After an inquiry from The New York Times reporters, Zoom said it would disable a data-mining feature that could be used to snoop on participants during meetings without their knowledge. From a report: For Americans sheltering at home during the coronavirus pandemic, the Zoom videoconferencing platform has become a lifeline, enabling millions of people to easily keep in touch with family members, friends, students, teachers and work colleagues. But what many people may not know is that, until Thursday, a data-mining feature on Zoom allowed some participants to surreptitiously access LinkedIn profile data about other users -- without Zoom asking for their permission during the meeting or even notifying them that someone else was snooping on them. The undisclosed data mining adds to growing concerns about Zoom's business practices at a moment when public schools, health providers, employers, fitness trainers, prime ministers and queer dance parties are embracing the platform. An analysis by The New York Times found that when people signed in to a meeting, Zoom's software automatically sent their names and email addresses to a company system it used to match them with their LinkedIn profiles.

An anonymous reader writes: We keep seeing stories about how providers are slowing down their streaming speed to reduce bandwidth usage during this period when many are being asked to stay at home... But it seems that many are totally ignoring a very obvious way to reduce usage significantly, and that is by disabling autoplay on their web sites and in their apps.

To give an example, a couple of days ago I was watching a show on Hulu, and either I was more sleepy than I thought or the show was more boring than I had expected (probably some combination of both), but I drifted off to sleep. Two hours later I awoke and realize that Hulu had streamed two additional episodes that no one was watching. I searched in vain for a way to disable autoplay of the next episode, but if there is some way to do it I could not find it.

What I wonder is how many people even want autoplay? I believe Netflix finally gave their users a way to disable it, but they need to affirmatively do so via a setting somewhere. But many other platforms give their users no option to disable autoplay. That is also true of many individual apps that can be used on a Roku or similar device. If conserving bandwidth is really that important, then my contention is that autoplaying of the next episode should be something you need to opt in for, not something enabled by default that either cannot be disabled or that forces the user to search for a setting to disable.
"Firefox will disable autoplay," writes long-time Slashdot user bobs666 (adding "That's it use Firefox.") And there are ways to disable autoplay in the user settings on Netflix, YouTube, Hulu, and Amazon Prime.

But wouldn't it make more sense to disable autoplay by default -- at least for the duration of this unusual instance of peak worldwide demand?

I'd be interested in hearing from Slashdot's readers. Do you use autoplay -- or have you disabled it? And do you think streaming companies should turn it off by default?

An anonymous reader quotes a report from Bleeping Computer: A new cyber attack is hijacking router's DNS settings so that web browsers display alerts for a fake COVID-19 information app from the World Health Organization that is the Oski information-stealing malware. For the past five days, people have been reporting their web browser would open on its own and display a message prompting them to download a 'COVID-19 Inform App' that was allegedly from the World Health Organization (WHO). After further research, it was determined that these alerts were being caused by an attack that changed the DNS servers configured on their home D-Link or Linksys routers to use DNS servers operated by the attackers. As most computers use the IP address and DNS information provided by their router, the malicious DNS servers were redirecting victims to malicious content under the attacker's control. "If your browser is randomly opening to a page promoting a COVID-19 information app, then you need to login to your router and make sure you configure it to automatically receive its DNS servers from your ISP," the report says. It also recommends you set a strong password for your router and to disable remote administration.

"Finally, if you downloaded and installed the COVID-19 app, you should immediately perform a scan on your computer for malware. Once clean, you should change all of the passwords for sites whose credentials are saved in your browser and you should change the passwords for any site that you visited since being infected."

Amazon said on Tuesday that it is temporarily discontinuing accepting orders for "lower-priority" products in India and prioritizing servicing urgent items such as household staples, health care, and personal safety products as the e-commerce player -- along with several of its competitors -- grapples with coronavirus outbreak in one of its key overseas markets. From a report: "To serve our customers' most urgent needs while also ensuring safety of our employees, we are temporarily prioritizing our available fulfilment and logistics capacity to serve products that are currently critical for our customers such as household staples, packaged food, health care, hygiene, personal safety and other high priority products," the American e-commerce giant said in a statement. "This also means that we have to temporarily stop taking orders and disable shipments for lower-priority products," it added. Understandably, the company said it did not have a timeline to share for how long this new measure would last. Amazon has taken a similar approach in the U.S. and Italy. The move, which goes into effect today, comes as nearly every Indian state has imposed a lockdown to prevent the spread of COVID-19.

