

Submission + - Dbrand sues CASETiFY over ripping off its Teardown skins (theverge.com)

Sunbird is Shutting Down Its iMessage App for Android (theverge.com) 12
Last week, Sunbird partnered with Nothing, the phone brand owned by OnePlus co-founder Carl Pei, on the launch of Nothing Chats. The Sunbird-powered messaging service is supposed to let owners of the Phone 2 send texts via iMessage, but it was pulled from the Google Play Store just one day after its launch. At the time, Nothing said it had to fix "several bugs" within the app. However, its removal from the Play Store came around the same time a post from Texts.blog revealed that messages sent via Sunbird may not be end-to-end encrypted.

Nothing's iMessage App Was a Security Catastrophe, Taken Down In 24 Hours (arstechnica.com) 47
How bad are the security issues? Both 9to5Google and Text.com (which is owned by Automattic, the company behind WordPress) uncovered shockingly bad security practices. Not only was the app not end-to-end encrypted, as claimed numerous times by Nothing and Sunbird, but Sunbird actually logged and stored messages in plain text on both the error reporting software Sentry and in a Firebase store. Authentication tokens were sent over unencrypted HTTP so this token could be intercepted and used to read your messages. [...]
Despite being the cause of this huge catastrophe, Sunbird has been bizarrely quiet during this whole mess. The app's X (formerly Twitter) page still doesn't say anything about the shutdown of Nothing Chats or Sunbird. Maybe that's for the best because some of Sunbird's early responses to the security concerns raised on Friday do not seem like they came from a competent developer. [...] Nothing has always seemed like an Android manufacturer that was more hype than substance, but we can now add "negligent" to that list. The company latched on to Sunbird, reskinned its app, created a promo website and YouTube video, and coordinated a media release with popular YouTubers, all without doing the slightest bit of due diligence on Sunbird's apps or its security claims. It's unbelievable that these two companies made it this far -- the launch of Nothing Chats required a systemic security failure across two entire companies.

Fusus' AI-Powered Cameras Are Spreading Across the United States 33
404 Media has obtained a cache of internal emails, presentations, memos, photos, and more which provide insight into how Fusus teams up with police departments to sell its surveillance technology. All around the country, city councils are debating whether they want to have a system that qualitatively changes what surveillance cameras mean for a town's residents and public agencies. While many have adopted Fusus, others have pushed back, and refused to have the hardware and software installed in their neighborhoods. In some ways, Fusus is deploying smart camera technology that historically has been used in places like South Africa, where experts warned about it creating an ever present blanket of surveillance. Now, tech with some of the same capabilities is being used across small town America.
Rather than selling cameras themselves, Fusus' hardware and software latches onto existing installations, which can include government-owned surveillance cameras as well as privately owned cameras at businesses and homes. It turns dumb cameras into smart ones. "In essence, the Fusus solution puts a brain into every camera connected with the system," one memorandum obtained by 404 Media reads. In addition to integrating with existing surveillance installations, Fusus' hardware, called SmartCORE, can turn cameras into automatic license plate readers (ALPRs). It can reportedly offer facial recognition features, too, although Fusus hasn't provided clear clarification on this matter.
The report says the system has been adopted by numerous police departments across the United States, with approximately 150 jurisdictions using Fusus. Orland Park police have called it a "game-changer." It's also being used internationally, launching in the United Kingdom.
Here's what Beryl Lipton, investigative researcher at the Electronic Frontier Foundation (EFF), had to say about it: "The lack of transparency and community conversation around Fusus exacerbates concerns around police access of the system, AI analysis of video, and analytics involving surveillance and crime data, which can influence officer patrols and priorities. In the absence of clear policies, auditable access logs, and community transparency about the capabilities and costs of Fusus, any community in which this technology is adopted should be concerned about its use and abuse."

