Games

Game Dev Says Contract Barring 'Subjective Negative Reviews' Was a Mistake (arstechnica.com) 26

The developers of team-based shooter Marvel Rivals have apologized for a contract clause that made creators promise not to provide "subjective negative reviews of the game" in exchange for early access to a closed alpha test. From a report: The controversial early access contract gained widespread attention over the weekend when streamer Brandon Larned shared a portion on social media. In the "non-disparagement" clause shared by Larned, creators who are provided with an early download code are asked not to "make any public statements or engage in discussions that are detrimental to the reputation of the game." In addition to the "subjective negative review" example above, the clause also specifically prohibits "making disparaging or satirical comments about any game-related material" and "engaging in malicious comparisons with competitors or belittling the gameplay or differences of Marvel Rivals."
Transportation

The Automotive Cold War Is Officially Underway (insideevs.com) 170

Tim Levin reports via InsideEVs: Two things of note in the electric vehicle world happened today around the same time. First, the Geely Group-owned Chinese EV brand Zeekr debuted on the New York Stock Exchange today at a valuation of around $5.2 billion. Then, around 250 miles south in Washington, D.C., news emerged that the Biden Administration is set to quadruple tariffs on Chinese-made electric cars if they hit American roads. The timing may be purely coincidental. But after this week, one thing feels clearer than ever: the automotive Cold War between China and the West is fully underway, and EVs specifically are at the center of it all.

The Wall Street Journal got the scoop that the White House plans to announce higher tariffs on Chinese clean-energy imports in the coming days. Under the reported new policies, tariffs on Chinese EVs are set to quadruple, rising from the current 25% to a whopping 100%, anonymous sources told the outlet. In theory, that would substantially increase the cost of any Chinese-made EVs on our market, including, potentially, ones sold by known Western and other Asian brands. It's no secret why the U.S. is attempting to push back on Chinese EVs, to say nothing of other clean energy imports from that country like solar panels. China has spent years aggressively building up its capacity to manufacture electric cars. It's developed a stranglehold on the supply chains for lithium-ion batteries and the critical minerals they contain. It has lavished state incentives on both EV production and purchasing. In recent years, the country has emerged as a global EV powerhouse -- and, for the first time ever, an exporter on par with leaders like Japan and Germany.

Many still believe that China's cars are cheap and technologically subpar. But the truth is China has learned to build cars very, very well, as InsideEVs' own Kevin Williams discovered during a recent trip to the Beijing auto show. China's homegrown electrified vehicles range from the inexpensive -- some, like the BYD Seagull, cost less than $10,000 in their home market -- to higher-end, luxury-focused offerings like the Yangwang U8, a kind of plug-in hybrid competitor to the Mercedes G-Class that can "float" on water. From batteries to software, most are incredibly advanced. Car companies and policymakers in the U.S. (and Europe) say these cars pose a real threat to our nascent EV market, where many options still remain unaffordable and things like batteries and software are works in progress. In response, European Union officials have also launched investigations into Chinese imports that could lead to stronger tariffs.
"In effect, the tariffs may end up buying the U.S. some time, rather than being a permanent solution here," concludes Levin. "After all, as Kevin Williams pointed out after going to Beijing: all of these crackdowns aren't guaranteed to yield better cars from Ford, General Motors and the rest."

According to the WSJ, the new tariffs on Chinese goods will also apply to solar panels, batteries and critical battery minerals. They're expected to be announced as soon as next week.
Japan

Japan is Fighting Against the Entire Investing World in the Currency Market (sherwood.news) 50

An anonymous reader shares a report: Japan's Ministry of Finance spent nearly $50 billion on April 29 and May 1 trying to prop up the value of the currency by selling US dollars and buying yen. Who was on the other side of this trade? Data from Deutsche Bank's foreign exchange trading platform suggests: literally everyone. "Nearly all client categories saw record USD/JPY buying during the assumed intervention days," writes George Saravelos, global head of FX research at the German bank, in a note to clients on Thursday.

"That absorption of USD/JPY selling from the Japanese Ministry of Finance was so broad-based continues to point to the lack of effectiveness of this policy." The Japanese yen is the weakest G10 currency in trading on Thursday, deepening its decline relative to the US dollar to nearly 10% so far this year. Very low rates in Japan increase the appeal of holding other currencies where investors can earn more interest. Strategists have warned that action from the Bank of Japan may be needed to reinforce the Ministry of Finance's attempts to guard against further yen weakness.

