"I have no musical talent at all," says Oliver McCann. "I can't sing, I can't play instruments, and I have no musical background at all!"

But the Associated Press describes 37-year-old McCann as a British "AI music creator" — and last month McCann signed with an independent record label "after one of his tracks racked up 3 million streams, in what's billed as the first time a music label has inked a contract with an AI music creator." McCann is an example of how ChatGPT-style AI song generation tools like Suno and Udio have spawned a wave of synthetic music, a movement most notably highlighted by a fictitious group, Velvet Sundown, that went viral even though all its songs, lyrics and album art were created by AI. Experts say generative AI is set to transform the music world. However, there are scant details, so far, on how it's impacting the $29.6 billion global recorded music market, which includes about $20 billion from streaming.

The most reliable figures come from music streaming service Deezer, which estimates that 18% of songs uploaded to its platform every day are purely AI generated, though they only account for a tiny amount of total streams, hinting that few people are actually listening. Other, bigger streaming platforms like Spotify haven't released any figures on AI music... "It's a total boom. It's a tsunami," said Josh Antonuccio, director of Ohio University's School of Media Arts and Studies. The amount of AI generated music "is just going to only exponentially increase" as young people grow up with AI and become more comfortable with it, he said. [Antonuccio says later the cost of making a hit record "just keeps winnowing down from a major studio to a laptop to a bedroom. And now it's like a text prompt — several text prompts." Though there's a lack of legal clarity over copyright issues.]

Generative AI, with its ability to spit out seemingly unique content, has divided the music world, with musicians and industry groups complaining that recorded works are being exploited to train AI models that power song generation tools... Three major record companies, Sony Music Entertainment, Universal Music Group and Warner Records, filed lawsuits last year against Suno and Udio for copyright infringement. In June, the two sides also reportedly entered negotiations that could go beyond settling the lawsuits and set rules for how artists are paid when AI is used to remix their songs.

GEMA, a German royalty collection society, has sued Suno, accusing it of generating music similar to songs like "Mambo No. 5" by Lou Bega and "Forever Young" by Alphaville. More than 1,000 musicians, including Kate Bush, Annie Lennox and Damon Albarn, released a silent album to protest proposed changes to U.K. laws on AI they fear would erode their creative control.

Meanwhile, other artists, such as will.i.am, Timbaland and Imogen Heap, have embraced the technology. Some users say the debate is just a rehash of old arguments about once-new technology that eventually became widely used, such as AutoTune, drum machines and synthesizers.

"AI web crawlers are strip-mining the web in their perpetual hunt for ever more content to feed into their Large Language Model mills," argues Steven J. Vaughan-Nichols at the Register.

And "when AI searchbots, with Meta (52% of AI searchbot traffic), Google (23%), and OpenAI (20%) leading the way, clobber websites with as much as 30 Terabits in a single surge, they're damaging even the largest companies' site performance..." How much traffic do they account for? According to Cloudflare, a major content delivery network (CDN) force, 30% of global web traffic now comes from bots. Leading the way and growing fast? AI bots... Anyone who runs a website, though, knows there's a huge, honking difference between the old-style crawlers and today's AI crawlers. The new ones are site killers. Fastly warns that they're causing "performance degradation, service disruption, and increased operational costs." Why? Because they're hammering websites with traffic spikes that can reach up to ten or even twenty times normal levels within minutes.

Moreover, AI crawlers are much more aggressive than standard crawlers. As the InMotionhosting web hosting company notes, they also tend to disregard crawl delays or bandwidth-saving guidelines and extract full page text, and sometimes attempt to follow dynamic links or scripts. The result? If you're using a shared server for your website, as many small businesses do, even if your site isn't being shaken down for content, other sites on the same hardware with the same Internet pipe may be getting hit. This means your site's performance drops through the floor even if an AI crawler isn't raiding your website...

AI crawlers don't direct users back to the original sources. They kick our sites around, return nothing, and we're left trying to decide how we're to make a living in the AI-driven web world. Yes, of course, we can try to fend them off with logins, paywalls, CAPTCHA challenges, and sophisticated anti-bot technologies. You know one thing AI is good at? It's getting around those walls. As for robots.txt files, the old-school way of blocking crawlers? Many — most? — AI crawlers simply ignore them... There are efforts afoot to supplement robots.txt with llms.txt files. This is a proposed standard to provide LLM-friendly content that LLMs can access without compromising the site's performance. Not everyone is thrilled with this approach, though, and it may yet come to nothing.

