Businesses

Despite a Record Year, Airlines Are Grappling With Big Challenges (economist.com) 31

The global airline industry is on track to post an all-time profit high of nearly $40 billion in 2025, according to trade group IATA, surpassing the pre-pandemic 2019 figure of $26 billion, but carriers are still managing a net margin of just 4% -- roughly $7.90 per passenger. Economist adds: Not everything has been in the ascent. European and North American airlines, which account for three-fifths of the industry's net profits, have had to contend with circuitous long-haul routes to avoid Russian airspace since the start of the war in Ukraine. This year parts of the Middle East became no-go zones after Israel's strike on Iran in June. America's airlines were hit by a government shutdown that stopped federal workers from travelling and kept unpaid air-traffic controllers at home, disrupting flights.

What is more, despite a drop in fuel prices, which account for 25-30% of airlines' operating expenses, other costs have risen.
Airlines flew 4.8 billion passengers in 2024, beating the 2019 peak, and that figure likely reached 5 billion in 2025 as combined revenues topped $1 trillion for the first time and load factors hit a record of nearly 84%.

But the industry is flying older planes because Boeing and Airbus can't deliver enough new ones. The duopoly shipped under 1,400 aircraft in 2025, well below the 2018 record of just over 1,600. Boeing has struggled since two fatal 737 MAX crashes in late 2018 and early 2019 led to a 20-month grounding, and a fuselage panel blew off another 737 MAX mid-flight in early 2024. Airbus cut its 2025 delivery target from 820 to 790 in early December due to a supplier's production flaw, and Pratt & Whitney engine problems have grounded a third of the global A320neo fleet.

IATA estimates the aircraft shortage won't resolve before 2031 at the earliest, and the global fleet's average age has climbed to 15 years from 13 in 2019. Annual fuel efficiency gains have slowed from about 2% to 0.3% in 2025, and an IATA and Oliver Wyman report pegs the cost of aging fleets -- extra fuel, repairs, spare parts -- at over $11 billion in 2025.
Windows

How Windows 10 Earned Its Good Reputation While Planting the Seeds of Windows 11's Problems (arstechnica.com) 39

Windows 10's formal end-of-support arrived in October, and while the operating system is generally remembered as one of the "good" versions of Windows -- the most widely used since XP -- many of the annoyances people complain about in Windows 11 actually started during the Windows 10 era, ArsTechnica writes.

Windows 10 earned its positive reputation primarily by not being Windows 8. It restored a version of the traditional Start menu, rolled out as a free upgrade to Windows 7 and 8 users, and ran on virtually all the same hardware as those older versions. Microsoft introduced the Windows Subsystem for Linux during this period and eventually rebuilt Edge on Chromium. The company seemed more willing to meet users where they were rather than forcing them to change their behavior.

But Windows 10 also began collecting more information about how users interacted with the operating system, cluttered the lock screen with advertisements and news articles, and added third-party app icons to the Start menu without user consent. The mandatory Microsoft Account sign-in requirement -- one of Windows 11's most frequently complained-about features -- was a Windows 10 innovation, easier to circumvent at the time but clearly a step down the road Windows 11 is currently traveling.

To be sure, Windows 11 has made things worse by stacking new irritants on top of old ones. The Microsoft Account requirement expanded to both Home and Pro editions, the SCOOBE screen now regularly nags users to "finish setting up" years-old installations and Microsoft's Copilot push changed the default PC keyboard layout for the first time in 30 years.
IT

Gmail Users May Soon Be Able To Change Their Email Address and Keep the Old One (9to5google.com) 51

Google appears to be testing a feature that would let users change their @gmail.com address for the first time, according to an official support document. The support page exists only in Hindi, suggesting an India-first rollout, and Google notes that users will "gradually begin to see this option."

The feature would let users switch to a new @gmail address while retaining full access to their old one, effectively giving a single account two working email addresses. Emails sent to either address would arrive in the same inbox, and existing data in Drive and Photos would remain unaffected. Users who switch cannot register another new address for 12 months. Google has not officially announced the feature.
AI

Fake Video Claiming 'Coup In France' Goes Viral 70

alternative_right shares a report from Euronews: France's President Emmanuel Macron discovered news of his own supposed overthrow, after he received a message of concern, along with a link to a Facebook video. "On Sunday (14 December) one of my African counterparts got in touch, writing 'Dear president, what's happening to you? I'm very worried,'" Macron told readers of French local newspaper La Provence on December 16.

