An anonymous reader quotes a report from the Guardian: Nearly a century ago, scientists proposed that a mysterious invisible substance they named dark matter clumped around galaxies and formed a cosmic web across the universe. What dark matter is made from, and whether it is even real, are still open questions, but according to a study, the first direct evidence of the substance may finally have been glimpsed. More work is needed to rule out less exotic explanations, but if true, the discovery would go down as a turning point in the decades-long search for the elusive substance that is said to make up 27% of the cosmos.

"This could be a crucial breakthrough in unraveling the nature of dark matter," said Prof Tomonori Totani, an astrophysicist at the University of Tokyo, who said gamma rays emanating from the centre of the Milky Way appeared to bear the signature of the substance. [...] To search for potential dark matter signals, Totani analysed data from Nasa's Fermi Gamma-ray Space Telescope, which detects the most energetic photons in the electromagnetic spectrum. He spotted a pattern of gamma rays that appeared to match the shape of the dark matter halo that spreads out in a sphere from the heart of the galaxy. The signal "closely matches the properties of gamma-ray radiation predicted to be emitted by dark matter," Totani told the Guardian. Details are published in the Journal of Cosmology and Astroparticle Physics.

If Totani has seen dark matter at work, the observations suggest it is made from elementary particles 500 times more massive than the proton. But far more work is needed to rule out other astrophysical processes and background emissions that could explain the signals. Totani said the "decisive factor" would be detecting gamma rays with the same spectrum from other regions of space, such as dwarf galaxies. According to Prof Justin Read, an astrophysicist at the University of Surrey, the lack of significant signals from such galaxies strongly argues against Totani having seen gamma rays emitted from dark matter particle annihilation. Prof Kinwah Wu, a theoretical astrophysicist at UCL, urged caution, saying: "I appreciate the author's hard work and dedication, but we need extraordinary evidence for an extraordinary claim," he said. "This analysis has not reached this status yet. It is a piece of work which serves as an encouragement for the workers in the field to keep on pressing."

Warner Music Group has reached a licensing deal with Suno that will let users create AI-generated music using the voices and likenesses of artists who opt in. WMG says participating artists will have "full control" over how their likeness and music are used. "These will be new creation experiences from artists who do opt in, which will open up new revenue streams for them and allow you to interact with them in new ways," Suno says, adding that users will be able to "build around" an artist's sounds "and ensure they get compensated." WMG is also dropping its previous lawsuit accusing Suno of scraping copyrighted material.

"Along with the licensing agreement, Suno is planning to use licensed music from WMG to build next-gen music generation models that it claims will surpass its flagship v5 model," adds The Verge. "It will also start requiring users to have a paid account to download songs starting next year, with each tier providing a specific number of downloads each month."

Further reading: First 'AI Music Creator' Signed by Record Label. More Ahead, or Just a Copyright Quandry?

Core Devices has fully open-sourced the entire Pebble software stack and confirmed the first Pebble Time 2 shipments will start in January. "This is the clearest sign yet that the platform is shifting from a company-led product to a community-backed project that can survive independently," reports Gadgets & Wearables. From the report: The announcement follows weeks of tension between Core Devices and parts of the Pebble community. By moving from 95 to 100 percent open source, the company has essentially removed itself as a bottleneck. Users can now build, run, and maintain every piece of software needed to operate a Pebble watch. That includes firmware for the watch and mobile apps for Android and iOS. This puts the entire software stack into public hands. According to the announcement, Core Devices has released the mobile app source code, enabled decentralized app distribution, and made hardware more repairable with replaceable batteries and published design files.

An anonymous reader quotes a report from Ars Technica: Some members of the maker community are distraught about Arduino's new terms of service (ToS), saying that the added rules put the company's open source DNA at risk. Arduino updated its ToS and privacy policy this month, which is about a month after Qualcomm announced that it's acquiring the open source hardware and software company. Among the most controversial changes is this addition: "User shall not: translate, decompile or reverse-engineer the Platform, or engage in any other activity designed to identify the algorithms and logic of the Platform's operation, unless expressly allowed by Arduino or by applicable license agreements ..."

