By making programming more mathematical, a community of computer scientists is hoping to eliminate the coding bugs that can open doors to hackers, spill digital secrets and generally plague modern society. From a report: Now a set of computer scientists has taken a major step toward this goal with the release today of EverCrypt, a set of digital cryptography tools. The researchers were able to prove -- in the sense that you can prove the Pythagorean theorem -- that their approach to online security is completely invulnerable to the main types of hacking attacks that have felled other programs in the past. "When we say proof, we mean we prove that our code can't suffer these kinds of attacks," said Karthik Bhargavan, a computer scientist at Inria in Paris who worked on EverCrypt.

EverCrypt was not written the way most code is written. Ordinarily, a team of programmers creates software that they hope will satisfy certain objectives. Once they finish, they test the code. If it accomplishes the objectives without showing any unwanted behavior, the programmers conclude that the software does what it's supposed to do. Yet coding errors often manifest only in extreme "corner cases" -- a perfect storm of unlikely events that reveals a critical vulnerability. Many of the most damaging hacking attacks in recent years have exploited just such corner cases.

A Fairfax County judge on Monday ordered the Fairfax County police to stop maintaining a database of photos of vehicle license plates, with the time and location where they were snapped, ruling that "passive use" of data from automated license plate readers on the back of patrol cars violates Virginia privacy law. From a report: The ruling followed a related finding by the Virginia Supreme Court last year, meaning the case could affect how long -- if at all -- Virginia police can keep license plate data. The ruling by Fairfax Circuit Court Judge Robert J. Smith is a victory for privacy rights advocates who argued that the police could track a person's movements by compiling the times and exact locations of a car anytime its plate was captured by a license plate reader. Fairfax County Police Chief Edwin C. Roessler Jr. said Monday night that he would ask the county attorney to appeal the ruling.

The issue represents another front in the ongoing conflict over the use of emerging technologies by law enforcement. Police say they can, and have, used license plate location data to find dangerous criminals and missing persons. Privacy advocates don't oppose the use of the technology during an active investigation, but they say that maintaining a database of license plate locations for months or years provides too much opportunity for abuse by the police. Last month, the ACLU disclosed that the federal Immigration and Customs Enforcement agency was tapping into a vast, national database of police and private license plate readers. Such private databases remain unregulated.

An anonymous reader shares a report: Just two weeks after admitting it stored hundreds of millions of its users' own passwords insecurely, Facebook is demanding some users fork over the password for their outside email account as the price of admission to the social network. Facebook users are being interrupted by an interstitial demanding they provide the password for the email account they gave to Facebook when signing up. "To continue using Facebook, you'll need to confirm your email," the message demands. "Since you signed up with [email address], you can do that automatically ..." A form below the message asked for the users' "email password."

"That's beyond sketchy," security consultant Jake Williams told the Daily Beast. "They should not be taking your password or handling your password in the background. If that's what's required to sign up with Facebook, you're better off not being on Facebook." In a statement emailed to the Daily Beast after this story published, Facebook reiterated its claim it doesn't store the email passwords. But the company also announced it will end the practice altogether. "We understand the password verification option isn't the best way to go about this, so we are going to stop offering it," Facebook wrote. It's not clear how widely the new measure was deployed, but in its statement Facebook said users retain the option of bypassing the password demand and activating their account through more conventional means, such as "a code sent to their phone or a link sent to their email." Those options are presented to users who click on the words "Need help?" in one corner of the page.

An anonymous reader quotes a report from ZDNet: A German security researcher has printed the word "PWNED!" on the tracking maps of hundreds of GPS watches after the watch vendor ignored vulnerability reports for more than a year, leaving thousands of GPS-tracking watches --some of which are used by children and the elderly-- open to attackers. Speaking at the Troopers 2019 security conference that was held in Heidelberg, Germany, at the end of March, security researcher Christopher Bleckmann-Dreher presented a series of vulnerabilities impacting over 20 models of GPS watches manufactured by Austrian company Vidimensio. The watch models all share a common backend API, which works as an intermediary and storage point between the GPS watches and associated mobile apps.