Bitcoin

FTX Customers Poised to Recover All Funds Lost in Collapse (nytimes.com) 44

Lawyers for the defunct cryptocurrency exchange FTX said customers would receive all the money they lost when the firm collapsed in 2022 and receive interest on top of it. "But the recoveries come with a caveat," reports the New York Times. "The amount owed to customers was calculated based on the value of their holdings at the time of FTX's bankruptcy in November 2022. That means customers won't reap the benefits of a recent surge in the crypto market that sent the price of Bitcoin to a record high." From the report: The announcement was a landmark in the attempt to recover the $8 billion in customer assets that disappeared when FTX imploded virtually overnight, setting off a crisis in the crypto industry. Under a plan filed in federal bankruptcy court in Delaware, virtually all FTX's creditors, including hundreds of thousands of ordinary investors who used the exchange to buy and sell cryptocurrencies, would receive cash payments equivalent to 118 percent of the assets they had stored on FTX, the lawyers said. Those payments would flow from a pool of assets that FTX's lawyers have pulled together in the 17 months since the exchange collapsed, the lawyers said. [...] It will take months for the payouts to begin. The plan must be approved by the federal judge overseeing FTX's bankruptcy, John T. Dorsey.
Microsoft

Microsoft Readies New AI Model To Compete With Google, OpenAI (theinformation.com) 26

For the first time since it invested more than $10 billion into OpenAI in exchange for the rights to reuse the startup's AI models, Microsoft is training a new, in-house AI model large enough to compete with state-of-the-art models from Google, Anthropic and OpenAI itself. The Information: The new model, internally referred to as MAI-1, is being overseen by Mustafa Suleyman, the ex-Google AI leader who most recently served as CEO of the AI startup Inflection before Microsoft hired the majority of the startup's staff and paid $650 million for the rights to its intellectual property in March. But this is a Microsoft model, not one carried over from Inflection, although it may build on training data and other tech from the startup. It is separate from the Pi models that Inflection previously released, according to two Microsoft employees with knowledge of the effort.

MAI-1 will be far larger than any of the smaller, open source models that Microsoft has previously trained, meaning it will require more computing power and training data and will therefore be more expensive, according to the people. MAI-1 will have roughly 500 billion parameters, or settings that can be adjusted to determine what models learn during training. By comparison, OpenAI's GPT-4 has more than 1 trillion parameters, while smaller open source models released by firms like Meta Platforms and Mistral have 70 billion parameters. That means Microsoft is now pursuing a dual trajectory of sorts in AI, aiming to develop both "small language models" that are inexpensive to build into apps and that could run on mobile devices, alongside larger, state-of-the-art AI models.

Privacy

In Argentina, Facing Surging Inflation, 500K Accept Worldcoin's Offer of $50 for Iris-Scanning (restofworld.org) 67

Wednesday Rest of World noticed an overlooked tech story in Argentina: Olga de León looked confused as she walked out of a nightclub on the edge of Buenos Aires on a recent Tuesday afternoon. She had just had her iris scanned. "No one told me what they'll do with my eye," de León, 57, told Rest of World. "But I did this out of need." De León, who lives off the $95 pension she receives from the state, had been desperate for money. Persuaded by her nephew, she agreed to have one of her irises scanned by Worldcoin, Sam Altman's blockchain project. In exchange, she received nearly $50 worth of WLD, the company's cryptocurrency.

De León is one of about half a million Argentines who have handed their biometric data over to Worldcoin. Beaten down by the country's 288% inflation rate and growing unemployment, they have flocked to Worldcoin Orb verification hubs, eager to get the sign-up crypto bonus offered by the company. A network of intermediaries — who earn a commission from every iris scan — has lured many into signing up for the practice in Argentina, where data privacy laws remain weak. But as the popularity of Worldcoin skyrockets in the country, experts have sounded the alarm about the dangers of giving away biometric data. Two provinces are now pushing for legal investigations. "Seeing that [iris scans have] been banned in European countries, shouldn't we be trying to stop it, too?" Javier Smaldone, a software consultant and digital security expert, told Rest of World.

Last month Worldcoin's web site announced that more than 10 million people in 160 countries had created a World ID and compatible wallet (performing 75 million transactions) — and that 5,195,475 people had also verified their World ID using Worldcoin's iris-scanning Orb.