Apple Backs US Government's Push for a National Right-to-Repair Bill . (But What About Parts Pairing?) (arstechnica.com) 30
"We intend to honor California's new repair provisions across the United States," said Brian Naumann, Apple's vice president for service and operation management, at a White House event Tuesday...
"I think most OEMs [Original Equipment Manufacturers] will realize they can save themselves a lot of trouble by making parts, tools, and other requirements of state laws already in NY, MN, CA, and CO available nationally," wrote Gay Gordon-Byrne, executive director of The Repair Association, to Ars... Gordon-Byrne noted that firms like HP, Google, Samsung, and Lenovo have pledged to comply with repair rules on a national level. The US Public Interest Research Group (PIRG) communicated a similarly hopeful note in its response to Tuesday's event, noting that "Apple makes a lot of products, and its conduct definitely influences other manufacturers." At the same time, numerous obstacles to repair access remain in place through copyright law — "Which we hope will be high on an agenda in the IP subcommittee this session," Gordon-Byrne wrote.
Besides strong support from President Biden, there's also strong support from America's Federal Trade Commission, reports TechCrunch: FTC chair Lina Khan commented on the pushback many corporations have given such legislation. Device and automotive manufacturers have argued that putting such choice in the hands of consumers opens them up to additional security risks. "We hear some manufacturers defend repair restrictions, claiming that they're needed for safety or security reasons," said Khan. "The FTC has found that all too often these claims are backed by limited evidence. Accordingly, the FTC has committed itself to using all of our enforcement and policy tools to fight for people's right to repair their own products."
A cautionary note from Ars Technica: Elizabeth Chamberlain, director of sustainability for iFixit, a parts vendor and repair advocate, suggested that Apple's pledge to extend California's law on a national level is "a strategic move." "Apple likely hopes that they will be able to negotiate out the parts of the Minnesota bill they don't like," Chamberlain wrote in an email, pointing specifically to the "fair and reasonable" parts provisioning measure that could preclude Apple's tendency toward pairing parts to individual devices. "[I]t's vital to get bulletproof parts pairing prohibitions passed in other states in 2024," Chamberlain wrote. "Independent repair and refurbishment depend on parts harvesting."
The Washington Post reports that currently repair shop owners and parts vendors "have had to find ways to reassure their customers they haven't made a mistake by choosing an independent fix." If the digital identifier tied to a replacement part doesn't match the one the phone expects to see, you'll start seeing those warnings and issues. "Only Apple pairs parts in an intrusive way where you get these messages pop up," said Jonathan Strange, owner of two XiRepair gadget repair shops in Montgomery, Alabama. To ward off those unnerving messages and restore full functionality, repair technicians are required to go through a "system configuration" process that authenticates the part after making the fix. Some small operations, like Strange's XiRepair shops, can do that in-store because they've gone through a process to become a certified Apple Independent Repair Providers. But that process can't happen at all in shops that haven't gone through that certification, or if more affordable parts like third-party replacements were used.
The Post also shares this reaction from Aaron Perzanowski, a repair researcher and law professor at the University of Michigan.
"The fact that companies want to use technology to essentially undo the notion of interchangeable parts is something we ought to find deeply disturbing."

Okta Cybersecurity Breach Wipes Out More Than $2 Billion In Market Cap (cnbc.com) 40
Okta has also been at the center of other higher-profile incidents. Earlier this year, for example, casino giants Caesars and MGM were both affected by hacks. Caesars was forced to pay millions in ransom to the hacking group, sources told CNBC. MGM had to shut down critical systems that the company acknowledged would have a material effect on its bottom line in an SEC filing. The direct and indirect losses from those incidents totaled over $100 million. Both those attacks targeted MGM and Caesars' Okta installations, using a sophisticated social engineering attack that went through IT help desks. Three other companies were also targeted by the hacking group, an Okta executive told Reuters.
Okta has also been a target before. A hacking group purportedly accessed numerous Okta systems in a March attempt. That group, Lapsus$, has been tied to hacking attacks at Uber and Grand Theft Auto maker Rockstar Games, a subsidiary of Take-Two Interactive, according to a report from the Cybersecurity and Infrastructure Security Agency.

Scientists Propose Sweeping New Law of Nature, Expanding On Evolution (reuters.com) 112
Titled the "law of increasing functional information," it holds that evolving systems, biological and non-biological, always form from numerous interacting building blocks like atoms or cells, and that processes exist -- such as cellular mutation -- that generate many different configurations. Evolution occurs, it holds, when these various configurations are subject to selection for useful functions. [...] The authors proposed three universal concepts of selection: the basic ability to endure; the enduring nature of active processes that may enable evolution; and the emergence of novel characteristics as an adaptation to an environment. Some biological examples of this "novelty generation" include organisms developing the ability to swim, walk, fly and think. Our species emerged after the human evolutionary lineage diverged from the chimpanzee lineage and acquired an array of traits including upright walking and increased brain size. The research has been published in the journal Proceedings of the National Academy of Sciences.
Submission + - Scientists Propose Sweeping New Law of Nature, Expanding On Evolution (arstechnica.com)
Titled the "law of increasing functional information," it holds that evolving systems, biological and non-biological, always form from numerous interacting building blocks like atoms or cells, and that processes exist — such as cellular mutation — that generate many different configurations. Evolution occurs, it holds, when these various configurations are subject to selection for useful functions. [...] The authors proposed three universal concepts of selection: the basic ability to endure; the enduring nature of active processes that may enable evolution; and the emergence of novel characteristics as an adaptation to an environment. Some biological examples of this "novelty generation" include organisms developing the ability to swim, walk, fly and think. Our species emerged after the human evolutionary lineage diverged from the chimpanzee lineage and acquired an array of traits including upright walking and increased brain size.