Back in December 2017, Dreher discovered flaws in the mechanism through which the GPS watches communicate with this backend API server. [...] Dreher's new warning comes as the number vulnerable Vidimensio GPS watches grew ten times since December 2017, despite the warning from German authorities to destroy and stop using children smartwatches with intrusive tracking and eavesdropping capabilities. According to the researcher, the number has grown from around 700 to 7,000, of which 3,000 have been active in the past month. To raise awareness to these still-unpatched devices, Dreher told ZDNet that he has now turned to an unconventional strategy. The researcher has been using one of the security flaws he discovered to insert fake GPS coordinates in people's location history. The researcher designed these fake GPS coordinates to look like the word "PWNED!" when displayed on the location history section map --displayed inside the mobile apps and the watches' web dashboard.

When India blew apart one of its satellites orbiting Earth last week, it created hundreds of pieces of orbital debris, and some of those pieces are large enough and high enough to pose a potential threat to the International Space Station, NASA says. "That is a terrible, terrible thing to create an event that sends debris in an apogee that goes above the International Space Station," NASA Administrator Jim Bridenstine said, referring to the debris' highest point in orbit. "And that kind of activity is not compatible with the future of human space flight that we need to see happen." NPR reports: In calculating the Indian test's potential impact last week, he said NASA determined that the risk of small debris hitting the space station was increased by 44 percent over a period of 10 days. "It's unacceptable, and NASA needs to be very clear about what its impact to us is," Bridenstine said, discussing space debris and India's anti-satellite test at a town hall event Monday.

As he spoke about the heightened risk, the NASA administrator also emphasized that both the space station and the astronauts aboard it are safe. The station can be maneuvered out of harm's way if needed, he added. But another danger, he said, is that "when one country does it, then other countries feel like they have to do it, as well." "The good thing is, it's low enough in Earth orbit that over time, this will all dissipate," Bridenstine said on Monday. Those pieces are expected to burn up as they re-enter Earth's atmosphere. India's intercept of its own satellite created 400 pieces of orbital debris, Bridenstine said. "What we are tracking right now -- objects big enough to track, we're talking about 10 centimeters [4 inches] or bigger -- about 60 pieces have been tracked," he said. "Of those 60, we know that 24 of them are going above the apogee of the International Space Station."

dryriver shares a report from the BBC: Tracking airplanes anywhere in the world just got a lot easier. The U.S. firm Aireon says its new satellite surveillance network is now fully live and being trialled over the North Atlantic. The system employs a constellation of 66 (Iridium) spacecraft, which monitor the situational messages pumped out by aircraft transponders. These report a plane's position, altitude, direction and speed every eight seconds. The two big navigation management companies that marshal plane movements across the North Atlantic -- UK Nats and Nav Canada -- intend to use Aireon to transform their operations. The more detailed information they now have about the behavior of airplanes means more efficient routing can be introduced. This ought to reduce costs for airlines. Passengers should also experience fewer delays. Aireon has receivers riding piggyback on all 66 spacecraft of the Iridium sat-phone service provider. These sensors make it possible now to track planes even out over the ocean, beyond the visibility of radar -- and ocean waters cover 70% of the globe. The rapid-fire nature of the messaging also means aircraft visibility is virtually continuous. Existing data links only report ocean-crossing aircraft positions every 14 minutes. '

The updated fifth-generation iPad mini has been torn apart by iFixit, revealing an "amalgamation of components and designs from other iPads -- the internals of a previous iPad mini, the camera system of an iPad Pro, and the exterior design of an iPad Air," reports Ars Technica. From the report: iFixit has published its teardown of the new, fifth-generation iPad mini -- the first update to Apple's smaller-sized tablet since 2015. The iFixit team -- which sells gear for repairing and servicing gadgets and uses these teardown series to promote said gearâ"noted that the iPad mini looks on the outside like a smaller version of the new iPad Air. But on the inside, it's an updated iPad mini 4, the team wrote.