In the meantime, to combat excessive crawling, some infrastructure providers, such as Cloudflare, now offer default bot-blocking services to block AI crawlers and provide mechanisms to deter AI companies from accessing their data.

In 2017 Rick Beato streamed "Rick's Rant Episode 2" — and just received a copyright claim this month. And days after jazz pianist Chick Corea died in 2021, Beato livestreamed a half-hour video which was mostly commentary, but with several excerpts from Corea's albums (at least one more than three minutes long). He also received a copyright claim for that one this August — just minutes after the claim on his 2017 video.

These videos "are all fair use," Beato argues in a new video, noting it's also affected other popular YouTube channels like The Professor of Rock: Rick Beato: Universal Music Group [UMG] has continued to send emails about copyright content ID claims — and now copyright strikes — on my channel. As a matter of fact, I have three shorts — these are under a minute long — that if they go through in the next four days, I'll have three strikes on my channel! Now if you don't fight these things, those three strikes would actually remove my channel from YouTube.
Five months ago Rick Beato had posted a clip from his interview with singer-songwriter Adam Duritz (founder of The Counting Crows) on YouTube. After 250,000 views, he'd earned a whopping $36.52 — and then Universal Music Group also claimed that video violated their copyright. (In the background the video played Duritz's song as he described how he wrote it.) "So they're gonna take my channel down over less than a hundred bucks — for using a small segment from an interview with him, on a song he sang on," Beato complained on YouTube. "That video is 55 seconds long!"

"You need to play people's music to talk about it," Beato argues. "That is the definition of fair use. These are interviews with the people about their careers." (And the interviews actually help promote the artists for the record labels...) Rick Beato: The next one has me in it — it's an Olivia Rodrigo song — that I played maybe 10 seconds of the song on, and the short is 42 seconds long. Who did it? UMG. The third copyright strike is from a Hans Zimmer short. It's also UMG — it's from the Crimson Tide soundtrack.

Now, what do these things say...? "Your video is scheduled to be removed in four days and your channel will get a copyright strike due to a removal request from a claimant. If you delete your video before then, your channel won't get a copyright strike." [And there's also emails like "After reviewing your dispute, UMG has decided that their copyright claim is still valid..."] I've had probably 4,000 claims, over the last 9 years — from things that are fair use. [When he interviewed producer Rick Rubin, that video got 13 separate copyright claims.]

That's when I hired a lawyer to fight these. [Full-time, Beato says later.] And what he's done is he fought every single claim... We have successfully fought thousands of these now. But it literally costs me so much money to do this. Since we've been fighting these things — and never lost one — they still keep coming in... They're all Universal Music Group. So they obviously have hired some third party company, that are dredging up things, they're looking for things that haven't been claimed in the past — they're taking videos from seven or eight years ago!
Slashdot reader MrBrklyn (Slashdot reader #4,775) writes on the "New York's Linux Scene" site that video bloggers like Beato "have been hounded by copyright pirates like UMG," arguing that new videos of support are a "rebellion gaining traction". (Beato's video drew 1,369,859 views — and attracted 24,605 Comments — along with videos of support from professional musicians like drummer Anthony Edwards, guitarist Justin Hawkins, and bassist Scot Lade, as well as two different professional music attorneys.)

"Since there's rarely humans making any of these decisions and it's automated by bots, they don't understand these claims are against Universal Music's best interests," argues the long-running blog Saving Country Music (first appearing on MySpace in 2008). On YouTube videos, creators can freely filch copyrighted photos and other people's videos virtually free of ramifications. You can take an entire 2 1/2 hour film, impose it over a background, and upload it to YouTube, and usually avoid any problems. But feature a barely audible 8 1/2-second clip of music underneath audio dialogue, and you could have your entire podcast career evaporate overnight... People continue to ask, "Why doesn't Saving Country Music has a podcast?" Because what's the point of having a music podcast when you can't feature music? In fact, after over a decade of refusing to start one, I finally did, music free. What happened? About a dozen episodes in, someone took out a claim, and not only were all the episodes deleted, so was the entire account, even though no music even appeared on any of the episodes. I was given absolutely no recourse to fight whatever false claim had been made...