Alongside the message, a compelling video showcasing a swirling helicopter, military personnel, crowds and -- what appears to be -- a news anchor delivering a piece to camera. "Unofficial reports suggest that there has been a coup in France, led by a colonel whose identity has not been revealed, along with the possible fall of Emmanuel Macron. However, the authorities have not issued a clear statement," she says.

Except, nothing about this video is authentic: it was created with AI. After discovering the video, Macron asked Pharos -- France's official portal for signaling online illicit content -- to call Facebook's parent company Meta, to get the fake video removed. But that request was turned down, as the platform claimed it did not violate its "rules of use." [...] The original video ... racked up more than 12 million views [...].The teenager running the account is based in Burkina Faso and makes money running courses focusing on how to monetize AI. He eventually took the video down more than a week after its initial publication, due to political -- and public -- controversy.
"I tend to think that I have more power to apply pressure than other people," Macron said. "Or rather, that it's easier to say something is serious if I am the one calling, but it doesn't work."

"These people are mocking us," he added. "They don't care about the serenity of public debates, they don't care about democracy, and therefore they are putting us in danger."
EU

Europe's Public Institutions Are Quietly Ditching US Cloud Providers (theregister.com) 90

European public institutions are quietly migrating away from American cloud providers and office software, driven less by policy ambitions in Brussels than by the mundane legal reality that GDPR-mandated risk assessments keep flagging the US CLOUD Act as an unacceptable threat to citizen data.

Austria's Federal Ministry for Economy, Energy and Tourism moved 1,200 employees to the open-source platform Nextcloud in four months. Germany's Schleswig-Holstein has already transitioned 24,000 of its 30,000 civil servants to LibreOffice, Nextcloud and Thunderbird. The International Criminal Court in The Hague announced in November 2025 that it would replace Microsoft office software after chief prosecutor Karim Khan was temporarily locked out of his Outlook account.

Competition economist Cristina Caffarra estimates that 90% of Europe's digital infrastructure is now controlled by non-European companies. Forrester predicts no European enterprise will fully abandon US hyperscalers in 2026, but these targeted migrations for sensitive government applications are already underway.
Apple

Apple Developer's Account Restored After Compromised Gift Card Incident (computerhistory.org) 14

"It's all fixed," says that Apple developer who was locked out of his Apple Account after redeeming a compromised Apple Gift Card. "A lovely man from Singapore, working for Apple Executive Relations, who has been calling me every so often for a couple of days, has let me know it's all fixed. It looks like the gift card I tried to redeem, which did not work for me, and did not credit my account, was already redeemed in some way (sounds like classic gift card tampering), and my account was caught by that.

"Obviously it's unacceptable that this can happen, and I'm still trying to get more information out of him, but at least things are now mostly working.

"Strangely, he did tell me to only ever buy gift cards from Apple themselves; I asked if that means Apple's supply chain of Blackhawk Network, InComm, and other gift card vendors is insecure, and he was unwilling to comment."

Updates to his original blog post now include a frequently-asked questions list:
  • Yes, I have the receipt for the card, including the activation receipt.
  • Yes, the card was legitimately purchased, it's not from eBay.
  • Yes, I have contacted the retailer.
  • Yes, I do have backups... No, I don't know why parts of the account still kinda work, and parts don't.
  • No, I didn't write this article with AI...
  • Yes, Apple really did use emojis in their Live Chat...

DRM

FSF Says Nintendo's New DRM Allows Them to Remotely Render User Devices 'Permanently Unusable' (fsf.org) 61

"In the lead up to its Switch 2 console release, Nintendo updated its user agreement," writes the Free Software Foundation, warning that Nintendo now claims "broad authority to make consoles owned by its customers permanently unusable."

"Under Nintendo's most aggressive digital restrictions management (DRM) update to date, game console owners are now required to give Nintendo the unilateral right to revoke access to games, security updates, and the Internet, at its sole discretion." The new agreement states: "You acknowledge that if you fail to comply with [Nintendo's restrictions], Nintendo may render the Nintendo Account Services and/or the applicable Nintendo device permanently unusable in whole or in part...."