Researchers Including Microsoft Spot Chinese Disinformation Campaign Using AI-Generated Photos (businesstimes.com.sg) 40
But a new piece co-authored by the newspaper's national security correspondent and its misinformation investigative reporter notes a new effort identified by researchers from Microsoft, the RAND Corporation, the University of Maryland, the intelligence company Recorded Future, and news-rating service NewsGuard. And that newly-discovered effort "suggests that Beijing is making more direct attempts to sow discord in the United States."
It began when, sensing an opportunity,"China's increasingly resourceful information warriors pounced" after high winds in Hawaii downed three power lines that sparked wildfires in Hawaii on August 8th... The disaster was not natural, they said in a flurry of false posts that spread across the internet, but was the result of a secret "weather weapon" being tested by the United States. To bolster the plausibility, the posts carried photographs that appeared to have been generated by artificial intelligence programs, making them among the first to use these new tools to bolster the aura of authenticity of a disinformation campaign... Recorded Future first reported that the Chinese government mounted a covert campaign to blame a "weather weapon" for the fires, identifying numerous posts in mid-August falsely claiming that MI6, the British foreign intelligence service, had revealed "the amazing truth behind the wildfire." Posts with the exact language appeared on social media sites across the internet, including Pinterest, Tumblr, Medium and Pixiv, a Japanese site used by artists. Other inauthentic accounts spread similar content, often accompanied with mislabeled videos, including one from a popular TikTok account, The Paranormal Chic, that showed a transformer explosion in Chile...
The Chinese campaign operated across many of the major social media platforms — and in many languages, suggesting it was aimed at reaching a global audience. Microsoft's Threat Analysis Center identified inauthentic posts in 31 languages, including French, German and Italian, but also in less prominent ones like Igbo, Odia and Guarani. The artificially generated images of the Hawaii wildfires identified by Microsoft's researchers appeared on multiple platforms, including a Reddit post in Dutch. "These specific A.I.-generated images appear to be exclusively used" by Chinese accounts used in this campaign, Microsoft said in a report. "They do not appear to be present elsewhere online."
The researchers "suggested that China was building a network of accounts that could be put to use in future information operations, including the next U.S. presidential election," according to the article. It adds that president Biden "has cut off China's access to the most advanced chips and the equipment made to produce them."
The article adds that the impact of China's misinformation campaign "is difficult to measure, though early indications suggest that few social media users engaged with the most outlandish of the conspiracy theories."

Terraform By Hashicorp Forked To OpenTF (theregister.com) 24
Submission + - Terraform by Hashicorp forked to OpenTF (theregister.com)
"Our view is that we're actually not the fork because we're just changing the name but it's the same project under the same license," Sebastian Stadil, co-founder and CEO of DevOps automation biz Scalr told The Register. "Our position is that the fork is actually HashiCorp that has forked its own projects under a different license."
HashiCorp's decision to issue new licensing terms for its software follows a path trodden by numerous other organizations formed around open source projects to limit what competitors can do with project code. As the biz acknowledged in its statement about the transition, firms like Cockroach Labs, Confluent Sentry, Couchbase, Elastic, MariaDB, MongoDB, and Redis Labs have similarly adopted less-permissive software licenses to create a barrier for competitors.
You can see the OpenTF manifesto here: https://github.com/opentffound...