The music industry continues to so colossal fail the artists and catalogs they represent, and the fans they're supposed to serve with this current system of how podcasts are handled. If everything changes today thanks to the Rick Beato rant, it would still be 15 years too late. But at least it would happen.
Instead, they write, "Music labels have been leaving major opportunities to promote their catalogs and performers on the table with their punitive copyright claims that make it impossible to feature music on music podcasts and other platforms...

"You aren't screwing podcasters. You're screwing artists who could be using podcasts to help promote their music. "

"For months, tens of thousands of people around the world have been complaining Meta has been banning their Instagram and Facebook accounts in error..." the BBC reported this month... More than 500 of them have contacted the BBC to say they have lost cherished photos and seen businesses upended — but some also speak of the profound personal toll it has taken on them, including concerns that the police could become involved.

Meta acknowledged a problem with the erroneous banning of Facebook Groups in June, but has denied there is wider issue on Facebook or Instagram at all. It has repeatedly refused to comment on the problems its users are facing — though it has frequently overturned bans when the BBC has raised individual cases with it.
One examples is a woman lost the Instagram profile for her boutique dress shop. ("Over 5,000 followers, gone in an instant.") "After the BBC sent questions about her case to Meta's press office, her Instagram accounts were reinstated... Five minutes later, her personal Instagram was suspended again — but the account for the dress shop remained."

Another user spent a month appealing. ("In June, the BBC understands a human moderator double checked," but concluded he'd breached a policy.) And then "his account was abruptly restored at the end of July. 'We're sorry we've got this wrong,' Instagram said in an email to him, adding that he had done nothing wrong." Hours after the BBC contacted Meta's press office to ask questions about his experience, he was banned again on Instagram and, for the first time, Facebook... His Facebook account was back two days later — but he was still blocked from Instagram.
None of the banned users in the BBC's examples were ever told what post breached the platform's rules. Over 36,000 people have signed a petition accusing Meta of falsely banning accounts; thousands more are in Reddit forums or on social media posting about it. Their central accusation — Meta's AI is unfairly banning people, with the tech also being used to deal with the appeals. The only way to speak to a human is to pay for Meta Verified, and even then many are frustrated.

Meta has not commented on these claims. Instagram states AI is central to its "content review process" and Meta has outlined how technology and humans enforce its policies.
The Guardian reports there's been "talk of a class action against Meta over the bans." Users report Meta has typically been unresponsive to their pleas for assistance, often with standardised responses to requests for review, almost all of which have been rejected... But the company claims there has not been an increase in incorrect account suspension, and the volume of users complaining was not indicative of new targeting or over-enforcement. "We take action on accounts that violate our policies, and people can appeal if they think we've made a mistake," a spokesperson for Meta said.
"It happened to me this morning," writes long-time Slashdot reader Daemon Duck," asking if any other Slashdot readers had their personal (or business) account unreasonably banned. (And wondering what to do next...)

ArsTechnica: Today's video game consoles are hundreds of dollars more expensive than you'd expect based on historic pricing trends. That's according to an Ars Technica analysis of decades of pricing data and price-cut timing across dozens of major US console releases.

The overall direction of this trend has been apparent to industry watchers for a while now. Nintendo, Sony, and Microsoft have failed to cut their console prices in recent years and have instead been increasing the nominal MSRP for many current consoles in the past six months.

But when you crunch the numbers, it's pretty incredible just how much today's console prices defy historic expectations, even when you account for higher-than-normal inflation in recent years. If today's consoles were seeing anything like what used to be standard price cuts over time, we could be paying around $200 today for pricey systems like the Switch OLED, PS5 Digital Edition, and Xbox Series S.

An anonymous reader shares a report: Valve has started to comply with the UK's Online Safety Act, by rolling out a requirement for all Brits to verify their age with a credit card to access "mature content" pages and games on Steam. UK users won't even be able to access the community hubs of mature content games unless a valid credit card is stored on a Steam account.

While platforms like Reddit, Bluesky, and Discord have opted for age verification checks using selfies, Valve is restricting its age checks to just credit cards, according to a support article. "Among all age assurance mechanisms reviewed by Valve, this process preserves the maximum degree of user privacy," says Valve. "Having the credit card stored as a payment method acts as an additional deterrent against circumventing age verification by sharing a single Steam user account among multiple persons."