There are probably other reasons that Nintendo has and will justify bricking game consoles, but here are some that we have seen reported:

— "Tampering" with hardware or software in pretty much any way;
— Attempting to play a back-up game;
— Playing a "used" game; or
— Use of a third-party game or accessory...


Nintendo's promise to block a user from using their game console isn't just an empty threat: it has already been wielded against many users. For example, within a month of the Switch 2's release, one user unknowingly purchased an open-box return that had been bricked, and despite functional hardware, it was unusable for many games. In another case, a user installing updates for game cartridges purchased via a digital marketplace had their console disabled. Though it's unclear exactly why they were banned, it's possible that the cartridge's previous owner made a copy and an online DRM check determined that the current and previous owner's use were both "fraudulent." The user only had their console released through appealing to Nintendo directly and providing evidence of their purchase, a laborious process.

Nintendo's new console banning spree is just one instance of the threat that nonfree software and DRM pose to users. DRM is but one injustice posed by nonfree software, and the target of the FSF's Defective by Design campaign. Like with all software, users ought to be able to freely copy, study, and modify the programs running on their devices. Proprietary software developers actively oppose and antagonize their users. In the case of Nintendo, this means punishing legitimate users and burdening them with proving that their use is "acceptable." Console users shouldn't have to tread so carefully with a console that they own, and should they misstep, beg Nintendo to allow them to use their consoles again.

AI

Microsoft AI Chief: Staying in the Frontier AI Race Will Cost Hundreds of Billions (businessinsider.com) 34

Microsoft AI CEO Mustafa Suleyman estimates that staying competitive in frontier AI development will require "hundreds of billions of dollars" over the next five to ten years, a sum that doesn't even account for the high salaries companies are paying individual researchers and technical staff. Speaking on a podcast, Suleyman compared Microsoft to a "modern construction company" where hundreds of thousands of workers are building gigawatts of CPUs and AI accelerators. There's "a structural advantage by being inside a big company," he said.

When asked whether startups could compete with Big Tech, Suleyman said "it's hard to say," adding that "the ambiguity is what's driving the frothiness of the valuations." Meta CEO Mark Zuckerberg said in September he'd rather risk "misspending a couple of hundred billion" than fall behind in superintelligence.
Apple

Compromised Apple Gift Card Leads to Apple Account Lockout (tidbits.com) 62

An Apple developer was locked out of his Apple Account after redeeming a compromised Apple Gift Card, exposing how automated fraud systems can effectively cut users off from their digital lives with little explanation or recourse. TidBITS reports: After attempting to redeem a $500 Apple Gift Card purchased from a well-known retailer, Apple developer, author, and /dev/world conference organizer Paris Buttfield-Addison found himself locked out of his Apple Account. He writes: "I am writing this as a desperate measure. After nearly 30 years as a loyal customer, authoring technical books on Apple's own programming languages (Objective-C and Swift), and spending tens upon tens upon tens of thousands of dollars on devices, apps, conferences, and services, I have been locked out of my personal and professional digital life with no explanation and no recourse."

As far as I can tell from his extensively documented story, Buttfield-Addison did nothing wrong. Personally, I wouldn't have purchased an Apple Gift Card to pay for Apple services -- he planned to use it to pay for his 6 TB iCloud+ storage plan. I presume he bought it at a discount, making the hassle worthwhile compared to simply paying with a credit card. But I have received Apple Gift Cards as thank-yous or gifts several times, so I can easily imagine accidentally trying to redeem a compromised card number and ending up in this situation. [...] For now, we can hope that ongoing media attention pushes Apple to unlock Buttfield-Addison's account. More troublingly, if this can happen to such a high-profile Apple user, I have to assume it also afflicts everyday users who lack the media reach to garner coverage.