Mozilla has announced plans to remove support for the FTP protocol from Firefox. Going forward, users won't be able to download files via the FTP protocol and view the content of FTP links/folders inside the Firefox browser. From a report: "We're doing this for security reasons," said Michal Novotny, a software engineer at the Mozilla Corporation, the company behind the Firefox browser. "FTP is an insecure protocol and there are no reasons to prefer it over HTTPS for downloading resources," he said. "Also, a part of the FTP code is very old, unsafe and hard to maintain and we found a lot of security bugs in it in the past." Novotny says Mozilla plans to disable support for the FTP protocol with the release of Firefox 77, scheduled for release in June this year.

Several pundits criticized Google for warning Edge users to switch to Chrome if they wanted to use Chrome extensions "securely". "In Chrome, a plugin can be remotely disabled by the Chrome team if it's considered unsafe for whatever reason," notes PC World. "Google lacks the ability to remotely disable the same plugin within Edge, prompting Google to recommend switching to Chrome, a source close to Google said."

Though PC World notes that Google isn't giving the same warning to Opera users...

Yet now when you try to add Chrome Extensions to Edge, Microsoft also gives you a warning of its own -- that extensions installed from sources other than the Microsoft Store "are unverified [by Microsoft], and may affect browser performance." And while Google.com is still displaying an ad for Chrome to web surfers using Edge, now if you search for "Chrome web store" on Bing, the first result is an ad ("promoted by Microsoft") for Microsoft's own Edge browser.

ZDNet's Chris Matyszczyk asked both Google and Microsoft for a comment: [N]othing from Google. But suddenly, a confirmation from Microsoft that it wouldn't offer official comment. My sniffings around Google suggest the company may have been taken aback by the positive public reaction to Edge... My nasal probings around Redmond offer the reasoning that, well, Microsoft hasn't tested or verified extensions that arrive from places other than they Microsoft Edge add-ons website. Why, they're far too busy to do that. And, well, it's the Chrome web store. Who knows what you'll find over there? Oh, and Edge gives you more control over your data, so there.

Could it be, then, that Google is being vacuously childish and trying to scare people into resisting the lures of Microsoft's browser handiwork? Could it also be that Microsoft is doing something rather similar in either retaliation or merely homage to the brutally competitive instincts of social activist Bill Gates?

Could it be that both of these companies should pause to examine their consciences, go sit in a corner and embrace their customers' needs and choices a touch more fully?

Long-time Slashdot reader Garabito writes: The Department of Homeland Security has revealed that an unnamed U.S. natural gas compression facility was forced to shut down operations for two days after becoming infected with ransomware.

The plant was targeted with a phishing e-mail, that allowed the attacker to access its IT network and then pivot to its Operational Technology (OT) control network, where it compromised Windows PCs used as human machine interface, data historians and polling servers, which led the plant operator to shut it down along with other assets that depended on it, including pipelines.

According to the DHS CISA report, the victim failed to implement robust segmentation between the IT and OT networks, which allowed the adversary to traverse the IT-OT boundary and disable assets on both networks.

The "Suggested" section on the Windows 10 Start Menu used to just promote its own apps, reports MSPowerUser. But for some users (who haven't disable Microsoft's "Suggestions"), that menu is now showing a new kind of ad listing: The listing displays "Still using Firefox? Microsoft Edge is here", to all users of the former -- even with the latter already installed.

The ad provides a link to download the chromium-based browser.

Undoubtedly, the suggestions won't end here. Microsoft is reportedly planning to sprawl similar ads out to Wordpad, to encourage users to download official Office apps.
The Windows Latest blog points out that Microsoft's "Suggestions" can be "permanently disabled with a few tweaks unlike the Chrome ads in Google search results."

A ransomware gang is installing vulnerable GIGABYTE drivers on computers it wants to infect. From a report: The purpose of these drivers is to allow the hackers to disable security products so their ransomware strain can encrypt files without being detected or stopped. This new novel technique has been spotted in two ransomware incidents so far, according to UK cybersecurity firm Sophos. In both cases, the ransomware was RobbinHood, a strain of "big-game" ransomware that's usually employed in targeted attacks against selected, high-value targets. In a report published late last night, Sophos described this new technique as follows:
1. Ransomware gang gets a foothold on a victim's network.
2. Hackers install legitimate Gigabyte kernel driver GDRV.SYS.
3. Hackers exploit a vulnerability in this legitimate driver to gain kernel access.
4. Attackers use the kernel access to temporarily disable the Windows OS driver signature enforcement.
5. Hackers install a malicious kernel driver named RBNL.SYS.
6. Attackers use this driver to disable or stop antivirus and other security products running on an infected host.
7. Hackers execute the RobbinHood ransomware and encrypt the victim's files

Netflix announced today that subscribers will now be able to disable the autoplay functionality that occurs on its homepage. The Verge reports: People can choose to disable autoplay in two different formats: one that automatically starts the next episode in a series and one that autoplays previews while browsing. Netflix rolled out an option to disable autoplay with episodes in a series way back in 2014, but this new setting specifically relates to the autoplay previews on the homepage.