More Developers Are Using the Rust Programming Language, Survey Finds (rust-lang.org) 117
- More people are using Rust than ever before! Over 90% of survey respondents identified as Rust users, and of those using Rust, 47% do so on a daily basis — an increase of 4% from the previous year.
- 30% of Rust user respondents can write simple programs in Rust, 27% can write production-ready code, and 42% consider themselves productive using Rust. Of the former Rust users who completed the survey, 30% cited difficulty as the primary reason for giving up while nearly 47% cited factors outside of their control.
- The growing maturation of Rust can be seen through the increased number of different organizations utilizing the language in 2022. In fact, 29.7% of respondents stated that they use Rust for the majority of their coding work at their workplace, which is a 51.8% increase compared to the previous year.
- There are numerous reasons why we are seeing increased use of Rust in professional environments. Top reasons cited for the use of Rust include the perceived ability to write "bug-free software" (86%), Rust's performance characteristics (84%), and Rust's security and safety guarantees (69%). We were also pleased to find that 76% of respondents continue to use Rust simply because they found it fun and enjoyable. (Respondents could select more than one option here, so the numbers don't add up to 100%.)
- Of those respondents that used Rust at work, 72% reported that it helped their team achieve its goals (a 4% increase from the previous year) and 75% have plans to continue using it on their teams in the future.
- But like any language being applied in the workplace, Rust's learning curve is an important consideration; 39% of respondents using Rust in a professional capacity reported the process as "challenging" and 9% of respondents said that adopting Rust at work has "slowed down their team". However, 60% of productive users felt Rust was worth the cost of adoption overall...
- Of those respondents who shared their main worries for the future of Rust, 26% have concerns that the developers and maintainers behind Rust are not properly supported — a decrease of more than 30% from the previous year's findings. One area of focus in the future may be to see how the Project in conjunction with the Rust Foundation can continue to push that number towards 0%.
- While 38% have concerns about Rust "becoming too complex", only a small number of respondents were concerned about documentation, corporate oversight, or speed of evolution. 34% of respondents are not worried about the future of Rust at all.
This year's survey reflects a 21% decrease in fears about Rust's usage in the industry since the last survey.

Denuvo Security Is Now On Switch, Including New Tech To Block PC Switch Emulation (videogameschronicle.com) 57

Windows 11 Has Made the 'Clean Windows Install' an Oxymoron (arstechnica.com) 207
The "out-of-box experience" (OOBE, in Microsoft parlance) for Windows 7 walked users through the process of creating a local user account, naming their computer, entering a product key, creating a "Homegroup" (a since-discontinued local file- and media-sharing mechanism), and determining how Windows Update worked. Once Windows booted to the desktop, you'd find apps like Internet Explorer and the typical in-box Windows apps (Notepad, Paint, Calculator, Media Player, Wordpad, and a few other things) installed. Keeping that baseline in mind, here's everything that happens during the OOBE stage in a clean install of Windows 11 22H2 (either Home or Pro) if you don't have active Microsoft 365/OneDrive/Game Pass subscriptions tied to your Microsoft account:
(Mostly) mandatory Microsoft account sign-in.
Setup screen asking you about data collection and telemetry settings.
A (skippable) screen asking you to "customize your experience."
A prompt to pair your phone with your PC.
A Microsoft 365 trial offer.
A 100GB OneDrive offer.
A $1 introductory PC Game Pass offer.
This process is annoying enough the first time, but at some point down the line, you'll also be offered what Microsoft calls the "second chance out-of-box experience," or SCOOBE (not a joke), which will try to get you to do all of this stuff again if you skipped some of it the first time. This also doesn't account for the numerous one-off post-install notification messages you'll see on the desktop for OneDrive and Microsoft 365. (And it's not just new installs; I have seen these notifications appear on systems that have been running for months even if they're not signed in to a Microsoft account, so no one is safe). And the Windows desktop, taskbar, and Start menu are no longer the pristine places they once were. Due to the Microsoft Store, you'll find several third-party apps taking up a ton of space in your Start menu by default, even if they aren't technically downloaded and installed until you run them for the first time. Spotify, Disney+, Prime Video, Netflix, and Facebook Messenger all need to be removed if you don't want them (this list can vary a bit over time).

Canon Is Getting Away With Printers That Won't Scan Sans Ink (theverge.com) 72
As Reuters reports, a judge has refused to dismiss a lawsuit by Gary Freund and Wayne McMath that alleges many HP printers won't scan or fax documents when their ink cartridges report that they've run low. Among other things, HP tried to suggest that Freund couldn't rely on the word of one of HP's own customer support reps as evidence that HP knew about the limitation. But a judge decided it was at least enough to be worth exploring in court. "Plaintiffs have plausibly alleged that HP had a duty to disclose and had knowledge of the alleged defect," wrote Judge Beth Labson Freeman, in the order denying almost all of HP's current attempts to dismiss the suit.
Interestingly, neither Canon nor HP spent any time trying to argue their printers do scan when they're low on ink in the lawsuit responses I've read. Perhaps they can't deny it? Epson, meanwhile, has an entire FAQ dedicated to reassuring customers that it hasn't pulled that trick since 2008. (Don't worry, Epson has other forms of printer enshittification.) HP does seem to be covering its rear in one way. The company's original description on Amazon for the Envy 6455e claimed that you could scan things "whenever". But when I went back now to check the same product page, it now reads differently: HP no longer claims this printer can scan "whenever" you want it to. Now, we wait to see whether the case can clear the bars needed to potentially become a big class-action trial, or whether it similarly settles like Canon, or any number of other outcomes.

