tesco told investors its method costs one-tenth of systems used by its competitors, partly because it only uses cameras. Amazon Go uses cameras and sensors to track what shoppers pick. Amazon customers scan a QR code at a gate when they enter a store, then walk out when finished. While Tesco will track the movements of their customers, the company says the system used in its trial doesn't recognize faces.

Facebook has built tools to track posts on Facebook and WhatsApp that talk about its executives, products, or moves Bloomberg reported on Monday. The company has been, for years, routinely using these tools to "snuff out" posts that it deems to offer untrue characterization of its services or people. From the report: Many companies monitor social media to learn what customers are saying about them. But Facebook's position is unique. It owns the platform it's watching, an advantage that may help Facebook track and reach users more effectively than other firms. And Facebook has been saddled with so many real problems recently that sometimes misinformation can stick. Stormchaser is just one of multiple tools Facebook has deployed to manage its reputation, which has taken a dramatic hit thanks to its role in spreading Russian misinformation during the U.S. election and numerous privacy scandals. The company employs hundreds of public relations officials and spent $13 million on government lobbying in 2018. Zuckerberg and Facebook Chief Operating Officer Sheryl Sandberg have become so intertwined with the company's image that Facebook routinely collects public survey data to understand how the general public views them -- data that shapes what the executives say and do publicly. Facebook's response: "We didn't use this internal tool to fight false news because that wasn't what it was built for, and it wouldn't have worked," the spokeswoman wrote in an email. "The tool was built with simple technology that helped us detect posts about Facebook based on keywords, so we could consider whether to respond to product confusion on our own platform. Comparing the two is a false equivalence." The New York Times' tech columnist Kevin Roose, writes: You could write a dissertation about this quote, and the difference between what Facebook considers "product confusion" (wrong stuff about us, which must be removed immediately) and "false news" (wrong stuff about other people, which is protected free speech).

Mike Davidson: It took an article I almost didn't publish and tens of thousands of people saying they were creeped out, but Superhuman admitted they were wrong and reduced the danger that their surveillance pixels introduce. Good on Rahul Vohra and team for that. I will say, however, that I'm a little surprised how quickly some people are rolling over and giving Superhuman credit for fixing a problem that they didn't actually fix. [...] Let's take a look at how Superhuman [an email app that charges users $30 a month] explains their changes.

Rahul correctly lays out four of the criticisms leveled at Superhuman's read receipts: Location data could be used in nefarious ways. Read statuses are on by default. Recipients of emails cannot opt out. Superhuman users cannot disable remote image loading. However, he also omits the core criticism: Recipients of Superhuman emails do not know their actions are being tracked or sent back to senders. Superhuman said it was keeping the read status feature, but turning it off by default. Users who want it will have to explicitly turn it on. Mike adds: This addresses the concern about teaching customers to surveil by default but also establishes that Superhuman is keeping the feature working almost exactly as-is, with the exception of not collecting or displaying actual locations. I've spoken with several people about how they interpreted Rahul's post on this particular detail. Some believed the whole log of timestamped read events was going away and were happy about that. Others read it as: you can still see exactly when and how many times someone has opened your email, complete with multiple timestamps -- you just can't see the location anymore. That, to me, is not sufficient. "A little less creepy" is still creepy. Also worth noting, "turning receipts off by default" does nothing to educate customers about the undisclosed surveillance they are enabling if they flip that switch.

Microsoft has released a public preview of a new service aimed at helping businesses assess their app-compatibility levels ahead of deploying new Windows 10 feature updates. From a report: It allows for the quick and easy creation of app inventories to make compatibility checks simpler. Brad Anderson, corporate vice president for Microsoft 365, says that the tool makes use of machine learning and the cloud to make it easier to deploy and update Windows 10. The aim with Desktop Analytics is to avoid the compatibility problems that stand in the way of keeping machines up to date.

