For the first time in more than four years, there are fewer open jobs in the U.S. than there are job seekers. CNN: "This is a turning point for the labor market," Heather Long, chief economist at Navy Federal Credit Union, wrote Wednesday. "It's yet another crack."

The number of job openings fell to an estimated 7.18 million at the end of July, according to Bureau of Labor Statistics data released Wednesday. Job openings not only are at their lowest level in 10 months, but they're also below the number of unemployed workers (at 7.2 million) for the first time since April 2021.

Critics are denouncing Tuesday's antitrust remedies ruling against Google, calling them inadequate to restore search market competition. DuckDuckGo said the court's decision allows Google to continue using its monopoly to hold back competitors in AI search.

The Open Markets Institute called it "pure judicial cowardice" that leaves Google's power "almost fully intact." Senator Amy Klobuchar said the limited remedies demonstrate why Congress needs to pass legislation stopping dominant platforms from preferencing their own products. The News/Media Alliance criticized Judge Amit Mehta for failing to address Google forcing publishers to provide content for AI offerings to remain in search results.

"A new study released Friday found that young children diagnosed with attention-deficit/hyperactivity disorder, or ADHD, are often prescribed medication too quickly," reports CBS News: The study, led by Stanford Medicine and published in JAMA Network Open, examined the health records of nearly 10,000 preschool-aged children ages 3 to 5 between 2016 and 2023 who were diagnosed with ADHD... The Stanford study found that about 68% of those children who were diagnosed with ADHD were prescribed medications before age 7, most often stimulants such as Ritalin, which can help children focus their attention and regulate their emotions. The turn to medication often came quickly, according to the study. About 42% of the children who were diagnosed with ADHD were prescribed drugs within 30 days of diagnosis, the study found.

"We don't have concerns about the toxicity of the medications for 4- and 5-year-olds, but we do know that there is a high likelihood of treatment failure, because many families decide the side effects outweigh the benefits," Dr. Yair Bannett, assistant professor of pediatrics at Stanford Medicine and the lead author of the study, said in a statement. Those side effects can include irritability, aggressiveness and emotional problems, according to Bannett. "The high rate of medication prescriptions among preschool-age children with ADHD and the lack of delay between initial diagnosis and prescription require further investigation to assess the appropriateness of early medication treatment," the researchers concluded.

The study also found that the vast majority of the young children diagnosed with ADHD, about 76%, were boys.
CBS News interviewed Jamie Howard, senior clinical psychologist from the Child Mind Institute (who was not involved in the study). Howard said when treating ADHD in young children, clinical guidelines call for starting with "behavioral intervention...."

"I think that people have an association with ADHD and stimulant medication... But there is actually a lot more than that. And we want to give kids the opportunity to use these other strategies first, and then if they need medication, it can be incredibly helpful for a lot of kids."

When it comes to nuclear fusion energy, "How do we advance fusion as fast as possible?" asks the CEO of Commonwealth Fusion Systems. They've just raised $863 million from Nvidia, Google, the BIll Gates-founded Breakthrough Energy Ventures and nearly two dozen more investors, which "may prove helpful as the company develops its supply chain and searches for partners to build its power plants and buy electricity," reports TechCrunch.

Commonwealth's CEO/co-founder Bob Mumgaard says "This round of capital isn't just about fusion just generally as a concept... It's about how do we go to make fusion into a commercial industrial endeavor." The Massachusetts-based company has raised nearly $3 billion to date, the most of any fusion startup. Commonwealth Fusion Systems (CFS) previously raised a $1.8 billion round in 2021...

CFS is currently building a prototype reactor called Sparc in a Boston suburb. The company expects to turn that device on later next year and achieve scientific breakeven in 2027, a milestone in which the fusion reaction produces more energy than was required to ignite it. Though Sparc isn't designed to sell power to the grid, it's still vital to CFS's success. "There are parts of the modeling and the physics that we don't yet understand," Saskia Mordijck, an associate professor of physics at the College of William and Mary, told TechCrunch. "It's always an open question when you turn on a completely new device that it might go into plasma regimes we've never been into, that maybe we uncover things that we just did not expect." Assuming Sparc doesn't reveal any major problems, CFS expects to begin construction on Arc, its commercial-scale power plant, in Virginia starting in 2027 or 2028...