In response to concerns from some members of the maker community, including from open source hardware distributor and manufacturer Adafruit, Arduino posted a blog on Friday. Regarding the new reverse-engineering rule, Arduino's blog said: "Any hardware, software or services (e.g. Arduino IDE, hardware schematics, tooling and libraries) released with Open Source licenses remain available as before. Restrictions on reverse-engineering apply specifically to our Software-as-a-Service cloud applications. Anything that was open, stays open."

But Adafruit founder and engineer Limor Fried and Adafruit managing editor Phillip Torrone are not convinced. They told Ars Technica that Arduino's blog leaves many questions unanswered and said that they've sent these questions to Arduino without response. "Why is reverse-engineering prohibited at all for a company built on openly hackable systems?" Fried and Torrone asked in a shared statement. There are also concerns about the ToS' broad new AI-monitoring powers, which offer little clarity on what data is collected, who can access it, or how long it's retained. On top of that, the update introduces an unusual patent clause that bars users from using the platform to identify potential infringement by Arduino or its partners, along with sweeping, perpetual rights over user-generated content. This could allow Arduino, and potentially Qualcomm, to republish, modify, monetize, or redistribute user uploads indefinitely.

The International Association of Cryptologic Research (IACR) was forced to cancel its leadership election after a trustee lost their portion of the Helios voting system's decryption key, making it impossible to reveal or verify the final results. Ars Technica reports: The IACR said Friday that the votes were submitted and tallied using Helios, an open source voting system that uses peer-reviewed cryptography to cast and count votes in a verifiable, confidential, and privacy-preserving way. Helios encrypts each vote in a way that assures each ballot is secret. Other cryptography used by Helios allows each voter to confirm their ballot was counted fairly. "Unfortunately, one of the three trustees has irretrievably lost their private key, an honest but unfortunate human mistake, and therefore cannot compute their decryption share," the IACR said. "As a result, Helios is unable to complete the decryption process, and it is technically impossible for us to obtain or verify the final outcome of this election."

The IACR will switch to a two-of-three private key system to prevent this sort of thing from happening again. Moti Yung, the trustee responsible for the incident, has resigned and is being replaced by Michael Abdalla.

Google has begun testing sponsored ads inside its Gemini-powered AI Mode, placing labeled "sponsored" links at the bottom of AI-generated responses. Engadget reports: [A] Google spokesperson says the result shown is akin to similar tests it's been running this year. "People seeing ads in AI Mode in the wild is simply part of Google's ongoing tests, which we've been running for several months," the spokesperson said. The push to start offering ads in AI Mode was announced in May. The company also told 9to5Google that there are no current plans to fully update AI Mode to incorporate ads. For now, the software seems to be prioritizing organic links over sponsored links, but we all know how insidious ads can be once the floodgates open...

Thunderbird Pro has moved its Thundermail email service into production testing as the open-source email client's subscription bundle of additional services prepares for an Early Bird beta launch at $9 per month that will include email hosting, encrypted file sharing through Send, and scheduling via Appointment.

Internal team members are now testing Thundermail accounts and the new Thunderbird Pro add-on automatically adds Thundermail accounts for users who sign up through it. The project migrated its data hosting from the Americas to Germany and the EU.

Appointment received a major visual redesign being applied across all three services while Send completed an external security review and moved from its standalone add-on into the unified Thunderbird Pro add-on. The new website at tb.pro is live for signups and account management.

An anonymous reader shares a report: Microsoft is upgrading its Advanced Paste tool in PowerToys for Windows 11, allowing you to use an on-device AI model to power some of its features. With the 0.96 update, you can route requests through Microsoft's Foundry Local tool or the open-source Ollama, both of which run AI models on your device's neural processing unit (NPU) instead of connecting to the cloud.