On opening the tablet up, iFixit discovered a 19.32Wh battery -- the same capacity as the previous-generation iPad mini. But there are some notable changes. The front-facing camera module has been updated to a 7-megapixel Æ'/2.2, like the 10.5-inch iPad Pro. That's a marked improvement over the iPad mini 4. There's also Apple's A12 Bionic system-on-a-chip (the same found in the iPhone XS, XS Max, and XR) with 3GB of LPDDR4X DRAM. The updated microphone array has been moved near the selfie cam, and new ambient light sensors support the True Tone feature, which adjusts the white balance of the display based on ambient light conditions for user comfort. The repair site gave the 2019 iPad mini a score of two out of 10 for repairability. "The only positive cited was that a single Phillips screwdriver can deal with all the screws in the device," Ars reports. "However, replacing the battery is 'unnecessarily difficult,' there's adhesive everywhere, and removing the home button (no small feat) is required in order to replace the screen."

The High Court of Paris has ordered several of the largest French ISPs to block access to the pirate libraries LibGen and Sci-Hub. "The decision is a setback for the sites that have come under increasing pressure, but Sci-Hub founder Alexandra Elbakyan believes that determined researchers are smart enough to find an alternative route to her site," reports TorrentFreak. From the report: Following a complaint from academic publishers Elsevier and Springer Nature, Internet providers Bouygues, Free, Orange, and SFR have been ordered (PDF) to block access to Sci-Hub and LibGen sites for the year to come. In its decision, picked up by Next INpact, the French court ruled that the two sites "clearly claim to be pirate platforms rejecting the principle of copyright and bypassing publishers' subscription access portals."

The court order targets a total of 57 domain names, including various mirror sites. The academic publishers had asked the court for a more flexible blocklist, which they could update whenever new domains would become available, but this was denied. If the publishers want to expand the blocklist, they will have to go back to court. This ensures that there remains judicial oversight over local website blockades. Also, a request for a specific IP-address block was denied. The court sided with the ISPs, who argued that they should have the freedom to choose their own blocking method, including DNS blocking. That does mean, however, that the ISPs will also have to bear the costs. "The blockade will have some effect, though not very profound," says Sci-Hub founder Alexandra Elbakya. "The people who are using Sci-Hub because they need access to research can still unblock it using VPN, TOR and etc."

An anonymous reader quotes a report from The Verge: Google said today that it would require its extended, non-employee workforce in the United States receive comprehensive health care coverage, a $15 minimum wage, and 12 weeks of parental leave. The move follows protests from employees and other workers at Google who have pushed the company to offer more benefits. Google relies on a massive staff of temporary, vendor, and contract workers, many of whom are supplied by third parties and aren't offered the same benefits as full Google employees. The disparity has led to calls for better conditions for the workers. Today, The Guardian reported that more than 900 employees have signed a letter supporting temporary workers whose contracts for work on Google Assistant were shortened.

In a statement announcing the changes, Google said it would require companies that provide temporary and vendor staff to offer health care benefits, including mental health, pediatric, oral, and dental services, as well as a minimum of eight paid days of sick leave. Workforce providers will also be required to pay workers at least $15 per hour and offer $5,000 per year in tuition reimbursement. The wage requirements will go into effect at the end of the year, Google said, and the health care requirements will start before 2022. The Tech Workers Coalition, which has organized tech industry workers, criticized that timeline. "Changes announced today apply to no one working right now -- but workers can't wait years to pay rent, see doctors and care for their families," the organization said in a tweet.