Typepad, which launched in 2003 to make it easier for the masses to start their blogging journey, is shutting down. From a blog post: We have made the difficult decision to discontinue Typepad, effective September 30, 2025. After September 30, 2025, access to Typepad -- including account management, blogs, and all associated content -- will no longer be available. Your account and all related services will be permanently deactivated. Please note that after this date, you will no longer be able to access or export any blog content.

An anonymous reader quotes a report from The Register: A German court has told Apple to stop advertising its Watches as being carbon-neutral, ruling that this was misleading and could not fly under the country's competition law. Apple has been marketing its newest smartwatches as being carbon-neutral for nearly two years now, with an array of rationales. It claims that clean energy for manufacturing, along with greener materials and shipping, lop around three-quarters off the carbon emissions for each model of the Apple Watch. The remaining emissions are offset by the purchase of carbon credits, according to Apple.

Deutsche Umwelthilfe (well, DUH – that's the acronym), a prominent environmental group, begged to differ on that last point. It applied for an injunction in May and Tuesday's ruling (in German), which will only be published in full later this week, led it to claim victory. The ruling means Apple can't advertise the Watch as a "CO2-neutral product" in Germany. [...] The ruling revolved around the Paraguayan forestry program that Apple claimed was offsetting some of the Watch's production emissions. The project involves commercial eucalyptus plantations on leased land, where the leases for three-quarters of the land will run out in 2029 with no guarantee of renewal.

According to the court, consumers' expectations of carbon compensation schemes are shaped by the prominent 2015 Paris Agreement, which commits countries to achieving carbon neutrality by the second half of this century. It said consumers would therefore "assume" that the carbon-neutrality claims around the Apple Watch would mean neutrality was assured through 2050. That leaves a 21-year gap of uncertainty in this case. The Verified Carbon Standard program, in which Apple is participating, has a "pooled buffer account" scheme to hedge against this sort of uncertainty. However, the German court was not impressed, saying it would only allow Apple to monitor the situation after the leases run out, which is a far cry from definitely being able to keep offsetting those emissions if the plantation gets cleared.

Google will require identity verification for all Android app developers, including those distributing apps outside the Play Store, starting September 2026 in Brazil, Indonesia, Singapore, and Thailand before expanding globally through 2027. Developers must register through a new Android Developer Console beginning March 2026. The requirement applies to certified Android devices running Google Mobile Services. Google cited malware prevention as the primary motivation, noting sideloaded apps contain 50 times more malware than Play Store apps.

Hobbyist and student developers will receive separate account types. Developer information submitted to Google will not be displayed to users.

Security researchers have uncovered critical vulnerabilities in Perplexity's Comet browser that enable attackers to hijack user accounts and execute malicious code through the browser's AI summarization features. The flaws, discovered independently by Brave and Guardio Labs, exploit indirect prompt injection attacks that bypass traditional web security mechanisms when users request webpage summaries.

Brave demonstrated account takeover through a malicious Reddit post that compromised Perplexity accounts when summarized. The vulnerability allows attackers to embed commands in webpage content that the browser's large language model executes with full user privileges across authenticated sessions.

Guardio's testing found the browser would complete phishing transactions and prompt users for banking credentials without warning indicators. The paid browser, available to Perplexity Pro and Enterprise Pro subscribers since July, processes untrusted webpage content without distinguishing between legitimate instructions and attacker payloads.

"Solar and wind accounted for almost 91% of new U.S. electrical generating capacity added in the first five months of 2025..." reports Electrek, citing new data from America's Federal Energy Regulatory Commission.

"Solar has now been the largest source of new generating capacity added each month for 21 consecutive months, starting September 2023." The 11,518 MW of solar added during the first five months of 2025 was 75.3% of the total new capacity placed into service... Between January and May, new wind provided 2,379 MW of capacity additions, accounting for 15.6% of all new capacity added during the first five months of 2025. For the first five months of 2025, solar and wind comprised 90.9% of new capacity while natural gas (1,381 MW) provided just 9.0%; the remaining 0.1% came from oil (14 MW). Solar + wind are 22.9% of U.S. utility-scale generating capacity.