That means you won't need to purchase API credits to perform certain actions, like having AI translate or summarize the text copied to your clipboard. Plus, you can keep your data on your device.

IBM and Cisco plan to link quantum computers over long distances by the early 2030s, "with the goal of demonstrating the concept is workable by the end of 2030," reports Reuters. "The move could pave the way for a quantum internet, though executives at the two companies cautioned that the networks would require technologies that do not currently exist and will have to be developed with the help of universities and federal laboratories." From the report: The challenge begins with a problem: Quantum computers like IBM's sit in massive cryogenic tanks that get so cold that atoms barely move. To get information out of them, IBM has to figure out how to transform information in stationary "qubits" -- the fundamental unit of information in a quantum computer -- into what Jay Gambetta, director of IBM Research and an IBM fellow, told Reuters are "flying" qubits that travel as microwaves.

But those flying microwave qubits will have to be turned into optical signals that can travel between Cisco switches on fiber-optic cables. The technology for that transformation -- called a microwave-optical transducer -- will have to be developed with the help of groups like the Superconducting Quantum Materials and Systems Center, led by the Fermi National Accelerator Laboratory near Chicago, among others. Along the way, Cisco and IBM will also publish open-source software to weave all the parts together.

Microsoft has released the source code for Zork I, II, and III under the MIT License through a collaboration with Team Xbox and Activision that involved submitting pull requests to historical source repositories maintained by digital archivist Jason Scott. Each repository now includes the original source code and accompanying documentation.

The games arrived on early home computers in the 1980s as text-based adventures built on the Z-Machine, a virtual machine that allowed the same story files to run across different platforms. Infocom created the Z-Machine after discovering the original mainframe version was too large for home computers. The team split the game into three titles that all ran on the same underlying system.

The code release covers only the source files and does not include commercial packaging or trademark rights. The games remain available commercially through The Zork Anthology on Good Old Games and can be compiled locally using ZILF, a modern Z-Machine interpreter.

Linus Torvalds is "fairly positive" about vibe coding as a way for people to get computers to do things they otherwise could not. The Linux kernel maintainer made the comments during an interview at the Linux Foundation Open Source Summit in Seoul earlier this month. But he cautioned that vibe coding would be a "horrible, horrible idea from a maintenance standpoint" for production code.

Torvalds told Dirk Hohndel, head of open source at Verizon, that computers have become more complicated than when he learned to code by typing in programs from computer magazines. He said vibe coding offers a path into computing for newcomers. The kernel maintainer is not using AI-assisted coding himself. He said his role has shifted from rejecting new ideas to sometimes pushing for them against opposition from longstanding maintainers who "kind of get stuck in a rut."

Rust is "actually becoming a real part of the kernel instead of being this experimental thing," he said. Torvalds said AI crawlers have been "very disruptive to a lot of our infrastructure" because they gather data from kernel.org source code. Kernel maintainers receive bugs and security notices that are "made up by people who misuse AI," though the problem is smaller than for other projects such as curl.

Mexico has finally lifted its long-running Tor ban for the main government portal, allowing privacy-focused users, journalists, and activists to access gob.mx again after more than a decade of blocking. That said, the open data portal and the former Tor-compatible whistleblower system remain inaccessible. CyberInsider reports: The development follows a long period of digital censorship that spanned two full six-year presidential terms, those of Enrique Pena Nieto and Andres Manuel Lopez Obrador, and continued into the early months of Claudia Sheinbaum Pardo's current administration. Research conducted by Jacobo Najera and Miguel Trujillo, published in October 2023, documented that 21 federal government agencies were blocking traffic from the Tor network, effectively excluding privacy-conscious users from vital public resources and services.