But the article notes a big drop in the number of countries even allowing Worldcoin's iris-scanning — from 25 to just eight. While in less than a year Worldcoin opened nearly 60 centers across Argentina...
Government

America's Federal Regulators Are Preparing More Lawsuits Against Crypto Companies (politico.com) 23

A "string of legal victories" by America's market-regulating Securities and Exchange Commission "has jolted some of crypto's biggest players," reports Politico — even as they're seeking more credibility with U.S. lawmakers: Judges have recently rebuked claims that the SEC lacks authority to police the market. Coinbase, the largest U.S. exchange, lost a bid to throw out charges that it is violating investor-protection rules. And a New York jury found one-time billionaire entrepreneur Do Kwon and his firm liable for fraud. Now, the crackdown is about to expand, with the SEC preparing for a new round of lawsuits. "The SEC just keeps winning," said John Reed Stark, a former agency attorney and prominent crypto critic. "The law is catching up...."

[I]t's the SEC crackdown that is raising foundational questions about crypto's future. [SEC Chairman Gary] Gensler has been among the industry's most implacable foes, saying most crypto tokens are unregistered securities that are being sold illegally and blasting the industry as "rife with fraud, scams, bankruptcies and money laundering." His opposition has been so unwavering that many in the industry are holding out hope that he leaves the agency after the November elections...

[T]he SEC's enforcement sweep appears to be on the brink of spreading across the crypto world. Consensys is facing potential charges from the agency, according to the company's lawsuit. And the SEC recently warned Uniswap Labs, a decentralized finance company that created one of the world's largest DeFi exchanges, that staff was preparing to sue.

Uniswap executives have vowed to fight the agency in court.

Social Networks

Could Better Data Protections Reduce Big Tech's Polarizing Power? (nbcnews.com) 39

"What if the big tech companies achieved their ultimate business goal — maximizing engagement on their platforms — in a way that has undermined our ability to function as an open society?"

That's the question being asked by Chuck Todd, chief political analyst for NBC News: What if they realized that when folks agree on a solution to a problem, they are most likely to log off a site or move on? It sure looks like the people at these major data-hoarding companies have optimized their algorithms to do just that. As a new book argues, Big Tech appears to have perfected a model that has created rhetorical paralysis. Using our own data against us to create dopamine triggers, tech platforms have created "a state of perpetual disagreement across the divide and a concurrent state of perpetual agreement within each side," authors Frank McCourt and Michael Casey write, adding: "Once this uneasy state of divisive 'equilibrium' is established, it creates profit-making opportunities for the platforms to generate revenue from advertisers who prize the sticky highly engaged audiences it generates."

In their new book, "Our Biggest Fight," McCourt (a longtime businessman and onetime owner of the Los Angeles Dodgers) and Casey are attempting a call to action akin to Thomas Paine's 18th century-era "Common Sense." The book argues that "we must act now to embed the core values of a free, democratic society in the internet of tomorrow." The authors believe many of the current ills in society can be traced to how the internet works. "Information is the lifeblood of any society, and our three-decade-old digital system for distributing it is fatally corrupt at its heart," they write. "It has failed to function as a trusted, neutral exchange of facts and ideas and has therefore catastrophically hindered our ability to gather respectfully to debate, to compromise and to hash out solutions.... Everything, ultimately, comes down to our ability to communicate openly and truthfully with one another. We have lost that ability — thanks to how the internet has evolved away from its open, decentralized ideals...."

Ultimately, what the authors are imagining is a new internet that essentially flips the user agreement 180 degrees, so that a tech company has to agree to your terms and conditions to use your data and has to seek your permission (perhaps with compensation) to access your entire social map of whom and what you engage with on the internet. Most important, under such an arrangement, these companies couldn't prevent you from using their services if you refused to let them have your data... Unlike most anti-Big Tech books, this one isn't calling for the breakup of companies like Meta, Amazon, Alphabet, Microsoft or Apple. Instead, it's calling for a new set of laws that protect data so none of those companies gets to own it, either specifically or in the aggregate...

The authors seem mindful that this Congress or a new one isn't going to act unless the public demands action. And people may not demand this change in our relationship with tech if they don't have an alternative to point to. That's why McCourt, through an organization he founded called Project Liberty, is trying to build our new internet with new protocols that make individual data management a lot easier and second nature. (If you want to understand the tech behind this new internet more, read the book!)