The Microsoft security team has issued a warning today about ongoing malware campaigns that are distributing the Astaroth malware using fileless and living-off-the-land techniques that make it harder for traditional antivirus solutions to spot the ongoing attacks. From a report: The attacks were detected by the team behind Windows Defender ATP, the commercial version of the company's Windows Defender free antivirus. Andrea Lelli, a member of the Windows Defender ATP team said alarms bells sounded at Microsoft's offices when they detected a huge and sudden spike in usage of the Windows Management Instrumentation Command-line (WMIC) tool. This is a legitimate tool that ships with all modern versions of Windows, but the sudden spike in usage suggested a pattern specific to malware campaigns. When Microsoft looked closer, it discovered a malware campaign that consisted of a massive spam operation that was sending out emails with a link to a website hosting a .LNK shortcut file.

Federal Communications Commission Chairman Ajit Pai has proposed another set of robocall rules, this time to ban malicious calls that spoof caller IDs in text messages and international calls. From a report: The anti-spoofing rules will be voted on by the FCC Aug. 1, and they already have the support of more than 40 state attorneys general, Pai said Monday. These new rules would close the loopholes in targeting international callers, including one-way interconnected VoIP calls, and scammers using text messaging. They are part of the FCC's "multi-pronged approach to battle the noxious intrusion of illegal robocalls, as well as malicious caller ID spoofing," Pai said. Last month, the FCC voted unanimously on a proposal to give mobile phone companies greater power to "aggressively block" unwanted robocalls.

News blog TorrentFreak spoke with a member of piracy group "The Scene" to understand how they obtain -- or rip -- movies and shows from sources such as Netflix and Amazon Prime Video. The technique these people use is different from hardware capture cards or software-based 'capping' tools. From the report: "Content for WEB releases are obtained by downloading the source content. Whenever you stream a video online, you are downloading chunks of a video file to your computer. Sceners simply save that content and attempt to decrypt it for non-DRM playback later," the source said. When accessing the content, legitimate premium accounts are used, often paid for using prepaid credit cards supported by bogus identities. It takes just a few minutes to download a video file since they're served by CDNs with gigabits of bandwidth.

"Once files are downloaded from the streaming platform, however, they are encrypted in the .mp4 container. Attempting to view such video will usually result in a blank screen and nothing else -- streams from these sites are protected by DRM. The most common, and hard to crack DRM is called Widevine. The way the Scene handles WEB-releases is by using specialized tools coded by The Scene, for The Scene. These tools are extremely private, and only a handful of people in the world have access to the latest version(s)," source noted. "Without these tools, releasing Widevine content is extremely difficult, if not impossible for most. The tools work by downloading the encrypted video stream from the streaming site, and reverse engineering the encryption." Our contact says that decryption is a surprisingly quick process, taking just a few minutes. After starting with a large raw file, the finalized version ready for release is around 30% smaller, around 7GB for a 1080p file.

Mozilla is funding a project for bringing the Julia programming language to Firefox and the general browser environment. From a report: The project received funding part of the Mozilla Research Grants for the first half of 2019, which the browser maker announced on Friday. In April, when Mozilla opened this year's submissions period for research grants, the organization said it was looking for a way to bring data science and scientific computing tools to the web. It said it was specifically interested in receiving submissions about supporting R or Julia at the browser level. Both R and Julia are programming languages designed for high-performance numerical, statistical, and computational science.

Mozilla engineers have worked in previous years to port data science tools at the browser level, as part of Project Iodide. Previously, as part of this project, Mozilla engineers ported the Python interpreter to run in the browser using WebAssembly. "This project, Pyodide, has demonstrated the practicality of running language interpreters in WebAssembly," Mozilla engineers said.

An anonymous reader shares a report: Permissions on Android apps are intended to be gatekeepers for how much data your device gives up. If you don't want a flashlight app to be able to read through your call logs, you should be able to deny that access. But even when you say no, many apps find a way around: Researchers discovered more than 1,000 apps that skirted restrictions, allowing them to gather precise geolocation data and phone identifiers behind your back. The discovery highlights how difficult it is to stay private online, particularly if you're attached to your phones and mobile apps. Tech companies have mountains of personal data on millions of people, including where they've been, who they're friends with and what they're interested in.