An anonymous reader quotes a report from ZDNet: At KubeCon North America 2025 in Atlanta, the Cloud Native Computing Foundation (CNCF)'s leaders predicted an enormous surge in cloud-native computing, driven by the explosive growth of AI inference workloads. How much growth? They're predicting hundreds of billions of dollars in spending over the next 18 months. [...] Where cloud-native computing and AI inference come together is when AI is no longer a separate track from cloud-native computing. Instead, AI workloads, particularly inference tasks, are fueling a new era where intelligent applications require scalable and reliable infrastructure. That era is unfolding because, said [CNCF Executive Director Jonathan Bryce], "AI is moving from a few 'Training supercomputers' to widespread 'Enterprise Inference.' This is fundamentally a cloud-native problem. You, the platform engineers, are the ones who will build the open-source platforms that unlock enterprise AI."

"Cloud native and AI-native development are merging, and it's really an incredible place we're in right now," said CNCF CTO Chris Aniszczyk. The data backs up this opinion. For example, Google has reported that its internal inference jobs have processed 1.33 quadrillion tokens per month recently, up from 980 trillion just months before. [...] Aniszczyk added that cloud-native projects, especially Kubernetes, are adapting to serve inference workloads at scale: "Kubernetes is obviously one of the leading examples as of the last release the dynamic resource allocation feature enables GPU and TPU hardware abstraction in a Kubernetes context." To better meet the demand, the CNCF announced the Certified Kubernetes AI Conformance Program, which aims to make AI workloads as portable and reliable as traditional cloud-native applications.

"As AI moves into production, teams need a consistent infrastructure they can rely on," Aniszczyk stated during his keynote. "This initiative will create shared guardrails to ensure AI workloads behave predictably across environments. It builds on the same community-driven standards process we've used with Kubernetes to help bring consistency as AI adoption scales." What all this effort means for business is that AI inference spending on cloud-native infrastructure and services will reach into the hundreds of billions within the next 18 months. That investment is because CNCF leaders predict that enterprises will race to stand up reliable, cost-effective AI services.

Blender 5.0 has been released with major upgrades including HDR and wide-gamut color support on Linux via Wayland/Vulkan, significant theme and UI improvements, new color-space tools, revamped curve and geometry features, and expanded hardware requirements. 9to5Linux reports: Blender 5.0 also introduces a working color space for Blend files, a new AgX HDR view, a new Convert to Display compositor node, new Rec.2100-PQ and Rec.2100-HLG displays that can be used for color grading for HDR video export, and new ACES 1.3 and 2.0 views as an alternative to AgX and Filmic.

A new "Jump Time by Delta" operator for jumping forward/backward in time by a user-specified delta has been introduced as well, along with a revamped Curve drawing, which better supports the new Curves object type and all of their features, and a new Geometry Attribute constraint.

Also new is a "Cylinder" option for curve display type that allows rendering thicker curves without the flat ribbon appearance, support for the Zstd (Zstandard) fast lossless compression algorithm for point caches, as well as a new "Curve Data" panel in edit mode that allows tweaking built-in curve attribute values. A full list of changes can be found here. You can download from the official website.

UC Berkeley researchers working with Project CETI discovered that sperm whales produce vowel-like sounds embedded in their click codas, suggesting a far more complex communication system than previously understood. "It was striking just how structured the system was. I've never seen anything like that before with other animals," Begus, a UC Berkeley linguistics professor and the linguistics lead at Project CETI, told SFGATE. "We're showing the world that there's more than meets the eye in sperm whales and that, if one cares to look closely, they're not as alien. We're much more similar to each other than we used to think." SFGATE reports: With the help of a machine-learning model to identify patterns, Begus and his team combed through recordings collected from social units of sperm whales off the coast of the island of Dominica between 2005 and 2018. When they sped up the audio, removing the silences between clicks, they heard new patterns. They found acoustic properties that share similarities with two vowels -- a and i -- and several vowel combinations.

"Before, people were looking just at the timing and the number of clicks exchanged between sperm whales, but now we have to look at the frequencies, too. A whole new set of patterns have appeared," Begus said. "Now, it's one of the most complex non-human communication systems we have observed." [...] Begus said the research only shows how much more we have to learn about whales' style of communicating. He is particularly interested in exploring how the system may differ for whales between regions and how whale babies learn to communicate in this way. Most importantly, he wants to understand the meaning behind the sounds, as a "window into whale thoughts and lives." The research was published in the journal Open Mind.