Both features have amassed tons of complaints from subscribers and creators. Star Wars: The Last Jedi and Knives Out director Rian Johnson tweeted his "current favorite console game: navigating Netflix without triggering autoplay promos." There are Reddit threads, YouTube videos, and, of course, tweets from angry customers who have asked Netflix to please, for the love of all that's good in the world, stop with the annoying autoplay features. One person was so frustrated that they created an entire Twitter account just to ask Netflix to please stop. Users can visit an updated help page on Netflix's website to learn how to disable the function.

Amazon's Ring doorbell has rolled out a new update that lets users add and remove shared users on an account, restrict third-party access, view two-factor authentication settings, and (perhaps, most importantly) opt out of all video request notifications from law enforcement. Mashable reports: Uncovered in reporting by Motherboard and Gizmodo in 2019, the scale of Amazon's Neighbor Portal program is much larger than originally believed -- and its various affiliations with law enforcement has raised alarming ethical questions. In the new update, users will be able to see an "Active Law Enforcement Map" clarifying which local institutions are part of the Neighbor Portal network. They will also be able to disable requests for video from officials, whether or not they have received one in the past. (This feature was available previously, but an account had to have received one request for the opt-out option to appear.)

That said, Ring is suggesting users allow video request notifications -- citing specific instances where such evidence helped solve criminal cases. According to Ring's official press release, the control center update will be made available to all Android and iOS users within "the next few days." Per the same release, this is the first of numerous security and privacy updates planned for the system.

"A Russian satellite has positioned itself uncomfortably close to an American spy satellite in orbit around Earth..." reports the Verge, adding that the Russian satellite "has been in constant view of its U.S. target for nearly two weeks now."

An anonymous reader quotes The Drive: Russia has a number of what it calls "space apparatus inspectors" in orbit, which the U.S. government and others warn the Kremlin could use to gather intelligence on other satellites or function as "killer satellites," using various means to damage, disable, or destroy those targets.

On Jan. 30, 2020, Michael Thompson, a graduate student at Purdue University focusing on astrodynamics, posted a detailed thread on Twitter... [H]ow Cosmos 2542 is orbiting now means that it now has a "consistent view" of USA 245. "As I'm typing this, that offset distance shifts between 150 and 300km depending on the location in the orbit," according to Thompson....

One possibility is that it could be using onboard systems, such as cameras or other sensors, to gather information about the [U.S. satellite] KH-11, the capabilities of which are highly classified... It may also be possible to gather electronic or signals intelligence data that could be of additional value. Beyond that, the ability of Cosmos 2542 to get into this position at all is notable and is exactly the kind of orbital maneuvering that the U.S. government had pointed to in the past as evidence of potential "killer satellites." A highly maneuverable, but small satellite could possibly get close enough to disrupt the operation of, disable, or destroy another object in space using a variety of means, ranging from electronic warfare jammers to directed energy weapons, such as a laser...

Russia is known to be interested in anti-satellite capacities and has developed or is developing a number of terrestrial anti-satellite weapons, including ground-based and air-launched interceptors, too. China is pursuing similar developments, as well.


The article points out that is all happening "as the U.S. military is very publicly working to address concerns about the increasing vulnerability of various space-based systems that it relies on heavily... The most obvious expression of this recent push is the creation of U.S. Space Force, an entirely new branch of the U.S. military to focus on American military activities in and related to space, as well as the procurement of satellites and other related systems and infrastructure."

And then late Saturday night, Thompson posted another update on Twitter: that the Russian satellite had made yet another manuever on Friday, "and is now drifting back towards USA 245."

Long-time Slashdot reader Motor writes: Rocket League — a very popular multiplayer game — will no longer "be patched" for Linux and the Mac after March — say the publisher, Psyonix...

The publishers say it's motivated by the need to support unspecified "new technologies".

Thanks Psyonix.
The announcement says their final patch "will disable online functionality (such as in-game purchases) for players on macOS and Linux, but offline features including Local Matches, and splitscreen play will still be accessible."

"Players on Mac can try running Rocket League on Windows with Apple's Boot Camp tool," explains a support page, while adding in the next sentence that "Boot Camp is not something Psyonix officially supports." And if you play Rocket League on Linux, "you can try Steam's Proton app or Wine. These tools are not officially supported by Psyonix."