"We know that this kind of idea should work," Mordijck said. "The question is naturally, how will it perform?" Investors appear to like what they've seen so far. The list of participants in the Series B2 round is lengthy. No single investor led the round, and a number of existing investors increased their stakes, said Ally Yost, CFS's senior vice president of corporate development... The new round will help CFS make progress on Sparc, but it will not be enough to build Arc, which will likely cost several billion dollars, Mumgaard said.
"As advances in computing and AI have quickened the pace of research and development, the sector has become a hotbed of startup and investor activity," the article points out.

And CEO Mumgaard told TechCrunch that their Sparc prototype will prove the soundness of the science — but it's also important to learn "the capabilities that you need to be able to deliver it. It's also to have the receipts, know what these things cost!"

"From a side project in Amsterdam to powering AI at the world's biggest companies — this is the story of Python," says the description of a new 84-minute documentary.

Long-time Slashdot reader destinyland writes: It traces Python all the way back to its origins in Amsterdam back in 1991. (Although the first time Guido van Rossum showed his new language to a co-worker, they'd typed one line of code just to prove they could crash Python's first interpreter.) The language slowly spread after van Rossum released it on Usenet — split across 21 separate posts — and Robin Friedrich, a NASA aerospace engineer, remembers using Python to build flight simulations for the Space Shuttle. (Friedrich says in the documentary he also attended Guido's first in-person U.S. workshop in 1994, and "I still have the t-shirt...")

Dropbox's CEO/founder Drew Houston describes what it was like being one of the first companies to use Python to build a company reaching millions of users. (Another success story was YouTube, which was built by a small team using Python before being acquired by Google). Anaconda co-founder Travis Oliphant remembers Python's popularity increasing even more thanks to the data science/macine learning community. But the documentary also includes the controversial move to Python 3 (which broke compatability with earlier versions). Though ironically, one of the people slogging through a massive code migration ended up being van Rossum himself at his new job at Dropbox. The documentary also includes van Rossum's resignation as "Benevolent Dictator for Life" after approving the walrus operator. (In van Rossum's words, he essentially "rage-quit over this issue.")

But the focus is on Python's community. At one point, various interviewees even take turns reciting passages from the "Zen of Python" — which to this day is still hidden in Python as an import-able library as a kind of Easter Egg.
"It was a massive undertaking", the documentary's director explains in a new interview, describing a full year of interviews. (The article features screenshots from the documentary — including a young Guido van Rossum and the original 1991 email that announced Python to the world.) [Director Bechtle] is part of a group that's filmed documentaries on everything from Kubernetes and Prometheus to Angular, Node.js, and Ruby on Rails... Originally part of the job platform Honeypot, the documentary-makers relaunched in April as Cult.Repo, promising they were "100% independent and more committed than ever to telling the human stories behind technology."
Honeypot's founder Emma Tracey bought back its 272,000-subscriber YouTube channel from Honeypot's new owners, New Work SE, and Cult.Repo now bills itself as "The home of Open Source documentaries."

Over in a thread at Python.org, language creator Guido van Rossum has identified the Python community members in the film's Monty Python-esque poster art. And core developer Hugo van Kemenade notes there's also a video from EuroPython with a 55-minute Q&A about the documentary.

An anonymous reader quotes a report from Ars Technica: Earlier this month, EA announced that players in its Battlefield 6 open beta on PC would have to enable Secure Boot in their Windows OS and BIOS settings. That decision proved controversial among players who weren't able to get the finicky low-level security setting working on their machines and others who were unwilling to allow EA's anti-cheat tools to once again have kernel-level access to their systems. Now, Battlefield 6 technical director Christian Buhl is defending that requirement as something of a necessary evil to combat cheaters, even as he apologizes to any potential players that it has kept away.

"The fact is I wish we didn't have to do things like Secure Boot," Buhl said in an interview with Eurogamer. "It does prevent some players from playing the game. Some people's PCs can't handle it and they can't play: that really sucks. I wish everyone could play the game with low friction and not have to do these sorts of things." Throughout the interview, Buhl admits that even requiring Secure Boot won't completely eradicate cheating in Battlefield 6 long term. Even so, he offered that the Javelin anti-cheat tools enabled by Secure Boot's low-level system access were "some of the strongest tools in our toolbox to stop cheating. Again, nothing makes cheating impossible, but enabling Secure Boot and having kernel-level access makes it so much harder to cheat and so much easier for us to find and stop cheating." [...]