Wait, there's more. The article adds that the authors "envision an internet where all apps and the algorithms that power them are open source and can be audited at will. They believe that simply preventing these private companies from owning and mapping our data will deprive them of the manipulative marketing and behavioral tactics they've used to derive their own power and fortunes at the expense of democracy."

And the NBC News analyst seems to agree. "For whatever reason, despite our societal fear of government databases and government surveillance, we've basically handed our entire personas to the techies of Silicon Valley."
Microsoft

Microsoft Concern Over Google's Lead Drove OpenAI Investment (yahoo.com) 10

Microsoft's motivation for investing heavily and partnering with OpenAI came from a sense of falling badly behind Google, according to an internal email released Tuesday as part of the Justice Department's antitrust case against the search giant. Bloomberg: The Windows software maker's chief technology officer, Kevin Scott, was "very, very worried" when he looked at the AI model-training capability gap between Alphabet's efforts and Microsoft's, he wrote in a 2019 message to Chief Executive Officer Satya Nadella and co-founder Bill Gates. The exchange shows how the company's top executives privately acknowledged they lacked the infrastructure and development speed to catch up to the likes of OpenAI and Google's DeepMind.

[...] Scott, who also serves as executive vice president of artificial intelligence at Microsoft, observed that Google's search product had improved on competitive metrics because of the Alphabet company's advancements in AI. The Microsoft executive wrote that he made a mistake by dismissing some of the earlier AI efforts of its competitors. "We are multiple years behind the competition in terms of machine learning scale," Scott said in the email. Significant portions of the message, titled 'Thoughts on OpenAI,' remain redacted. Nadella endorsed Scott's email, forwarding it to Chief Financial Officer Amy Hood and saying it explains "why I want us to do this."

Bitcoin

Binance Founder Changpeng Zhao Sentenced To 4 Months In Prison (cnbc.com) 9

Binance founder Changpeng Zhao has been sentenced to four months in prison after pleading guilty to charges related to enabling money laundering through his cryptocurrency exchange. CNBC reports: The sentence handed down to Zhao in Seattle federal court was significantly less than the three years that federal prosecutors had been seeking for him. The defense had asked for five months of probation. The sentencing guidelines called for a prison term of 12 to 18 months. In November, Zhao struck a deal with the U.S. government to resolve a multiyear investigation into Binance, the world's largest cryptocurrency exchange. As part of the settlement, Zhao stepped down as the company's CEO.

Zhao, who wore a dark navy suit with a light blue tie to court, is accused of willfully failing to implement an effective anti-money laundering program as required by the Bank Secrecy Act, and of allowing Binance to process transactions involving proceeds of unlawful activity, including between Americans and individuals in sanctions jurisdictions. The U.S. ordered Binance to pay $4.3 billion in fines and forfeiture. Zhao agreed to pay a $50 million fine.

Cloud

How an Empty S3 Bucket Can Make Your AWS Bill Explode (medium.com) 70

Maciej Pocwierz, a senior software engineer Semantive, writing on Medium: A few weeks ago, I began working on the PoC of a document indexing system for my client. I created a single S3 bucket in the eu-west-1 region and uploaded some files there for testing. Two days later, I checked my AWS billing page, primarily to make sure that what I was doing was well within the free-tier limits. Apparently, it wasn't. My bill was over $1,300, with the billing console showing nearly 100,000,000 S3 PUT requests executed within just one day! By default, AWS doesn't log requests executed against your S3 buckets. However, such logs can be enabled using AWS CloudTrail or S3 Server Access Logging. After enabling CloudTrail logs, I immediately observed thousands of write requests originating from multiple accounts or entirely outside of AWS.

Was it some kind of DDoS-like attack against my account? Against AWS? As it turns out, one of the popular open-source tools had a default configuration to store their backups in S3. And, as a placeholder for a bucket name, they used... the same name that I used for my bucket. This meant that every deployment of this tool with default configuration values attempted to store its backups in my S3 bucket! So, a horde of misconfigured systems is attempting to store their data in my private S3 bucket. But why should I be the one paying for this mistake? Here's why: S3 charges you for unauthorized incoming requests. This was confirmed in my exchange with AWS support. As they wrote: "Yes, S3 charges for unauthorized requests (4xx) as well[1]. That's expected behavior." So, if I were to open my terminal now and type: aws s3 cp ./file.txt s3://your-bucket-name/random_key. I would receive an AccessDenied error, but you would be the one to pay for that request. And I don't even need an AWS account to do so.