The installed capacities of solar (11.1%) and wind (11.8%) are now each more than a tenth of the U.S. total. Taken together, they constitute 22.9% of the U.S.'s total available installed utility-scale generating capacity. At least 25-30% of U.S. solar capacity is in the form of small-scale (e.g., rooftop) systems that are not reflected in FERC's data. Including that additional solar capacity would bring the share provided by solar + wind to more than a quarter of the U.S. total. With the inclusion of hydropower (7.7%), biomass (1.1%), and geothermal (0.3%), renewables currently claim a 32.0% share of total US utility-scale generating capacity. If small-scale solar capacity is included, renewables are now about one-third of total US generating capacity....

Taken together, the net new "high probability" capacity additions by all renewable energy sources over the next three years — the bulk of the Trump Administration's remaining time in office — would total 113,097 MW. There is no new nuclear capacity in FERC's three-year forecast, while coal and oil are projected to contract by 24,913 MW and 1,907 MW, respectively... If FERC's current "high probability" additions materialize by May 1, 2028, solar will account for 16.7% of US installed utility-scale generating capacity. Wind would provide an additional 12.7% of the total. Thus, each would be greater than coal (12.2%) and substantially more than nuclear power or hydropower (each 7.2%). In fact, assuming current growth rates continue, the installed capacity of utility-scale solar is likely to surpass that of either coal or wind within two years...

At the end of 2024, the mix of all renewables accounted for 30.96% of total generating capacity. Solar alone was 10.19% while wind was 11.68%. By the end of May, renewables' share had risen to 31.98% with solar at 11.13% and wind at 11.80%.
FERC also says that 43 "units" of solar totaling 1,515 megawatts (MW) were placed into service in May, according to the article, "accounting for 58.7% of all new generating capacity added during the month."

An anonymous reader shares a report: Expect record-breaking temperatures to change the workplace, the World Health Organization (WHO) and World Meteorological Organization (WMO) warned today in a new report. When workers don't have adequate protections from heat stress, their health and productivity suffer.

It's a risk employers and lawmakers have to take more seriously if they want to keep workers safe and businesses prosperous, the agencies say. That means finding ways to adapt in a warming world, and paying close attention to groups that might be more vulnerable than others.

[...] More than 2.4 billion people around the world -- 71 percent of the working population -- experience workplace heat stress, according to estimates from the ILO. Each year, 22.85 million occupational injuries and 18,970 fatalities are linked to excessive heat at work. The report also says that worker productivity falls 2-3 percent with every degree increase above 20 degrees Celsius in wet-bulb globe temperature, a measure that takes humidity and other environmental factors into account.

Davis Lu, a former Eaton Corporation developer, has been sentenced to four years in prison for sabotaging his ex-employer's Windows network with malware and a custom kill switch that locked out thousands of employees once his account was disabled. The attack caused significant operational disruption and financial losses, with Lu also attempting to cover his tracks by deleting data and researching privilege escalation techniques. BleepingComputer reports: After a corporate restructuring and subsequent demotion in 2018, the DOJ says that Lu retaliated by embedding malicious code throughout the company's Windows production environment. The malicious code included an infinite Java thread loop designed to overwhelm servers and crash production systems. Lu also created a kill switch named "IsDLEnabledinAD" ("Is Davis Lu enabled in Active Directory") that would automatically lock all users out of their accounts if his account was disabled in Active Directory. When his employment was terminated on September 9, 2019, and his account disabled, the kill switch activated, causing thousands of users to be locked out of their systems.

"The defendant breached his employer's trust by using his access and technical knowledge to sabotage company networks, wreaking havoc and causing hundreds of thousands of dollars in losses for a U.S. company," said Acting Assistant Attorney General Matthew R. Galeotti. When he was instructed to return his laptop, Lu reportedly deleted encrypted data from his device. Investigators later discovered search queries on the device researching how to elevate privileges, hide processes, and quickly delete files. Lu was found guilty earlier this year of intentionally causing damage to protected computers. After his four-year sentence, Lu will also serve three years of supervised release following his prison term.

An anonymous reader quotes a report from Adweek: Meta wanted advertisers to believe its ecommerce ad product, Shops ads, was outperforming the competition, per a whistleblower complaint filed in a U.K. court. The former employee alleges the social media giant artificially inflated return on ad spend (ROAS) by counting shipping fees as revenue, subsidizing bids in ad auctions, and applying undisclosed discounts. The complaint, viewed by ADWEEK, was filed with the London Central Employment Tribunal on Wednesday (August 20) by Samujjal Purkayastha, a former product manager on Meta's Shops ads team. The document claims Meta artificially inflated performance metrics to push brands toward its fledgling ecommerce ad product.