Boeing's promised software fix for its 737 Max planes involved in two deadly crashes since October has been pushed back several weeks after an internal review by engineers not connected to the aircraft raised additional safety questions. "The results of the 'non-advocate' review have not been revealed, but the Federal Aviation Administration confirmed on April 1 that the software needed additional work," reports Ars Technica. From the report: "The FAA expects to receive Boeing's final package of its software enhancement over the coming weeks for FAA approval," an FAA spokesperson said in a statement. "Time is needed for additional work by Boeing as the result of an ongoing review of the 737 MAX Flight Control System to ensure that Boeing has identified and appropriately addressed all pertinent issues." Just how far back the delivery of the MCAS patch has been pushed is uncertain. The New York Times reports that the update's schedule has been pushed back "several weeks." And after its delivery, an FAA spokesperson said, "the FAA will subject Boeing's completed submission to a rigorous safety review. The FAA will not approve the software for installation until the agency is satisfied with the submission."

This means it could be months before grounded Boeing 737 MAX aircraft are once again deemed airworthy. And that means more flight cancellations for airlines that have the aircraft in their inventory. Southwest Airlines, Boeing's largest 737 MAX customer, canceled all of its flights dependent on its 34 737 MAX aircraft through April 20 so far -- about 150 flights per day. And Boeing's delivery of new 737 MAX aircraft -- the company's best-seller -- has been indefinitely delayed.

Starting today, Microsoft is ending all ebook sales in its Microsoft Store for Windows PCs. "Previously purchased ebooks will be removed from users' libraries in early July," reports The Verge. "Even free ones will be deleted. The company will offer full refunds to users for any books they've purchased or preordered." From the report: Microsoft's "official reason," according to ZDNet, is that this move is part of a strategy to help streamline the focus of the Microsoft Store. It seems that the company no longer has an interest in trying to compete with Amazon, Apple Books, and Google Play Books. It's a bit hard to imagine why anyone would go with Microsoft over those options anyway.

If you have purchased ebooks from Microsoft, you can continue accessing them through the Edge browser until everything vanishes in July. After that, customers can expect to automatically receive a refund. According to a newly published Microsoft Store FAQ, "refund processing for eligible customers start rolling out automatically in early July 2019 to your original payment method." If your original payment method is no longer valid (or if you used a gift card), you'll receive a credit back to your Microsoft account to use online at the Microsoft Store. Microsoft will also offer an additional $25 credit (to your Microsoft account) if you annotated or marked up any ebook that you purchased from the Microsoft Store prior to today, April 2nd. Liliputing reminds us that "if you pay for eBooks, music, movies, video games, or any other content from a store that uses DRM, then you aren't really buying those digital items so much as paying a license fee for the rights to access them... a right that can be revoked if the company decides to remove a title from your device unexpectedly or if a company shuts down a server that would normally handle the digital rights management features."

You can find DRM-free eBooks at some online stores including Smashwords and Kobo (by browsing the DRM-free selection), or from publisher websites including Angry Robot, and Baen.

The spectre of superintelligent machines doing us harm is not just science fiction, technologists say -- so how can we ensure AI remains 'friendly' to its makers? From a story: Jaan Tallinn (co-founder of Skype) warns that any approach to AI safety will be hard to get right. If an AI is sufficiently smart, it might have a better understanding of the constraints than its creators do. Imagine, he said, "waking up in a prison built by a bunch of blind five-year-olds." That is what it might be like for a super-intelligent AI that is confined by humans. The theorist Eliezer Yudkowsky, who has written hundreds of essays on superintelligence, found evidence this might be true when, starting in 2002, he conducted chat sessions in which he played the role of an AI enclosed in a box, while a rotation of other people played the gatekeeper tasked with keeping the AI in. Three out of five times, Yudkowsky -- a mere mortal -- says he convinced the gatekeeper to release him. His experiments have not discouraged researchers from trying to design a better box, however.