Russia Hopes For Its First Successful Lunar Landing Mission in Nearly 50 Years (theguardian.com) 143
Post-Soviet Russia has launched two failed space landing missions, the Mars-96 in 1996 and Phobos-Grunt in 2011, both of which crash-landed into the Pacific Ocean. "The Russian Federation hasn't had much luck with launching unmanned interplanetary probes," said Vitaly Egorov, a blogger who writes extensively on space exploration. "Now 12 years later they're launching Luna-25 and the main intrigue is whether or not it will succeed in reaching [the moon] or not, and if it does, can it actually land there? "One of the main goals is to let modern specialists put down space probes softly on celestial objects. They haven't had that experience in 47 years. That knowledge needs to be restored for new specialists on a new technological level."

Intel's GPU Drivers Now Collect Telemetry, Including 'How You Use Your Computer' (extremetech.com) 44
According to TechPowerUp, which discovered the change, Intel has created a landing page for the program that explains what is collected and what isn't. At a high level, it states, "This program uses information about your computer's performance to make product improvements that may benefit you in the future." Though that sounds innocuous, Intel provides a long list of the types of data it collects, many unrelated to your computer's performance. Those include the types of websites you visit, which Intel says are dumped into 30 categories and logged without URLs or information that identifies you, including how long and how often you visit certain types of sites. It also collects information on "how you use your computer" but offers no details. It will also identify "Other devices in your computing environment." Numerous performance-related data points are also captured, such as your CPU model, display resolution, how much memory you have, and, oddly, your laptop's average battery life. The good news is that Intel allows you to opt out of this program, which is not the case with Nvidia. According to TechPowerUp, they don't even ask for permission! As for AMD, they not only give you a choice to opt out but they also explain what data they're collecting.
Submission + - Intel's GPU Drivers Now Collect Telemetry, Including 'How You Use Your Computer' (extremetech.com)
According to TechPowerUp, which discovered the change, Intel has created a landing page for the program that explains what is collected and what isn't. At a high level, it states, "This program uses information about your computer's performance to make product improvements that may benefit you in the future." Though that sounds innocuous, Intel provides a long list of the types of data it collects, many unrelated to your computer's performance. Those include the types of websites you visit, which Intel says are dumped into 30 categories and logged without URLs or information that identifies you, including how long and how often you visit certain types of sites. It also collects information on "how you use your computer" but offers no details. It will also identify "Other devices in your computing environment." Numerous performance-related data points are also captured, such as your CPU model, display resolution, how much memory you have, and, oddly, your laptop's average battery life. Though this sounds like an egregious overreach regarding the type of data captured, to be fair to Intel, it allows you to opt out of this program.

Gizmodo Editor-In-Chief Sues Apple Over Tetris Movie (theverge.com) 53
Apple and the Tetris Company did not immediately respond to requests for comment from The Verge. But Ackerman's case may be difficult given the fact that Tetris and The Tetris Effect both draw on real historical facts, which are not generally protected by copyright law. As a result, the suit relies heavily on arguing that Tetris copies the feel of The Tetris Effect. (He also argues that some potential inventions of the film -- like a guide who turns out to be a secret KGB agent -- are based on speculations in his narrative.) "Ackerman's book took a unique approach to writing about the real history of Tetris, as it not only applied the historical record, but also layered his own original research and ingenuity to create a compelling narrative non-fiction book in the style of a Cold War spy thriller," the suit says. "Mr. Ackerman's literary masterpiece, unlike other articles and writings, dispelled of the emphasis on the actual gameplay and fans, and instead concentrated on the surrounding narrative, action sequences, and adversarial relationship between the players ... This was the identical approach Defendants adopted for the Tetris Film, without notable material distinction."
Ackerman says that he reached out after the Tetris trailer's release and unsuccessfully requested Apple and the other defendants address legal issues before the film's release. His suit alleges copyright infringement and unfair competition, among other offenses.