Microsoft

Microsoft Will Finally Kill Obsolete Cipher That Has Wreaked Decades of Havoc (arstechnica.com) 63

An anonymous reader quotes a report from Ars Technica: Microsoft is killing off an obsolete and vulnerable encryption cipher that Windows has supported by default for 26 years following more than a decade of devastating hacks that exploited it and recently faced blistering criticism from a prominent US senator. When the software maker rolled out Active Directory in 2000, it made RC4 a sole means of securing the Windows component, which administrators use to configure and provision fellow administrator and user accounts inside large organizations. RC4, short for Rivist Cipher 4, is a nod to mathematician and cryptographer Ron Rivest of RSA Security, who developed the stream cipher in 1987. Within days of the trade-secret-protected algorithm being leaked in 1994, a researcher demonstrated a cryptographic attack that significantly weakened the security it had been believed to provide. Despite the known susceptibility, RC4 remained a staple in encryption protocols, including SSL and its successor TLS, until about a decade ago. [...]

Last week, Microsoft said it was finally deprecating RC4 and cited its susceptibility to Kerberoasting, the form of attack, known since 2014, that was the root cause of the initial intrusion into Ascension's network. "By mid-2026, we will be updating domain controller defaults for the Kerberos Key Distribution Center (KDC) on Windows Server 2008 and later to only allow AES-SHA1 encryption," Matthew Palko, a Microsoft principal program manager, wrote. "RC4 will be disabled by default and only used if a domain administrator explicitly configures an account or the KDC to use it." [...] Following next year's change, RC4 authentication will no longer function unless administrators perform the extra work to allow it. In the meantime, Palko said, it's crucial that admins identify any systems inside their networks that rely on the cipher. Despite the known vulnerabilities, RC4 remains the sole means of some third-party legacy systems for authenticating to Windows networks. These systems can often go overlooked in networks even though they are required for crucial functions.

To streamline the identification of such systems, Microsoft is making several tools available. One is an update to KDC logs that will track both requests and responses that systems make using RC4 when performing requests through Kerberos. Kerberos is an industry-wide authentication protocol for verifying the identities of users and services over a non-secure network. It's the sole means for mutual authentication to Active Directory, which hackers attacking Windows networks widely consider a Holy Grail because of the control they gain once it has been compromised. Microsoft is also introducing new PowerShell scripts to sift through security event logs to more easily pinpoint problematic RC4 usage. Microsoft said it has steadily worked over the past decade to deprecate RC4, but that the task wasn't easy.
"The problem though is that it's hard to kill off a cryptographic algorithm that is present in every OS that's shipped for the last 25 years and was the default algorithm for so long, Steve Syfuhs, who runs Microsoft's Windows Authentication team, wrote on Bluesky. "See," he continued, "the problem is not that the algorithm exists. The problem is how the algorithm is chosen, and the rules governing that spanned 20 years of code changes."
Security

Security Researcher Found Critical Kindle Vulnerabilities That Allowed Hijacking Amazon Accounts (thetimes.com) 13

The Black Hat Europe hacker conference in London included a session titled "Don't Judge an Audiobook by Its Cover" about a two critical (and now fixed) flaws in Amazon's Kindle. The Times reports both flaws were discovered by engineering analyst Valentino Ricotta (from the cybersecurity research division of Thales), who was awarded a "bug bounty" of $20,000 (£15,000 ). He said: "What especially struck me with this device, that's been sitting on my bedside table for years, is that it's connected to the internet. It's constantly running because the battery lasts a long time and it has access to my Amazon account. It can even pay for books from the store with my credit card in a single click. Once an attacker gets a foothold inside a Kindle, it could access personal data, your credit card information, pivot to your local network or even to other devices that are registered with your Amazon account."

Ricotta discovered flaws in the Kindle software that scans and extracts information from audiobooks... He also identified a vulnerability in the onscreen keyboard. Through both of these, he tricked the Kindle into loading malicious code, which enabled him to take the user's Amazon session cookies — tokens that give access to the account. Ricotta said that people could be exposed to this type of hack if they "side-load" books on to the Kindle through non-Amazon stores.

Ricotta donated his bug bounties to charity...
Crime

Hollywood Director Found Guilty of Blowing $11 Million Netflix Budget on Crypto and Ferraris (decrypt.co) 43

Carl Rinsch, the director behind the 2013 Keanu Reeves film "47 Ronin," has been found guilty of defrauding Netflix out of $11 million that was meant to fund a science fiction series called "Conquest," which the streaming company ultimately cancelled in 2021 after Rinsch failed to meet any production milestones. A jury in the Southern District of New York convicted the 48-year-old on seven charges: one count each of wire fraud and money laundering, and five counts of transacting in illicitly obtained property.