Another question was bugging me: why was over half of my bill coming from the us-east-1 region? I didn't have a single bucket there! The answer to that is that the S3 requests without a specified region default to us-east-1 and are redirected as needed. And the bucket's owner pays extra for that redirected request. The security aspect: We now understand why my S3 bucket was bombarded with millions of requests and why I ended up with a huge S3 bill. At that point, I had one more idea I wanted to explore. If all those misconfigured systems were attempting to back up their data into my S3 bucket, why not just let them do so? I opened my bucket for public writes and collected over 10GB of data within less than 30 seconds. Of course, I can't disclose whose data it was. But it left me amazed at how an innocent configuration oversight could lead to a dangerous data leak! Lesson 1: Anyone who knows the name of any of your S3 buckets can ramp up your AWS bill as they like. Other than deleting the bucket, there's nothing you can do to prevent it. You can't protect your bucket with services like CloudFront or WAF when it's being accessed directly through the S3 API. Standard S3 PUT requests are priced at just $0.005 per 1,000 requests, but a single machine can easily execute thousands of such requests per second.

Space

The Naked-Eye Sky Will (Briefly) Host a New Star (cnn.com) 41

RockDoctor (Slashdot reader #15,477) wants to tell you about a "new" star that will be visible to the naked eye — without a telescope — sometime before September: By "star", I do not mean "comet", "meteorite" or "firefly", but genuine [star] photons arriving here after about 3000 years in flight, causing your eyes to see a bright point on the nighttime sky. When it happens, the star will go from needing-a- telescope-or-good-binoculars-to-see, to being the 50th (or even 30th) brightest star in the sky.

For a week or so. Of course, it could just go full-on supernova, and be visible in daylight for a few weeks, and dominate the night sky for months. But that's unlikely.

Named "T Corona Borealis" (because it's the 20th variable star studied in the constellation "Corona Borealis") it's now visible all night, all year, for about 60% of the world's population (although normally you need binoculars to see it).

But RockDoctor writes that in 2016, "T CrB" (as it is known) has started showing "a similar pattern of changes" to what happened in the late 1930s when it became one of only 10 "recurring nova" known to science: In 2023, the pattern continued and the match of details got better. The star is expected to undergo another "eruption" — becoming one of the brightest few stars in the sky, within the next couple of months. Maybe the next couple of weeks. Maybe the next couple of hours....

Last week, astrophysicist Dr Becky Smethurst posted on the expected event in her monthly "Night Sky News" video blog. If you prefer your information in text not video, the AAVSO (variable star observers) posted a news alert for it's observers a while ago. They also hosted a seminar on the star, and why it's eruption is expected Real Soon Now, which is also on YouTube. A small selection of recent papers on the subject are posted here, which also includes information on how to get the most up-to-date brightness readings (unless you're a HST / JWST / Palomar / Hawai`i / Chile telescope operator). Yes, the "big guns" of astronomy have prepared their "TOO — Target Of Opportunity" plans, and will be dropping normal observations really quickly when the news breaks and slewing TOO the target.

You won't need your eclipse glasses for this. (Dr Becky's video covers where you can send them for re-use.) But you might want to photograph the appropriate part of the sky so you'll notice when the bomb goes off. Bomb? Did I say that the best model for what is happening is a thermonuclear explosion like a H-bomb the size of the Earth detonating? Well, that's the best analogue.

This CNN article includes a nice animation from NASA illustrating the multi-star interaction that's causing the event: The stars in the orbiting pair are close enough to each other that they interact violently. The red giant becomes increasingly unstable over time as it heats up, casting off its outer layers that land as matter on the white dwarf star. The exchange of matter causes the atmosphere of the white dwarf to gradually heat until it experiences a "runaway thermonuclear reaction," resulting in a nova [according to NASA]...

The NASAUniverse account on X, formerly known as Twitter, will provide updates about the outburst and its appearance.

The BBC reiterates the key data points — that "The rare cosmic event is expected to take place sometime before September 2024. When it occurs it will likely be visible to the naked eye. No expensive telescope will be needed to witness this cosmic performance, says NASA."
Businesses

Thoma Bravo To Take UK Cybersecurity Company Darktrace Private In $5 Billion Deal (techcrunch.com) 6

An anonymous reader quotes a report from TechCrunch: Darktrace is set to go private in a deal that values the U.K.-based cybersecurity giant at around $5 billion. A newly formed entity called Luke Bidco Ltd., formed by private equity giant Thoma Bravo, has tabled an all-cash bid of $7.75 per share, which represents a 44% premium on its average price for the three-month period ending April 25. However, this premium drops to just 20% when juxtaposed against Darktrace's closing price Thursday, as the company's shares had risen 20% to 5.18 pounds in the past month.