Lawmakers are attempting to reel that in with privacy regulation, and app permissions are supposed to control what data you give up. Apple and Google have released new features to improve people's privacy, but apps continue to find hidden ways to get around these protections. Researchers from the International Computer Science Institute found up to 1,325 Android apps that were gathering data from devices even after people explicitly denied them permission. Serge Egelman, director of usable security and privacy research at the ICSI, presented the study in late June at the Federal Trade Commission's PrivacyCon.

Some think automated radio emails are mucking up the spectrum reserved for amateur radio, while others say these new offerings provide a useful service. Wave723 writes: Like many amateur radio fans his age, Ron Kolarik, 71, still recalls the "pure magic" of his first ham experience nearly 60 years ago. Lately, though, encrypted messages have begun to infiltrate the amateur bands in ways that he says are antithetical to the spirit of this beloved hobby. So Kolarik filed a petition, RM-11831 [PDF], to the U.S. Federal Communications Commission (FCC) proposing a rule change to "Reduce Interference and Add Transparency to Digital Data Communications." And as the proposal makes its way through the FCC's process, it has stirred up heated debate that goes straight to the heart of what ham radio is, and ought to be. The core questions: Should amateur radio -- and its precious spectrum -- be protected purely as a hobby, or is it a utility that delivers data traffic? Or is it both? And who gets to decide?

Since Kolarik filed his petition in late 2018, this debate has engulfed the ham world. Fierce defenders of both sides have filed passionate letters and comments to the FCC arguing their cases. On one side is Kolarik in Nebraska. In his view, it's all rather simple: "Transparency is a core part of ham radio," he says. "And yet, you can find tons of traffic from automatic[ally controlled digital] stations that are extremely difficult to identify, if you can identify them at all, and they cause interference." The automatically controlled digital stations (ACDS) Kolarik refers to can serve to power services like Winlink, a "global radio email" system. Overseen and operated by licensed volunteers around the globe, Winlink is funded and guided by the Amateur Radio Safety Foundation, Inc. (ARSFI). The service uses amateur and government radio frequencies around the globe to send email messages by radio. Users initiate the transmission through an Internet connection, or go Internet-free and use smart-network radio relays.

On Winlink's website, the service says it provides its licensed users the ability to send email with attachments, plus messages about their positions, and weather and information bulletins. Representatives of the service say it also allows users to participate in emergency and disaster relief communications. But Kolarik's petition argues two points: First, because such messages "are not readily and freely able to be decoded," the FCC should require all digital codes to use protocols that "can be monitored in entirety by third parties with freely available, open-source software." Secondly, he wants the rule change to reduce the interference that he says services like Winlink can create between amateur-to-amateur stations -- by relegating the often-unattended automatic stations to operate solely on narrower sub-bands. Loring Kutchins, the president of ARSFI, says he believes Kolarik's petition is "well intentioned in its basis. But the fundamental conflict is between people who believe amateur radio is about hobby, not about utility. But nowhere do the FCC rules use the word 'hobby.'"

AmiMoJo writes: British Airways is facing a record fine of 183m Pound ($230m) for last year's breach of its security systems. The Information Commissioner's Office said the incident took place after users of British Airways' website were diverted to a fraudulent site. Through this false site, details of around 500,000 customers were harvested by the attackers. The BA penalty amounts to 1.5% of its worldwide turnover in 2017, less than the possible maximum of 4%. The fine amounts to around 10% of BA's profits for that year.

An excerpt from a post on Trail of Bits: From major open source projects to exciting new proprietary software, we've seen it all. But one common denominator in all of these systems is that for some inexplicable reason people still seem to think RSA is a good cryptosystem to use. Let me save you a bit of time and money and just say outright -- if you come to us with a codebase that uses RSA, you will be paying for the hour of time required for us to explain why you should stop using it. RSA is an intrinsically fragile cryptosystem containing countless foot-guns which the average software engineer cannot be expected to avoid. Weak parameters can be difficult, if not impossible, to check, and its poor performance compels developers to take risky shortcuts. Even worse, padding oracle attacks remain rampant 20 years after they were discovered. While it may be theoretically possible to implement RSA correctly, decades of devastating attacks have proven that such a feat may be unachievable in practice.