Prosecutors alleged that Rinsch funneled the $11 million through multiple bank accounts into a personal brokerage account, lost more than half of it on securities within two months, and then began speculating on cryptocurrency. Court records show he also spent $2.4 million on a Ferrari and five Rolls Royces, $3.3 million on furniture and antiques, and $387,000 on a Swiss watch. Netflix has written off $55 million in total and has not recovered any funds. Rinsch faces up to 90 years in prison and is scheduled for sentencing on April 17, 2026.
Bitcoin

SEC Gives DTCC OK to Tokenize Stocks In Move To Blockchain (bloomberg.com) 19

The SEC has granted the Depository Trust & Clearing Corp., or DTCC, a no-action letter allowing it to custody and recognize tokenized stocks, ETFs, and Treasuries on approved blockchains for three years. "Although this program is a pilot subject to various operational limitations, it marks a significant incremental step in moving markets onchain," SEC Commissioner Hester Peirce said in a statement. Bloomberg reports: With the permission, DTCC will also extend their record-keeping to the blockchain, Michael Winnike, global head of strategy and market solutions at DTCC Clearing & Securities Services, said in an interview. "It's the same legal entitlement, the same stock that you would hold in your account from the DTCC in traditional form," Winnike said. [...] The SEC's authorization of tokenization services only applies to a specific set of securities that trade often. The approval includes the Russell 1000 index which represents the 1,000 largest publicly traded US companies, as well as exchange-traded funds that track major indices and US Treasury bills, bonds and notes, Winnike said. "This allows us both to create value for the markets, while staying in a pre-defined pool of highly-liquid securities to start," said Winnike. The firm's ultimate aspiration is to add its entire depository, which represents $100 trillion in securities, to the blockchain, a move that would require further expansion of the no-action relief from the SEC, he said.

Winnike said the tokenization service will help bridge the traditional and digital worlds in part because the new technology will have the same legal entitlements and controls as traditional markets, including freezing or forced transfers if assets are stolen. "This enables participants to adopt and integrate, because they know there is a trusted party that can recover their securities as needed" and can address potential errors, he said. The new blockchain service will also allow investors to move assets all the time, not just Monday through Friday when traditional markets are open. "That creates a lot of new utility," Winnike said. "It brings the two ecosystems together."

Businesses

The Inevitable Shape of Cheap Online Retail (indiadispatch.com) 15

Pinduoduo in China, Shopee in Southeast Asia, and Meesho in India operate in markets that could hardly be more different -- an upper-middle-income industrial state, a stitched-together archipelago of under-banked economies, and a country where three-quarters of retail is unorganized and e-commerce penetration sits at about 7% -- yet all three have landed on the same business model.

These platforms run asset-light marketplaces specializing in cheap goods and slow delivery, monetizing through logistics mark-ups, advertising, and installment credit rather than retail margins. Temu and Shein are further variations now expanding in the U.S. and Europe.

The economics are thin for all. Pinduoduo's EBITDA margins on GMV (gross merchandise value) sit in a 0-4% band; Meesho's group-wide EBITDA hovers around break-even. Neither charges commissions on most sales; both earn through logistics mark-ups and advertising. Sponsored listings account for 1-3% of GMV at Indian marketplaces and 4-5% at Alibaba and Pinduoduo.

Credit is the more consequential side business. In India, cash on delivery functions as unofficial credit. Meesho CEO Vidit Aatrey said the customers prefer CoD for its "built-in delay," which effectively makes it "a five-day loan." Geography, income, and regulation were supposed to produce different answers. They produced one: a 3% endgame where e-commerce clips a few points of GMV and relies on attention and credit for profits.
China

China's Growth Is Coming at the Rest of the World's Expense (msn.com) 50

China has contributed less to global growth this year than the U.S. despite Beijing's frequent criticism of protectionism, according to a Wall Street Journal analysis citing new research from Goldman Sachs economists. U.S. imports are up 10% so far this year compared to a year earlier, while China's imports have fallen 3% in dollar terms. Goldman's economists found that the historical relationship between Chinese growth and global growth has turned negative; where 1% more Chinese output once raised world output by 0.2%, the bank now projects.