The support page also includes instructions on how to request a refund.

In light of this week's rumor that a Pro Mode -- which will supposedly boost performance on Macs with Catalina operating system -- may be coming, long time developer and Apple commentator Marco Arment makes the case for a Low Power Mode on macOS. He writes: Modern hardware constantly pushes thermal and power limits, trying to strike a balance that minimizes noise and heat while maximizing performance and battery life. Software also plays a role, trying to keep everything background-updated, content-indexed, and photo-analyzed so it's ready for us when we want it, but not so aggressively that we notice any cost to performance or battery life. Apple's customers don't usually have control over these balances, and they're usually fixed at design time with little opportunity to adapt to changing circumstances or customer priorities.

The sole exception, Low Power Mode on iOS, seems to be a huge hit: by offering a single toggle that chooses a different balance, people are able to greatly extend their battery life when they know they'll need it. Mac laptops need Low Power Mode, too. I believe so strongly in its potential because I've been using it on my laptops (in a way) for years, and it's fantastic. I've been disabling Intel Turbo Boost on my laptops with Turbo Boost Switcher Pro most of the time since 2015. In 2018, I first argued for Low Power Mode on macOS with a list of possible tweaks, concluding that disabling Turbo Boost was still the best bang-for-the-buck tweak to improve battery life without a noticeable performance cost in most tasks.

Recently, as Intel has crammed more cores and higher clocks into smaller form factors and pushed thermal limits to new extremes, the gains have become even more significant. [...] With Turbo Boost disabled, peak CPU power consumption drops by 62%, with a correspondingly huge reduction in temperature. This has two massive benefits: The fans never audibly spin up. [...] It runs significantly cooler. Turbo Boost lets laptops get too hot to comfortably hold in your lap, and so much heat radiates out that it can make hands sweaty. Disable it, and the laptop only gets moderately warm, not hot, and hands stay comfortably dry. I haven't done formal battery testing on the 16-inch, since it's so difficult and time-consuming to do in a controlled way that's actually useful to people, but anecdotally, I'm seeing similar battery gains by disabling Turbo Boost that I've seen with previous laptops: significantly longer battery life that I'd estimate to be between 30-50%.

Apple's initiatives to minimize tracking by marketers is continuing to make life harder for the advertising industry, forcing advertisers to use inefficient data sources to pinpoint users. AppleInsider reports: Over the years, Apple has enhanced how it protects the privacy of its users online, typically by limiting what data can be seen by advertisers tracking different data points. Initiatives such as Intelligent Tracking Protection in Safari has helped secure more privacy by making it harder to track individual users, which advertising executives in December admitted has been "stunningly effective." While ITP and other improvements have helped to minimize the tracking of users, marketers are also being affected by another element of iOS 13, one where users are regularly notified of apps that are capturing their location in the background. The warning gives options for users to allow an app to continue to track all the time or to do so when it is open, with users often selecting the latter.

According to data from verification firm Location Sciences seen by DigiDay, approximately seven in ten iPhone users tracked by the company downloaded iOS 13 in its first six weeks of availability. Of those tracked users who installed the update, around 80% of them stopped all background tracking by apps. Ad tracking company Teemo suggests the opt-in rates to share data with apps when not in use are often below 50%, whereas three years ago, the same rates were close to 100%. The higher rates were due to it being a time when users were largely unaware there were options to disable tracking in the first place.

The prospect of using the popular genome-editing tool CRISPR to treat a host of diseases in people is moving closer to reality. From a report: Medical applications of CRISPR-Cas9 had a banner year in 2019. The first results trickled in from trials testing the tool in people, and more trials launched. In the coming years, researchers are looking ahead to more sophisticated applications of CRISPR genome editing that could lay the foundation for treating an array of diseases, from blood disorders to hereditary blindness. But although the results of clinical trials of CRISPR genome editing so far have been promising, researchers say that it is still too soon to know whether the technique will be safe or effective in the clinic. "There's been a lot of appropriate caution in applying this to treating people," says Edward Stadtmauer, an oncologist at the University of Pennsylvania in Philadelphia. "But I think we're starting to see some of the results of that work."

It has only been seven years since researchers discovered that a molecular defence system called CRISPR-Cas9, which microbes use to fend off viruses and other invaders, could be harnessed to rewrite human genes. Since then gene-editing has attracted attention for its potential to modify embryos -- an application that is ethically and legally fraught if those embryos are destined to become human beings. But in parallel, scientists have been testing CRISPR's much less controversial ability to disable or correct problematic genes in other cells in order to treat a host of diseases.