The New York Times ran a disturbing opinion piece about Google by the founder of search engine marketing consulting firm Berlin SEM. In it he discusses counter-messaging ads offering "redirection", where marketers "swerve your monetizable desperation. But we can also swerve something bigger: your beliefs, convictions and ideology." There are advertisers in the digital marketing industry who want to find out how effective this new form of social engineering is. One of those advertisers is Google. Redirect Method was a Google-incubated project that used redirect ads to deradicalize would-be extremists. In the first eight weeks of 2016, some 320,000 people -- all of whom were believed to harbor sympathy toward the Islamic State -- clicked on ads designed to reflect an interest in extremist content. Instead of arriving at a page that supported their views, Islamic State sympathizers who clicked the ads found themselves directed to a playlist of videos debunking the terror group's recruitment narratives. Most of the visitors stuck around. Together, they watched more than half a million minutes of video.

After the ISIS campaign ended, Google left behind a blueprint.

The blueprint shows, step by step, how you can create your own redirect ads to sway any belief or opinion -- held by any Google user, anywhere in the world -- of your choice. You don't have to be a marketer with years of experience to do this. You just need to follow the instructions and put up a credit card (a few hundred bucks will suffice). Recently, I followed the blueprint and created a redirect campaign of my own... The goal of my first redirect campaign was to sway the ideology of suicidal people.
Nearly one in three apparently suicidal searchers who viewed his ad then dialed his hotline number -- which then forwarded the calls to the National Suicide Prevention Lifeline. But he expressed surprise that Google "let me run the ads with no issue... I didn't need qualifications to be a conduit of peoples' fates." He later tried creating another campaign for prospective school shooters, "but the conversion rates were low. These prospective shooters were reluctant to speak with someone."

Yet one study found that more than 50% of people using Google couldn't distinguish between ads and "organic" results on Google [see page 151] -- and with this experiment, that raises a very important issue. "With the ISIS campaign, Google decided what a radical view was, who seemed to hold those views and who should be able to view them. It's hard to be cynical about an initiative that deters extremism.

"But entering the domain of social engineering is a slippery slope. The standard of what needs to be deradicalized is adjustable..."

TMZ accosted 68-year-old Steve Wozniak at an airport, according to an article shared by a Slashdot reader. TMZ asked Wozniak for his thoughts on whether our devices are listening to us -- and if we're trying to have private conversations, should we be worried?

"I'm worried about everything," Wozniak replied. "I don't think we can stop it, though." But, everything about you -- I mean, they can measure your heartbeat with lasers now, they can listen to you with a lot of devices. Who knows if my cellphone's listening right now. Alexa has already been in the news a lot.

So, I worry, because you're having conversations that you think are private... You're saying words that really shouldn't be listened to, because you don't expect it. But there's almost no way to stop it. People think they have a level of privacy they don't. Why don't they give me a choice? Let me pay a certain amount, and you'll keep my data more secure and private then everybody else handing it to advertisers.
Wozniak was also asked if we should "get rid of Facebook and Instagram..." His reply?

"There are many different kinds of people, and some the benefits of Facebook are worth the loss of privacy. But to many like myself, my recommendation is -- to most people -- you should figure out a way to get off Facebook."

"Steve knows what he's talking about," explains TMZ's write-up of their conversation, adding that "the dude co-founded Apple, and he's very much plugged into Silicon Valley and all aspects of tech."

"Windows 10 continues to be a danger zone," writes Forbes senior contributor Gordon Kelly: Not only have problems been piling up in recent weeks, Microsoft has also been worryingly deceptive about the operation of key services. And now the company has warned millions about another problem. Spotted by the always excellent Windows Latest, Microsoft has told tens of millions of Windows 10 users that the latest KB4501375 update may break the platform's Remote Access Connection Manager (RASMAN). And this can have serious repercussions.

The big one is VPNs. RASMAN handles how Windows 10 connects to the internet and it is a core background task for VPN services to function normally. Given the astonishing growth in VPN usage for everything from online privacy and important work tasks to unlocking Netflix and YouTube libraries, this has the potential to impact heavily on how you use your computer. Interestingly, in detailing the issue Microsoft states that it only affects Windows 10 1903 - the latest version of the platform.