The company's motivation, the complaint says, was in part to combat Apple's 2021 privacy changes that cut the troves of iOS tracking information that had long powered Meta's ad machine. Meta's former chief financial officer (CFO), David Wehner, said the changes would cost "on the order of $10 billion" in losses during the company's Q4 2021 earnings call. User purchases on Facebook or Instagram Shops pages would provide more first-party data, however. Purkayastha, who joined Meta (then Facebook) in 2020 as a product manager on the Facebook Artificial Intelligence Applied Research team, was reassigned to the Shops Ads team in March 2022 and remained at the company until Feb. 19, 2025, when he was terminated.

He alleged that during internal reviews in early 2024, Meta data scientists found the return on ad spend (ROAS) from Shops ads had been inflated between 17% and 19%. This discrepancy stemmed from Meta counting shipping fees and taxes as part of a sale, even though that money never went to merchants, he alleged. The company's other ad products exclude those figures, in line with competitors like Google, the complaint reads. Without including the fees and taxes, Shops ads performed no better than Meta's traditional ads, Purkayastha claimed. "This was significant," the complaint reads. "In addition to the ROAS performance metric being overstated by nearly a fifth, it meant that, rather than having exceeded our primary target, the Shops Ads team had in fact missed it once the figure was reduced to take account of the artificial inflation." Purkayastha raised these concerns with senior leadership in multiple meetings between 2022 and 2024, and is now seeking interim relief through his employment tribunal filing to have his former position reinstated.

A Meta spokesperson told ADWEEK the company is "actively defending these proceedings," adding that "allegations related to the integrity of our advertising practices are without merit and we have full confidence in our performance review processes."

The women-only dating-advice app Tea "has been hit with 10 potential class action lawsuits in federal and state court," NBC News reported last week, "after a data breach led to the leak of thousands of selfies, ID photos and private conversations online." The suits could result in Tea having to pay tens of millions of dollars in damages to the plaintiffs, which could be catastrophic for the company, an expert told NBC News... One of the suits lists the right-wing online discussion board 4chan and the social platform X as defendants, alleging that they allowed bad actors to spread users' personal information.
But meanwhile, a new competing app for men called "TeaOnHer" has already been launched. And it was also found to have enormous security flaws, reports TechCrunch, that "exposed its users' personal information, including photos of their driver's licenses and other government-issued identity documents..." [W]hen we looked at the TeaOnHer's public internet records, it had no meaningful information other than a single subdomain, appserver.teaonher.com. When we opened this page in our browser, what loaded was the landing page for TeaOnHer's API (for the curious, we uploaded a copy here)... It was on this landing page that we found the exposed email address and plaintext password (which wasn't that far off from "password") for [TeaOnHer developer Xavier] Lampkin's account to access the TeaOnHer "admin panel"... This API landing page included an endpoint called /docs, which contained the API's auto-generated documentation (powered by a product called Swagger UI) that contained the full list of commands that can be performed on the API [including administrator commands to return user data]...

While it's not uncommon for developers to publish their API documentation, the problem here was that some API requests could be made without any authentication — no passwords or credentials were needed...

The records returned from TeaOnHer's server contained users' unique identifiers within the app (essentially a string of random letters and numbers), their public profile screen name, and self-reported age and location, along with their private email address. The records also included web address links containing photos of the users' driver's licenses and corresponding selfies. Worse, these photos of driver's licenses, government-issued IDs, and selfies were stored in an Amazon-hosted S3 cloud server set as publicly accessible to anyone with their web addresses. This public setting lets anyone with a link to someone's identity documents open the files from anywhere with no restrictions...

The bugs were so easy to find that it would be sheer luck if nobody malicious found them before we did. We asked, but Lampkin would not say if he has the technical ability, such as logs, to determine if anyone had used (or misused) the API at any time to gain access to users' verification documents, such as by scraping web addresses from the API. In the days since our report to Lampkin, the API landing page has been taken down, along with its documentation page, and it now displays only the state of the server that the TeaOnHer API is running on as "healthy."
The flaws were discovered while TeaOnHer was the #2 free app in the Apple App Store, the article points out. And while these flaws "appear to be resolved," the article notes a larger issue. "Shoddy coding and security flaws highlight the ongoing privacy risks inherent in requiring users to submit sensitive information to use apps and websites,"

And TeaOnHer also had another authentication issue. A female reporter at Cosmopolitan also noted Friday that TeaOnHer "lets you browse through profiles before your verifications are complete. So literally anyone (like myself) can read reviews..."