The researchers that Tallinn funds are pursuing a broad variety of strategies, from the practical to the seemingly far-fetched. Some theorise about boxing AI, either physically, by building an actual structure to contain it, or by programming in limits to what it can do. Others are trying to teach AI to adhere to human values. A few are working on a last-ditch off-switch. One researcher who is delving into all three is mathematician and philosopher Stuart Armstrong at Oxford University's Future of Humanity Institute, which Tallinn calls "the most interesting place in the universe." (Tallinn has given FHI more than $310,000.) Armstrong is one of the few researchers in the world who focuses full-time on AI safety. When I asked him what it might look like to succeed at AI safety, he said: "Have you seen the Lego movie? Everything is awesome."

An anonymous reader quotes a report from MIT Technology Review: Almost a thousand Google staff, academic researchers, and other tech industry figures have signed a letter protesting the makeup of an independent council that Google created to guide the ethics of its AI projects. The search giant announced the creation of the council last week at EmTech Digital, MIT Technology Review's event in San Francisco. Known as the Advanced Technology External Advisory Council (ATEAC), it has eight members including economists, philosophers, policymakers, and technologists with expertise in issues like algorithmic bias. It is meant to hold four meetings a year, starting this month, and write reports designed to provide feedback on projects at the company that use artificial intelligence.

But two of those members proved controversial. One, Dyan Gibbens, is CEO of Trumbull, a company that develops autonomous systems for the defense industry -- a contentious choice given that thousands of Google employees protested the company's decision to supply the US Air Force with AI for drone imaging. The greatest outrage, though, has come over the inclusion of Kay Coles James, president of the Heritage Foundation, a think tank that opposes regulating carbon emissions, takes a hard line on immigration, and has argued against the protection of LGBTQ rights. The creation of ATEAC -- and the inclusion of Gibbens and James -- may in fact have been designed to appease Google's right-wing critics. At roughly the same time the council was announced, Sundar Pichai, Google's CEO, was meeting with President Donald Trump. Trump later tweeted: "He stated strongly that he is totally committed to the U.S. Military, not the Chinese Military. [We] also discussed political fairness and various things that Google can do for our Country. Meeting ended very well!" "Not only are James' views counter to Google's stated values," the letter states, "but they are directly counter to the project of ensuring that the development and application of AI prioritizes justice over profit. Such a project should instead place representatives from vulnerable communities at the center of decision-making."

Mozilla said this week that it intends to run two experiments over the course of this month to determine the most adequate way of dealing with push notification spam, a growing problem that is slowly deteriorating the web experience for everyone. From a report: The experiments will run in Firefox Nightly (v68) and Firefox Beta (v67). The Firefox Nightly experiment will run from April 1 to April 29. During this time, Mozilla said Firefox Nightly would only allow websites to show a push notification permission only after the user has clicked or pressed a key while on a website. All attempts to show a push notification permission request before a click or key press will be blocked by default. [...] In the last two weeks of the experiment, Firefox will show an icon in the URL bar, but with no visible popup on the page. Users can click this icon and accept any push notification permission requests if they wish so. Further reading: Mozilla and Scroll Partner To Test Alternative Funding Models for the Web.

Two new studies reaffirm every computer dunce's worst fears: IT professionals blame the employees they're bound to help for their computer problems -- at least when it comes to security. From a report: One, courtesy of SaaS operations management platform BetterCloud, offers grim reading. 91 percent of the 500 IT and security professionals surveyed admitted they feel vulnerable to insider threats. Which only makes one wonder about the supreme (over-)confidence of the other 9 percent.

[...] Yet now I've been confronted with another survey. This one was performed by the Ponemon Institute at the behest of security-for-your-security company nCipher. Its sampling was depressingly large. 5,856 IT and security professionals from around the world were asked for their views of corporate IT security. They seemed to wail in unison at the lesser and more unwashed. Oh, an objective 30 percent insisted that external hackers were the biggest cause for concern. A teeth-gritting 54 percent, however, said the most extreme threat to corporate IT security came from employee mistakes.