Chinese automakers are rapidly expanding across South America, boosted by the new Chinese-built Port of Chancay, aggressive pricing, local partnerships, and growing regional demand. Reuters reports: China has been ramping up sales since the opening last year of the Port of Chancay, north of Lima. The Chinese-built megaport has halved trans-Pacific shipping times just as Chinese manufacturers face rising barriers to entry in the United States and greater trade restrictions in Europe.

BYD, which makes EVs, plug-in hybrids and combustion engine cars, plans to open a fourth dealership in Lima by the end of this year, while Chery and Geely have more than a dozen in total in Peru. Chinese carmakers face a profit-destroying price war at home and a growing surplus of new cars rolling out of Chinese factory lines. Much of this excess is being shipped overseas to the Middle East, Central Asia and Latin America, according to global automotive analyst Felipe Munoz at JATO Dynamics.

The Chinese have "carved out space," across both electric and petrol-powered cars, said Martin Bresciani, president of Chile's automotive business chamber, CAVEM. "The Chinese have already demonstrated that they match global standards in quality." Chinese brands reached 29.6% of all new passenger car sales in Chile in the first quarter of this year. [...] Part of China's success has been partnering with trusted local importers to offer more affordable models tailored to regional tastes, according to seven dealerships Reuters spoke to in Peru, Chile, Uruguay and Argentina.

Even after disabling remote control and officially ending support for early Nest Learning Thermostats, Google is still receiving detailed sensor and activity data from these devices, including temperature changes, motion, and ambient light. The Verge reports: After digging into the backend, security researcher Cody Kociemba found that the first- and second-generation Nest Learning Thermostats are still sending Google information about manual temperature changes, whether a person is present in the room, if sunlight is hitting the device, and more. Kociemba made the discovery while participating in a bounty program created by FULU, a right-to-repair advocacy organization cofounded by electronics repair technician and YouTuber Louis Rossmann.

FULU challenged developers to come up with a solution to restore smart functionality to Nest devices no longer supported by Google, and that's exactly what Kociemba did with his open-source No Longer Evil project. But after cloning Google's API to create this custom software, he started receiving a trove of logs from customer devices, which he turned off. "On these devices, while they [Google] turned off access to remotely control them, they did leave in the ability for the devices to upload logs. And the logs are pretty extensive," Kociemba tells The Verge. [...] "I was under the impression that the Google connection would be severed along with the remote functionality, however that connection is not severed, and instead is a one-way street," Kociemba says.

Strauss Zelnick, CEO of Take-Two Interactive, which operates publishing labels including GTA-maker Rockstar Games and 2K, said on Monday that although gaming consoles are not going away, the industry is moving toward PCs in the next decade. From a report: "I think it's moving towards PC and business is moving towards open rather than closed," Zelnick told CNBC's "Squawk Box."

"But if you define console as the property, not the system, then the notion of a very rich game that you engage in for many hours that you play on a big screen -- that's never going away." Zelnick said the current split between console and mobile is about even in the market, but mobile is growing more rapidly than consoles.

Linux kernel maintainers "are grappling with how to integrate AI-generated contributions without compromising the project's integrity," reports WebProNews: The latest push comes from a proposal by Sasha Levin, a prominent kernel developer at NVIDIA, who has outlined guidelines for tool-generated submissions. Posted to the kernel mailing list, these guidelines aim to standardize how AI-assisted patches are handled. According to Phoronix, the v3 iteration of the proposal [posted by Intel engineer Dave Hansen] emphasizes transparency and accountability, requiring developers to disclose AI involvement in their contributions. This move reflects broader industry concerns about the quality and copyright implications of machine-generated code.