14 months ago a jury ruled against Boeing, awarding $81 million in damages to failed electric airplane startup Zunum. "Zunum alleged that Boeing, while ostensibly investing seed money to get the startup off the ground, stole Zunum's technology and actively undermined its attempts to build a business," the Seattle Times reported at the time.

But two months later that verdict was overturned, Reuters reports, with U.S. District Judge James Robart deciding that Zunum "did not adequately identify its secrets or show that they derived their value from being kept secret."

And then three days ago a U.S. appeals court reinstated the original $81 million award, reversing that district judge's decision and "rejecting his finding that the information Boeing allegedly stole was not entitled to trade-secret protection." [T]he district court erred in concluding that "Zunum failed to identify any of its alleged trade secrets with sufficient particularity"... Here, the court rejected Zunum's repeated attempts to introduce comprehensive trade secret definitions into evidence and instead provided the jury with a court-created exhibit enumerating Zunum's alleged trade secrets with a short description of each. Zunum's witnesses identified the trade secrets by number, provided a basic explanation of each, and used exhibits and demonstratives to exemplify information comprising specific trade secrets.
"internal Boeing communications introduced at trial suggesting that Boeing intended to modify its own in-house designs, methods, and strategies to incorporate information from certain Zunum trade secrets..." according to the new ruling. "Under the parties' agreement, Boeing was not permitted to use Zunum's confidential information for any reason other than to manage its investment in Zunum."

Reuters adds that "A spokesperson for Boeing declined to comment on the appeals court's decision"

One final note: The appeals court also ordered the case to be assigned to a new judge after Robart revealed that his wife had acquired Boeing stock through a retirement savings account during the litigation.
Judge Robart had called that an "error". (And judicial ethics experts interviewed by Business Insider in 2024 "characterized Robart's trades and delayed disclosure to the parties as a minor issue," they reported Thursday.)

But Thursday's ruling notes that the delayed disclosure "taken together with the district court's consistent rulings in Boeing's favor during and after trial, could give an objective observer reason to question the district judge's impartiality in further proceedings."

Three years ago security researcher Eaton Zveare discovered a vulnerability in Jacuzzi's SmartTub interface allowing access to the personal data of every hot tub owner.

Now Zverae says flaws in an unnamed carmaker's dealership portal "exposed the private information and vehicle data of its customers," reports TechCrunch, "and could have allowed hackers to remotely break into any of its customers' vehicles." Zveare, who works as a security researcher at software delivery company Harness, told TechCrunch the flaw he discovered allowed the creation of a ["national"] admin account that granted "unfettered access" to the unnamed carmaker's centralized web portal. With this access, a malicious hacker could have viewed the personal and financial data of the carmaker's customers, tracked vehicles, and enrolled customers in features that allow owners — or the hackers — to control some of their cars' functions from anywhere.

Zveare said he doesn't plan on naming the vendor, but said it was a widely known automaker with several popular sub-brands.

In an interview with TechCrunch ahead of his talk at the Def Con security conference in Las Vegas on Sunday, Zveare said the bugs put a spotlight on the security of these dealership systems, which grant their employees and associates broad access to customer and vehicle information... The flaws were problematic because the buggy code loaded in the user's browser when opening the portal's login page, allowing the user — in this case, Zveare — to modify the code to bypass the login security checks. Zveare told TechCrunch that the carmaker found no evidence of past exploitation, suggesting he was the first to find it and report it to the carmaker.

When logged in, the account granted access to more than 1,000 of the carmakers' dealers across the United States, he told TechCrunch... With access to the portal, Zveare said it was also possible to pair any vehicle with a mobile account, which allows customers to remotely control some of their cars' functions from an app, such as unlocking their cars... "The takeaway is that only two simple API vulnerabilities blasted the doors open, and it's always related to authentication," said Zveare. "If you're going to get those wrong, then everything just falls down."
Zveare told TechCrunch the portals even included "telematics systems that allowed the real-time location tracking of rental or courtesy cars...