The problem is Windows 10 1903 accounts for a conservative total of at least 50M users.
Microsoft estimates they'll have a solution available "in late July," adding that the issue only occurs "when a VPN profile is configured as an Always On VPN (AOVPN) connection with or without device tunnel. This does not affect manual only VPN profiles or connections." That support page also offers a work-around which involves configuring the default telemetry settings in either the group policy settings or with a registry value.

UPDATE (7/7/2019): ZDNet is strongly criticizing Forbes' article, arguing that the issue affects only a small number of Windows users, "when the diagnostic data level setting is manually configured to the non-default setting of 0." For those who don't understand how unusual that configuration is, note that it applies only to Windows 10 Enterprise and that it can be set only using Group Policy on corporate networks or by manually editing the registry. You can't accidentally enable this setting. And you can't deliberately set it on a system running Windows 10 Home or Pro, because it is for Enterprise edition only.

"Staffers challenge Facebook's happy talk about its digital currency in a briefing," reports the American Prospect, introducing a new article in a series written anonymously by Congressional staffers, this time a House Democratic aide "who attended a briefing last Thursday with executives who are developing Libra..."

"Such briefings are commonplace to convince staffers who write legislation (and by association the members they serve) of the righteousness of corporate causes." The briefing was fascinating. The lead representative, the head of policy for Libra, kicked it off by admitting that the whole endeavor required a "suspension of disbelief." They were asked about the timeline, and said they hoped to have Libra operational in about a year, which they kept suggesting was a prolonged timeline, but didn't seem lengthy to anyone in the room.

They kept selling Libra as a means of providing banking services to 1.7 billion unbanked people around the world. When challenged on how they were going to do that, and asked directly whether they'd figure out how exactly a digital currency would be an answer for people who can't access credit currently, they said, "The short answer is no." The phrase "the miracle of blockchain" was used at one point...

Because Facebook is proposing to take over a role traditionally under the purview of central banks, not private companies, we should expect the skepticism we heard in the room from staffers to be publicly aired by House Financial Services Committee members on July 17.

"KLM Royal Dutch Airlines has an unusual message for its customers: Maybe don't take that flight," reports Quartz: In a June 29 open letter from its CEO, Pieter Elbers, the airline invited air travelers to make "responsible decisions about flying," and encouraged customers to invest in the airline's carbon offsetting scheme, CO2ZERO... It's all part of KLM's new "Fly Responsibly" campaign, which includes a website with information on its commitment to sustainable fuel and practices. A short video poses three questions to customers: Do meetings always have to take place face-to-face? Could you take the train instead? And could you contribute by compensating your CO2 emissions or packing light? "We all have to fly every now and again," it concludes. "But next time, think about flying responsibly..."

Environmentally conscious customers, especially in Europe, are increasingly opting out of flying, which contributes about 2.5% of global emissions. (Few personal actions are quite so harmful for the environment.)
The article also notes that planes with more business and first-class seats "have a greater carbon footprint, relative to the number of people they are able to transport" -- and that by that standard, KLM is already one of the most fuel-efficient airlines in the world.

Design firm Baggar writes: A user assumes certain actions to be in a certain place or color because interface designers worldwide have been collaboratively educating users and feeding them these design-patterns. But what happens if we poke all good practice with a stick and stir it up? What if we don't respect our self-created rules and expectations, and do everything the other way around?

That's exactly why we created User Inyerface: An interface that expects you to do the hard work instead of doing it for you. We created a simple interface, that isn't your friend. An interface that doesn't want to please you. An interface that has no clue and no rules.

The task is simple: complete the forms as fast as you can. It might suck the life out of you, but it is possible if you simply look and forget everything you have grown accustomed to.
Ars Technica collected some screenshots of their favorite screens, calling it "a hilariously and deliberately difficult-to-use website created to show just how much we rely on past habits and design conventions to interact with the Web... a gauntlet of nearly impossible-to-parse interactions that are as funny as they are infuriating."

At one point, the site gave me a warning that my chosen password "was not unsafe."