China will grow about 0.6 percentage points faster annually over the next few years while reducing the rest of the world's growth by 0.1 point per year. China's current account surplus could reach 1% of world GDP by 2029, Goldman estimates, larger than any country's since the late 1940s. China now accounts for 17% of global GDP.
EU

EU Urged to Soften 2035 Ban on Internal Combustion Engine Cars (reuters.com) 109

Friday six European Union countries "asked the European Commission to water down an effective ban on the sale of internal combustion engine cars slated for 2035," reports Reuters The countries have asked the EU Commission to allow the sale of hybrid cars or vehicles powered by other, existing or future, technologies "that could contribute to the goal of reducing emissions" beyond 2035, a joint letter seen by Reuters showed on Friday. The letter was signed by the prime ministers of Bulgaria, the Czech Republic, Hungary, Italy, Poland and Slovakia. They also asked for low-carbon and renewable fuels to be included in the plan to reduce the carbon emissions from transportation...

Since they adopted a regulation that all new vehicles from 2035 should have zero emissions in March 2023, EU countries are now having second thoughts. Back then, the outlook for battery electric vehicles was positive, but carmakers' efforts have later collided with the reality of lower-than-expected demand and fierce competition from China.

Car and Drive reports that Chancellor Friedrich Merz of Germany also "wants to allow exceptions for plug-in hybrids, extended-range EVs, and 'highly efficient' combustion vehicles beyond the current 2035 deadline." They cite a report in Automotive News. The European Commission hasn't made any official changes yet, but mounting pressure suggests that a revised plan could be coming soon.... Apostolos Tzitzikostas, the European Commissioner for Sustainable Transport and Tourism, was cited by the German paper Handelsblatt as saying that the EU "will take all technological advances into account when reassessing fleet emission limits, including combustion engines running on e-fuels and biofuels." And these renewable products will apparently be key pieces of the puzzle. BMW uses a vegetable-oil-derived fuel called HVO 100 in its diesel products throughout Europe. The plant-oil-based fuel reportedly reduces tailpipe emissions by 90 percent compared with traditional diesel. For its part, Porsche has been working on producing synthetic fuel at a plant in Chile since 2022.

The European Commission is set to meet on December 10. At that time, the body is expected to assemble a package of proposals to help out the struggling European automotive industry, though the actual announcement may be pushed to a later date.

Thanks to long-time Slashdot reader sinij for sharing the article.
Microsoft

Microsoft Faces New Complaint For Unlawfully Processing Data On Behalf of Israeli Military (aljazeera.com) 53

Ancient Slashdot user Alain Williams shares a report from Al Jazeera: The Irish Council for Civil Liberties (ICCL) has announced it filed a complaint against Microsoft, accusing the global tech giant of unlawfully processing data on behalf of the Israeli military and facilitating the killings of Palestinian civilians in Gaza. In the complaint, the council asked the Data Protection Commission -- the European Union's lead data regulator for the company -- to "urgently investigate" Microsoft Ireland's processing.

"Microsoft's technology has put millions of Palestinians in danger. These are not abstract data-protection failures -- they are violations that have enabled real-world violence," Joe O'Brien, ICCL's executive director, said in a statement. "When EU infrastructure is used to enable surveillance and targeting, the Irish Data Protection Commission must step in -- and it must use its full powers to hold Microsoft to account."

After months of complaints from rights groups and Microsoft whistleblowers, the company said in September it cancelled some services to the Israeli military over concerns that it was violating Microsoft's terms of service by using cloud computing software to spy on millions of Palestinians.

AT&T

AT&T and Verizon Are Fighting Back Against T-Mobile's Easy Switch Tool (tmo.report) 23

AT&T and Verizon are blocking T-Mobile's new "Switching Made Easy" tool that scans their customer accounts to recommend comparable plans. AT&T is also suing, alleging T-Mobile used bots to scrape over 100 fields of sensitive customer data. From The Mobile Report: According to a lawsuit, which AT&T has shared directly with us, T-Mobile updated the T-Life app's scraping abilities three separate times in an attempt to bypass AT&T's detection. Essentially, T-Mobile and AT&T have been in a game of cat and mouse. Not only that, but AT&T alleges that T-Mobile is intentionally hiding the fact that it's their scraper accessing an account, and essentially pretends to be an end user while doing so. Apparently, T-Mobile's scraping bot tries its best to appear as a generic web browser.