An anonymous reader writes: Microsoft today announced that Visual Studio 2019 for Windows and Mac has hit general availability — you can download it now from visualstudio.microsoft.com/downloads. Visual Studio 2019 includes AI-assisted code completion with Visual Studio IntelliCode. Separately, real-time collaboration tool Visual Studio Live Share has also hit general availability, and is now included with Visual Studio 2019.

At its Data-Centric Innovation Day, Intel today announced its Cascade Lake line of Xeon Scalable data center processors. From a report: The second-generation lineup of Xeon Scalable processors comes in 53 flavors that span up to 56 cores and 12 memory channels per chip, but as a reminder that Intel company is briskly expanding beyond "just" processors, the company also announced the final arrival of its Optane DC Persistent Memory DIMMs along with a range of new data center SSDs, Ethernet controllers, 10nm Agilex FPGAs, and Xeon D processors. This broad spectrum of products leverages Intel's overwhelming presence in the data center, it currently occupies ~95% of the worlds server sockets, as a springboard to chew into other markets, including its new assault on the memory space with the Optane DC Persistent Memory DIMMs. The long-awaited DIMMs open a new market for Intel and have the potential to disrupt the entire memory hierarchy, but also serve as a potentially key component that can help the company fend off AMD's coming 7nm EPYC Rome processors.

Apple has released the fifth-generation iPad Mini. So, of course, the repair experts at iFixit needed to tear it apart. From a report: The new 7.9 inch tablet, launched two weeks ago, sticks to its roots as a revamp of the iPad Mini 4, according to iFixit's teardown published Tuesday. One notable change is the battery connector design, which could prevent people trying to fix a device from accidentally killing the backlight during a repair, according to iFixit. The iFixit team calls this tweak "nifty!"

iFixit also noted that both the screen and battery are difficult to remove. The removal of the display, in particular, if not done carefully, could compromise the Touch ID technology. "Battery and screen replacements are the two most common repairs, and the iPad Mini makes both unnecessarily difficult," iFixit said. "The battery lacks pull-to-remove adhesive tabs, and the display requires a tricky removal of the home button if you want to keep Touch ID after your repair."

Proposals to change recommendations and curb conspiracies on YouTube were sacrificed for engagement, Bloomberg reported Monday, citing Google employees. From the report: In recent years, scores of people inside YouTube and Google, its owner, raised concerns about the mass of false, incendiary and toxic content that the world's largest video site surfaced and spread. One employee wanted to flag troubling videos, which fell just short of the hate speech rules, and stop recommending them to viewers. Another wanted to track these videos in a spreadsheet to chart their popularity. A third, fretful of the spread of "alt-right" video bloggers, created an internal vertical that showed just how popular they were. Each time they got the same basic response: Don't rock the boat.

The company spent years chasing one business goal above others: "Engagement," a measure of the views, time spent and interactions with online videos. Conversations with over twenty people who work at, or recently left, YouTube reveal a corporate leadership unable or unwilling to act on these internal alarms for fear of throttling engagement. Wojcicki would "never put her fingers on the scale," said one person who worked for her. "Her view was, 'My job is to run the company, not deal with this.'"

Twelve years after its inception, Readdle is finally venturing beyond Apple's ecosystem with the launch today of its Spark email app for Android. This comes on the heels of Google killing its own popular Inbox email app. From a report: Spark's Android app -- like its iOS and macOS incarnations -- includes three key selling points: It is free for individual users, does not serve ads, and offers a host of features aimed at power users. Plus, it supports all major email providers, including Google, Microsoft, Yahoo, and Apple. Spark for Android, like the now defunct Inbox app, sorts emails -- prioritizing more important messages to help you reach "inbox zero." It offers options to snooze an email and to schedule when an email should go out. You can also pin emails so that it is easier to find them later and get reminders to follow up on previous conversations. Advanced search functionality lets you use conversational keywords to find things like that PDF file your boss sent last week. So how exactly does the Ukrainian-headquartered company make money? Readdle offers a paid version of Spark that is aimed at small to medium-sized teams and enterprises.