New submitter jasonbuechler writes: Related to the Xiaomi post the other day, Google has entirely disabled Google Assistant/Home integration with Xiaomi devices pending further testing. Google issued the following statement:

Hi everyone,

Late night on January 1st, we were made aware of an issue where a Reddit user posted that their Nest Hub was able to access other people's Xiaomi camera feeds. We've been working with Xiaomi and we're comfortable that the issue was limited to their camera technology platform. While we worked on this issue with Xiaomi, we made the decision to disable all Xiaomi integrations on our devices. We understand this had a significant impact on users of Xiaomi devices but the security and privacy of our users is our priority and we felt this was the appropriate action.

We're re-enabling Xiaomi device integrations for everything but camera streaming after necessary testing has been completed. We will not reinstate camera functionality for Xiaomi devices until we are confident that the issue has been fully resolved. We'll keep you updated with information as more becomes available to share. UPDATE: Speaking to Engadget, Xiaomi says that the issue occurred due to a cache update, which made the stills pop up if a user had that camera and that display under poor network conditions. According to the company, only 1,044 users had this setup with a "few" experiencing the poor network connection that would make it appear, and they have fixed the issue on their end. The full statement is available on Engadget's report.

Long-time Slashdot reader twocows writes: Hyperbola GNU/Linux, a FSF-approved distribution of GNU/Linux, has declared their intent to fork OpenBSD and become HyperbolaBSD..."
The news came earlier this week in a roadmap announcement promising "a completely new OS derived from several BSD implementations" (though Hyperbola was originally based on Arch snapshots and Debian development).

"This was not an easy decision to make, but we wish to use our time and resources to create a viable alternative to the current operating system trends which are actively seeking to undermine user choice and freedom." In 2017 Hyperbola dropped its support for systemd -- but its concerns go far beyond that: This will not be a "distro", but a hard fork of the OpenBSD kernel and userspace including new code written under GPLv3 and LGPLv3 to replace GPL-incompatible parts and non-free ones.

Reasons for this include:

- Linux kernel forcing adaption of DRM, including HDCP.

- Linux kernel proposed usage of Rust (which contains freedom flaws and a centralized code repository that is more prone to cyber attack and generally requires internet access to use.)

- Linux kernel being written without security and in mind. (KSPP is basically a dead project and Grsec is no longer free software)

- Many GNU userspace and core utils are all forcing adaption of features without build time options to disable them. E.g. (PulseAudio / SystemD / Rust / Java as forced dependencies....)

HyperbolaBSD is intended to be modular and minimalist so other projects will be able to re-use the code under free license.

An anonymous reader quotes a report from ZDNet: Academics from three universities across Europe have disclosed today a new attack that impacts the integrity of data stored inside Intel SGX, a highly-secured area of Intel CPUs. The attack, which researchers have named Plundervolt, exploits the interface through which an operating system can control an Intel processor's voltage and frequency -- the same interface that allows gamers to overclock their CPUs. Academics say they discovered that by tinkering with the amount of voltage and frequency a CPU receives, they can alter bits inside SGX to cause errors that can be exploited at a later point after the data has left the security of the SGX enclave. They say Plundervolt can be used to recover encryption keys or introduce bugs in previously secure software. Intel desktop, server, and mobile CPUs are impacted. A full list of vulnerable CPUs is available here. Intel has also released microcode (CPU firmware) and BIOS updates today that address the Plundervolt attack [by allowing users to disable the energy management interface at the source of the attack, if not needed]. Proof-of-concept code for reproducing attacks will be released on GitHub.

Brian Krebs: One of the more curious behaviors of Apple's new iPhone 11 Pro is that it intermittently seeks the user's location information even when all applications and system services on the phone are individually set to never request this data. Apple says this is by design, but that response seems at odds with the company's own privacy policy. The privacy policy available from the iPhone's Location Services screen says, "If Location Services is on, your iPhone will periodically send the geo-tagged locations of nearby Wi-Fi hotspots and cell towers (where supported by a device) in an anonymous and encrypted form to Apple, to be used for augmenting this crowd-sourced database of Wi-Fi hotspot and cell tower locations."

The policy explains users can disable all location services entirely with one swipe (by navigating to Settings > Privacy > Location Services, then switching "Location Services" to "off"). When one does this, the location services indicator -- a small diagonal upward arrow to the left of the battery icon -- no longer appears unless Location Services is re-enabled. The policy continues: "You can also disable location-based system services by tapping on System Services and turning off each location-based system service." But apparently there are some system services on this model (and possibly other iPhone 11 models) which request location data and cannot be disabled by users without completely turning off location services, as the arrow icon still appears periodically even after individually disabling all system services that use location.