Founded out of Cambridge, U.K., in 2013, Darktrace is best known for AI-enabled threat detection smarts, using machine learning to identify abnormal network activity and attempts at ransomware attacks, insider attacks, data breaches and more. The company claims big-name customers including Allianz, Airbus and the city of Las Vegas. After raising some $230 million in VC funding and hitting a private valuation of $1.65 billion, Darktrace went public on the London Stock Exchange in April 2021, with an opening-day valuation of $2.4 billion. Its shares hit an all-time high later that year of 9.45 pounds and plummeted to an all-time low of 2.29 pounds last February. But they had been steadily rising since the turn of the year and hadn't fallen below 4 pounds since the beginning of March.

The full valuation based on Thoma Bravo's offer amounts to $5.3 billion on what is known as a full-diluted basis, which takes into account all convertible securities and is designed to give a more comprehensive view of a company's valuation. However, the enterprise value in this instance is approximately $4.9 billion, which includes additional considerations such as debt and cash positions. [...] The deal is of course still subject to shareholder approval, but the companies said that they expect to complete the transaction by the end of 2024.
"The proposed offer represents an attractive premium and an opportunity for shareholders to receive the certainty of a cash consideration at a fair value for their shares," Darktrace chair Gordon Hurst said. "The proposed acquisition will provide Darktrace access to a strong financial partner in Thoma Bravo, with deep software sector expertise, who can enhance the company's position as a best-in-class cyber AI business headquartered in the U.K."
Microsoft

Ex-White House Cyber Policy Director: Microsoft is a National Security Risk (theregister.com) 124

This week the Register spoke to former senior White House cyber policy director A.J. Grotto — who complained it was hard to get even slight concessions from Microsoft: "If you go back to the SolarWinds episode from a few years ago ... [Microsoft] was essentially up-selling logging capability to federal agencies" instead of making it the default, Grotto said. "As a result, it was really hard for agencies to identify their exposure to the SolarWinds breach." Grotto told us Microsoft had to be "dragged kicking and screaming" to provide logging capabilities to the government by default. [In the interview he calls it "an epic fight" which lasted 18 months."] [G]iven the fact the mega-corp banked around $20 billion in revenue from security services last year, the concession was minimal at best.

That illustrates, Grotto said, that "they [Microsoft] just have a ton of leverage, and they're not afraid to use it." Add to that concerns over an Exchange Online intrusion by Chinese snoops, and another Microsoft security breach by Russian cyber operatives, both of which allowed spies to gain access to US government emails, and Grotto says it's fair to classify Microsoft and its products as a national security concern.

He estimates that Microsoft makes 85% of U.S. government productivity software — and has an even greater share of their operating systems. "Microsoft in many ways has the government locked in, he says in the interview, "and so it's able to transfer a lot of these costs associated with the security breaches over to the federal government."

And about five minutes in, he says, point-blank, that "It's perfectly fair" to consider Microsoft a national security threat, given its dominance "not just within the federal government, but really in sort of the boarder IT marketplace. I think it's fair to say, yeah, that a systemic compromise that affects Microsoft and its products do rise to the level of a national security risk."

He'd like to see the government encourage more competition — to the point where public scrutiny prompts software customers to change their behavior, and creates a true market incentive for better performance...
Red Hat Software

Red Hat Upgrades Its Pipeline-Securing (and Verification-Automating) Tools (siliconangle.com) 11

SiliconANGLE reports that to help organizations detect vulnerabilities earlier, Red Hat has "announced updates to its Trusted Software Supply Chain that enable organizations to shift security 'left' in the software supply chain." Red Hat announced Trusted Software Supply Chain in May 2023, pitching it as a way to address the rising threat of software supply chain attacks. The service secures software pipelines by verifying software origins, automating security processes and providing a secure catalog of verified open-source software packages. [Thursday's updates] are aimed at advancing the ability for customers to embed security into the software development life cycle, thereby increasing software integrity earlier in the supply chain while also adhering to industry regulations and compliance standards.