Linus Torvalds, the creator of Linux, has weighed in on the debate, advocating for treating AI tools no differently than traditional coding aids. As reported by heise online, Torvalds sees no need for special copyright treatment for AI contributions, stating that they should be viewed as extensions of the developer's work. This perspective aligns with the kernel's pragmatic approach to innovation. The proposal, initially put forward by Levin in July 2025, includes a 'Co-developed-by' tag for AI-assisted patches, ensuring credit and traceability. OSTechNix details how tools like GitHub Copilot and Claude are specifically addressed, with configurations to guide their use in kernel development... ZDNET warns that without official policy, AI could 'creep' into the kernel and cause chaos...

The New Stack provides insight into how AI is already assisting kernel maintainers with mundane tasks. According to The New Stack, large language models (LLMs) are being used like 'novice interns' for drudgery work, freeing up experienced developers for complex problems... The Linux kernel's approach could set precedents for other open-source projects. With AI integration accelerating, projects like those in the Linux Foundation are watching closely... Recent kernel releases, such as 6.17.7, include performance improvements that indirectly support AI applications, as noted in Linux Compatible.

An anonymous reader shared this report from The Register: Yet another supply chain attack has hit the npm registry in what Amazon describes as "one of the largest package flooding incidents in open source registry history" — but with a twist. Instead of injecting credential-stealing code or ransomware into the packages, this one is a token farming campaign.

Amazon Inspector security researchers, using a new detection rule and AI assistance, originally spotted the suspicious npm packages in late October, and, by November 7, the team had flagged thousands. By November 12, they had uncovered more than 150,000 malicious packages across "multiple" developer accounts. These were all linked to a coordinated tea.xyz token farming campaign, we're told. This is a decentralized protocol designed to reward open-source developers for their contributions using the TEA token, a utility asset used within the tea ecosystem for incentives, staking, and governance.

Unlike the spate of package poisoning incidents over recent months, this one didn't inject traditional malware into the open source code. Instead, the miscreants created a self-replicating attack, infecting the packages with code to automatically generate and publish, thus earning cryptocurrency rewards on the backs of legitimate open source developers. The code also included tea.yaml files that linked these packages to attacker-controlled blockchain wallet addresses.
At the moment, Tea tokens have no value, points out CSO Online. "But it is suspected that the threat actors are positioning themselves to receive real cryptocurrency tokens when the Tea Protocol launches its Mainnet, where Tea tokens will have actual monetary value and can be traded..." In an interview on Friday, an executive at software supply chain management provider Sonatype, which wrote about the campaign in April 2024, told CSO that number has now grown to 153,000. "It's unfortunate that the worm isn't under control yet," said Sonatype CTO Brian Fox. And while this payload merely steals tokens, other threat actors are paying attention, he predicted. "I'm sure somebody out there in the world is looking at this massively replicating worm and wondering if they can ride that, not just to get the Tea tokens but to put some actual malware in there, because if it's replicating that fast, why wouldn't you?"

When Sonatype wrote about the campaign just over a year ago, it found a mere 15,000 packages that appeared to come from a single person. With the swollen numbers reported this week, Amazon researchers wrote that it's "one of the largest package flooding incidents in open source registry history, and represents a defining moment in supply chain security...." For now, says Sonatype's Fox, the scheme wastes the time of npm administrators, who are trying to expel over 100,000 packages. But Fox and Amazon point out the scheme could inspire others to take advantage of other reward-based systems for financial gain, or to deliver malware.
After deplooying a new detection rule "paired with AI", Amazon's security researchers' write, "within days, the system began flagging packages linked to the tea.xyz protocol... By November 7, the researchers flagged thousands of packages and began investigating what appeared to be a coordinated campaign. The next day, after validating the evaluation results and analyzing the patterns, they reached out to OpenSSF to share their findings and coordinate a response.
Their blog post thanks the Open Source Security Foundation (OpenSSF) for rapid collaboration, while calling the incident "a defining moment in supply chain security..."