AT&T sent T-Mobile a cease and desist letter on November 24th demanding T-Mobile stop the scraping process. T-Mobile responded two days later refusing, stating that the process was legal because "customers themselves ... log into their own wireless account." On November 26th, AT&T says they detected T-Mobile is no longer scraping the AT&T website, and instead asks users to upload a pdf of their bill or enter some info manually. They note, however, that at the time the app still appeared to scrape Verizon accounts. The lawsuit further explains that AT&T reached out to Apple with the claim that T-Mobile's T-Life app is also violating the App Store Review Guidelines. T-Mobile responded to this complaint as well, making similar claims that the scraping process does not violate those guidelines. [...]

According to AT&T, the T-Life app collects way more information than is necessary for a simple carrier switch. The company alleges T-Mobile grabs over 100 separate bits of info from a customer's account, including info about other users on the account and other services not related to wireless service. It's also worth noting that, apparently, T-Mobile is storing this information, not just using it temporarily, even if the customer doesn't end up switching. T-Mobile has responded to our request for comment, and says that actually, AT&T is wrong about the facts, and Easy Switch is safe and secure...

Youtube

SmartTube YouTube App For Android TV Breached To Push Malicious Update (bleepingcomputer.com) 17

An anonymous reader quotes a report from BleepingComputer: The popular open-source SmartTube YouTube client for Android TV was compromised after an attacker gained access to the developer's signing keys, leading to a malicious update being pushed to users. The compromise became known when multiple users reported that Play Protect, Android's built-in antivirus module, blocked SmartTube on their devices and warned them of a risk.

The developer of SmartTube, Yuriy Yuliskov, admitted that his digital keys were compromised late last week, leading to the injection of malware into the app. Yuliskov revoked the old signature and said he would soon publish a new version with a separate app ID, urging users to move to that one instead. [...] A user who reverse-engineered the compromised SmartTube version number 30.51 found that it includes a hidden native library named libalphasdk.so [VirusTotal]. This library does not exist in the public source code, so it is being injected into release builds.

[...] The library runs silently in the background without user interaction, fingerprints the host device, registers it with a remote backend, and periodically sends metrics and retrieves configuration via an encrypted communications channel. All this happens without any visible indication to the user. While there's no evidence of malicious activity such as account theft or participation in DDoS botnets, the risk of enabling such activities at any time is high.

The Courts

Supreme Court Hears Copyright Battle Over Online Music Piracy (nytimes.com) 32

The Supreme Court appears inclined to side with Cox Communications in a major copyright case, suggesting that ISPs shouldn't be held liable for users' music piracy based solely on "mere knowledge," given the risk of forcing outages for universities, hospitals, and other large customers. The New York Times reports: Leading music labels and publishers who represent artists ranging from Bob Dylan to Beyonce sued Cox Communications in 2018, saying it had failed to terminate the internet connections of subscribers who had been repeatedly flagged for illegally downloading and distributing copyrighted music. At issue is whether providers like Cox can be held legally responsible and be required to pay steep damages -- a billion dollars or more -- if they know that customers are pirating the music but do not take sufficient steps to terminate their internet access.

Justices from across the ideological spectrum on Monday raised concerns about whether finding for the music industry could result in internet providers being forced to cut off access to large account holders such as hospitals and universities because of the illegal acts of individual users. "What is the university supposed to do in your view?" asked Justice Samuel A. Alito Jr., a conservative, suggesting it would be difficult to track down bad actors without the risk of losing service campuswide. "I just don't see how it's workable at all."

"The internet is so amorphous," added Justice Sonia Sotomayor, a liberal, saying that a single "customer" could represent tens of thousands of users, particularly in rural areas where an entire region might be considered a "customer." After nearly two hours of argument, a majority of justices seemed likely to side with Cox and to send the case back to the U.S. Court of Appeals for the Fourth Circuit for review under a stricter standard. Several justices suggested the company's "mere knowledge" of the illegal downloads was not sufficient to hold Cox liable.

Slashdot Top Deals