They start with a new tool called Red Hat Trust Artifact Signer. Based on the open-source Sigstore project [founded at Red Hat and now part of the Open Source Security Foundation], Trust Artifact Signer allows developers to sign and verify software artifacts cryptographically without managing centralized keys, to enhance trust in the software supply chain. The second new release, Red Hat Trusted Profile Analyzer, provides a central source for security documentation such as Software Bill of Materials and Vulnerability Exploitability Exchange. The tool simplifies vulnerability management by enabling proactive identification and minimization of security threats.

The final new release, Red Hat Trusted Application Pipeline, combines the capabilities of the Trusted Profile Analyzer and Trusted Artifact Signer with Red Hat's internal developer platform to provide integrated security-focused development templates. The feature aims to standardize and accelerate the adoption of secure development practices within organizations.

Specifically, Red Hat's announcement says organizations can use their new Trust Application Pipeline feature "to verify pipeline compliance and provide traceability and auditability in the CI/CD process with an automated chain of trust that validates artifact signatures, and offers provenance and attestations."
Businesses

23andMe CEO Anne Wojcicki Considers Taking Company Private (cnbc.com) 20

Ashley Capoot reports via CNBC: Anne Wojcicki, the CEO of 23andMe, is considering a proposal to take the genetic testing company private after its stock price tumbled more than 95% from its 2021 highs. A late Wednesday filing with the Securities and Exchange Commission said Wojcicki is working with advisors and plans to speak with possible financing sources and partners. She "wishes to maintain control" of the company and will "not be willing to support any alternative transaction," the filing said. [...] In November, 23andMe received a deficiency letter from the Nasdaq Listing Qualifications Department, which said the company had 180 days to bring its share price back above $1. The company's board of directors formed a "Special Committee" in late March to help explore options that could juice the stock.

A press release on Thursday said the committee was made aware of Wojcicki's interest in acquiring all of 23andMe's outstanding shares. Wojcicki owns shares that make up more than 20% of those outstanding, which equates to about 49% of voting power, the release said. "The Special Committee will carefully review Ms. Wojcicki's proposal when and if it is made available and evaluate it in light of other available strategic alternatives, including continuing to operate as a publicly traded company," the committee said in the release. "The Special Committee is committed to acting in the best interests of 23andMe and its shareholders." The committee has engaged Wells Fargo as its financial advisor, and it said there is "no assurance" that Wojcicki's offer would result in the proposed outcome.

China

Apple Removes WhatsApp, Threads and Telegram From China App Store (wsj.com) 53

China ordered Apple to remove some of the world's most popular chat messaging apps from its app store in the country, the latest example of censorship demands on the iPhone seller in the company's second-biggest market. WSJ: Meta's WhatsApp and Threads as well as messaging platforms Signal, Telegram and Line were taken off the Chinese App Store Friday [non-paywalled link]. Apple said it was told to remove certain apps because of national security concerns, without specifying which. "We are obligated to follow the laws in the countries where we operate, even when we disagree," an Apple spokesperson said in a statement.

These messaging apps, which allow users to exchange messages and share files individually and in big groups, combined have more than three billion users globally. They can only be accessed in China through virtual private networks that take users outside China's Great Firewall, but are still commonly used. Beijing has often viewed such platforms with caution, concerned that these apps could be used by its citizens to spread negative content and organize demonstrations or social movements. Much of the news China censors at home often makes it beyond the Great Firewall through such channels.

The Internet

Reddit Is Taking Over Google (businessinsider.com) 86

An anonymous reader quotes a report from Business Insider: If you think you've been seeing an awful lot more Reddit results lately when you search on Google, you're not imagining things. The internet is in upheaval, and for website owners the rules of "winning" Google Search have never been murkier. Google's generative AI search engine is coming from one direction. It's creeping closer to mainstream deployment and bringing an existential crisis for SEOs and website makers everywhere. Coming from the other direction is an influx of posts from Reddit, Quora, and other internet forums that have climbed up through the traditional set of Google links. Data analysis from Semrush, which predicts traffic based on search ranking, shows that traffic to Reddit has climbed at an impressive clip since August. Semrush estimated that Reddit had over 132 million visitors in August 2023. At the time of publishing, it was projected to have over 346 million visitors in April 2024.