"Zveare said the bugs took about a week to fix in February 2025 soon after his disclosure to the carmaker."

Thanks to long-time Slashdot reader schwit1 for sharing the article.

Proton has begun relocating infrastructure outside Switzerland ahead of proposed surveillance legislation requiring VPNs and messaging services with over 5,000 users to identify customers and retain data for six months.

The company's AI chatbot Lumo became the first product hosted on German servers rather than Swiss infrastructure. CEO Andy Yen confirmed the decision and a spokesperson told TechRadar that the company isn't fully exiting Switzerland.

In a blog post about the launch of Lumo last month, Proton's Head of Anti-Abuse and Account Security, Eamonn Maguire, explained that the company had decided to invest outside Switzerland for fear of the looming legal changes. He wrote: "Because of legal uncertainty around Swiss government proposals to introduce mass surveillance -- proposals that have been outlawed in the EU -- Proton is moving most of its physical infrastructure out of Switzerland. Lumo will be the first product to move."

The proposed amendments to Switzerland's Ordinance on the Surveillance of Correspondence by Post and Telecommunications would also mandate decryption capabilities for providers holding encryption keys. Proton is developing additional facilities in Norway.

Top fintech and crypto executives urged the Trump administration to block US banks from charging fees for access to customer data, levies that strike at the heart of their business models. From a report: Klarna, Robinhood and crypto exchange Gemini were among a long list of companies, investors and lobbying groups that signed a letter sent Wednesday to President Donald Trump, arguing that the proposed fees would "cripple" innovation and "may cause small businesses and financial tools to shut down entirely."

JPMorgan Chase has told fintechs and the data aggregators they rely on that the bank's customer account information will no longer be accessible without a charge. JPMorgan, the biggest US bank, views the data aggregators as freeloaders of sorts who access data without paying and then charge their fintech clients for it. PNC Financial Services is considering charging similar fees.

"We urge you to use the full power of your office and the broader administration to prevent the largest institutions from raising new barriers to financial freedom," they said in the letter. "We cannot allow the most powerful, entrenched banks to close the door on a more open and modern financial system."

Legal scholar Victoria Haneman argues that U.S. law should grant estates a time-limited right to delete a deceased person's data so they can't be recreated by AI without their consent. "Digital resurrection by or through AI requires the personal data of the deceased, and the amount of data that we are storing online is increasing exponentially with each passing year," writes Haneman in an article published earlier this year in the Boston College Law Review. "It has been said that data is the new uranium, extraordinarily valuable and potentially dangerous. A right to delete will provide the decedent with a time-limited right for deletion of personal data." The Register reports: A living person may have some say on the matter through the control of personal digital documents and correspondence. But a dead person can't object, and US law doesn't offer the dead much data protection in terms of privacy law, property law, intellectual property law, or criminal law. The Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA), a law developed to help fiduciaries deal with digital files of the dead or incapacitated, can come into play. But Haneman points out that most people die intestate (without a will), leaving matters up to tech platforms. Facebook's response to dead users is to allow anyone to request the memorialization of an account, which keeps posts online. As for RUFADAA, it does little to address digital resurrection, says Haneman.

The right to publicity, which provides a private right of action against unauthorized commercial use of a person's name, image, or likeness, covers the dead in about 25 states, according to Haneman. But the monetization of publicity rights has proven to be problematic. Haneman says that there are some states where it's theoretically possible to be prosecuted for libeling or defaming the deceased, such as Idaho, Nevada, and Oklahoma, but adds that such prosecutions have declined because they tread upon the constitutional right to free expression. [...] A recent California law, the Delete Act, which took effect last year, is the first to offer a way for the living to demand the deletion of personal data from data brokers in one step. But according to Haneman, it's unclear whether the text of the law will be extended to cover the dead -- a possibility think tank Aspen Tech Policy Hub supports [PDF].

Haneman argues that a data deletion law for the dead would be grounded in laws governing human remains, where corpses receive protection against abuse despite being neither a person nor property. "The personal representative of the decedent has the right to destroy all physical letters and photographs saved by the decedent; merely storing personal information in the cloud should not grant societal archival rights," she argues. "A limited right of deletion within a twelve-month window balances the interests of society against the rights of the deceased."