None of this is accidental. For years, Google has been watching users tack on "Reddit" to the end of search queries and finally decided to do something about it. Google started dropping hints in 2022 when it promised to do a better job of promoting sites that weren't just chasing the top of search but were more helpful and human. Last August, Google rolled out a big update to Search that seemed to kick this into action. Reddit, Quora, and other forum sites started getting more visibility in Google, both within the traditional links and within a new "discussions and forums" section, which you may have spotted if you're US-based. The timing of this Reddit bump has led to some conspiracy theories. In February, Google and Reddit announced a blockbuster deal that would let Google train its AI models on Reddit content. Google said the deal, reportedly worth $60 million, would "facilitate more content-forward displays of Reddit information," leading to some speculation that Google promised Reddit better visibility in exchange for the valuable training data. A few weeks later, Reddit also went public.

Steve Paine, marketing manager at Sistrix, called the rise of Reddit "unprecedented." "There hasn't been a website that's grown so much search visibility so quickly in the US in at least the last five years," he told Business Insider. Right now, Reddit ranks high for product searches. Reddit's main competitors are Wikipedia, YouTube, and Fandom, Paine said, and it also competes in "high-value commercial searches," putting it up against Amazon. The "real competitors," he said, are the subreddits that compete with brands on the web.
A Google spokesperson told Business Insider that the company is essentially just giving users what they want: "Our research has shown that people often want to learn from others' experiences with a topic, so we've continued to make it easier to find helpful perspectives on Search when it's relevant to a query. Our systems surface content from hundreds of forums and other communities across the web, and we conduct rigorous testing to ensure results are helpful and high quality."
Security

Frontier Communications Shuts Down Systems After Cyberattack (bleepingcomputer.com) 6

U.S. telecom provider Frontier Communications shut down its systems after a cybercrime group breached some of its IT systems in a recent cyberattack. BleepingComputer reports: Frontier is a leading U.S. communications provider that provides gigabit Internet speeds over a fiber-optic network to millions of consumers and businesses across 25 states. After discovering the incident, the company was forced to partially shut down some systems to prevent the threat actors from laterally moving through the network, which also led to some operational disruptions. Despite this, Frontier says the attackers could access some PII data, although it didn't disclose if it belonged to customers, employees, or both.

"On April 14, 2024, Frontier Communications Parent, Inc. [..] detected that a third party had gained unauthorized access to portions of its information technology environment," the company revealed in a filing with the U.S. Securities and Exchange Commission on Thursday. "Based on the Company's investigation, it has determined that the third party was likely a cybercrime group, which gained access to, among other information, personally identifiable information." Frontier now believes that it has contained the breach, has since restored its core IT systems affected during the incident, and is working on restoring normal business operations.

United States

Feds Hit Coding Boot Camp With Big Fine For Allegedly Conning Students 39

The US Consumer Financial Protection Bureau (CFPB) has slapped coding boot camp BloomTech -- formerly known as Lambda School -- with several punishments for alleged deceptive business practices. From a report: The business, which claims on its site it will help students land their "dream job" in tech at companies like Amazon, Cisco, and Google, accepted the consent order without admitting or denying any wrongdoing. In an announcement yesterday, the CFPB said it had taken action against BloomTech and its CEO Austen Allred for allegedly not disclosing the true cost of its loans to students and allegedly claiming overoptimistic hiring rates for BloomTech graduates. BloomTech, formerly Lambda School, has operated since 2017 and offers six- to nine-month vocational programs in science and engineering, with a focus on computer technology.

"BloomTech and its CEO sought to drive students toward income share loans that were marketed as risk-free, but in fact carried significant finance charges and many of the same risks as other credit products," said Rohit Chopra, director of the CFPB. With income share loans or income share agreements, BloomTech allowed students to pay tuition later but in exchange had to pay a percentage of their future income, CFPB claimed. The agency alleged that BloomTech explicitly told students that its income share loans (which cost an average of $4k "finance charge" to use) weren't actually loans at all. The CFPB claimed in the settlement order a "significant majority" of students used these loans to finance their education, and alleged each student could end up paying up to $30k of their income to BloomTech to settle the loans.
From the CFPB's press release: BloomTech advertised on its website that 71 to 86 percent of students were placed in jobs within six months of graduation, when its non-public reporting to investors consistently showed placement rates closer to 50 percent. Allred tweeted that the school achieved a 100 percent job-placement rate in one of its cohorts, and later acknowledged in a private message that the sample size was just one student.

Slashdot Top Deals