Despite all these justifications for the Secure Boot requirement on EA's part, it hasn't been hard to find people complaining about what they see as an onerous barrier to playing an online shooter. A quick Reddit search turns up dozens of posts complaining about the difficulty of getting Secure Boot on certain PC configurations or expressing discomfort about installing what they consider a "malware rootkit" on their machine. "I want to play this beta but A) I'm worried about bricking my PC. B) I'm worried about giving EA complete access to my machine," one representative Redditor wrote.

Apple has warned that "EU-style rules" proposed by the UK competition watchdog "are bad for users and bad for developers." From a report: It says EU laws -- which have sought to make it easier for smaller firms to compete with big tech -- have resulted in some Apple features and enhancements being delayed for European users. It argues the UK risks similar hold-ups if the Competition and Markets Authority (CMA) pushes ahead with plans designed to open up markets the regulator says is too dominated by Apple and Google.

[...] The CMA wants UK app makers to be able to use and exchange data with Apple's mobile technology -- something called "interoperability." Without it, app makers cannot create the full range of innovative products and services, it argues. Apple claims under EU interoperability rules it has received over 100 requests -- some from big tech rivals -- demanding access to sensitive user data, including sensitive information Apple itself cannot access. It argues the rules are effectively allowing other firms to demand its data and intellectual property for free.

Japan has launched its first entirely homegrown quantum computer, built with domestic superconducting qubits and components, and running on the country's own open-source software toolchain, OQTOPUS. "The system is now ready to take on workloads from its base at the University of Osaka's Center for Quantum Information and Quantum Biology (QIQB)," reports LiveScience. From the report: The system uses a quantum chip with superconducting qubits -- quantum bits derived from metals that exhibit zero electrical resistance when cooled to temperatures close to absolute zero (minus 459.67 degrees Fahrenheit, or minus 273.15 degrees Celsius). The quantum processing unit (QPU) was developed at the Japanese research institute RIKEN. Other components that make up the "chandelier" -- the main body of the quantum computer -- include the chip package, delivered by Seiken, the magnetic shield, infrared filters, bandpass filters, a low-noise amplifier and various cables.

These are all housed in a dilution refrigerator (a specialized cryogenic device that cools the quantum computing components) to allow for those extremely low temperatures. It also comes alongside a pulse tube refrigerator (which again cools various components in use), controllers and a low-noise power source. OQTOPUS, meanwhile, is a collection of open-source tools that include everything required to run quantum programs. It includes the core engine and cloud module, as well as graphical user interface (GUI) elements, and is designed to be built on top of a QPU and quantum control hardware.

samleecole shares a report from 404 Media: An app developer has jailbroken Echelon exercise bikes to restore functionality that the company put behind a paywall last month, but copyright laws prevent him from being allowed to legally release it. Last month, Peloton competitor Echelon pushed a firmware update to its exercise equipment that forces its machines to connect to the company's servers in order to work properly. Echelon was popular in part because it was possible to connect Echelon bikes, treadmills, and rowing machines to free or cheap third-party apps and collect information like pedaling power, distance traveled, and other basic functionality that one might want from a piece of exercise equipment. With the new firmware update, the machines work only with constant internet access and getting anything beyond extremely basic functionality requires an Echelon subscription, which can cost hundreds of dollars a year.

App engineer Ricky Witherspoon, who makes an app called SyncSpin that used to work with Echelon bikes, told 404 Media that he successfully restored offline functionality to Echelon equipment and won the Fulu Foundation bounty. But he and the foundation said that he cannot open source or release it because doing so would run afoul of Section 1201 of the Digital Millennium Copyright Act, the wide-ranging copyright law that in part governs reverse engineering. There are various exemptions to Section 1201, but most of them allow for jailbreaks like the one Witherspoon developed to only be used for personal use. [...] "I don't feel like going down a legal rabbit hole, so for now it's just about spreading awareness that this is possible, and that there's another example of egregious behavior from a company like this [...] if one day releasing this was made legal, I would absolutely open source this. I can legally talk about how I did this to a certain degree, and if someone else wants to do this, they can open source it if they want to."

A widely used Node.js utility called fast-glob, relied on by thousands of projectsâ"including over 30 U.S. Department of Defense systems -- is maintained solely by a Russian developer linked to Yandex. While there's no evidence of malicious activity, cybersecurity experts warn that the lack of oversight in such critical open-source projects leaves them vulnerable to potential exploitation by state-backed actors. The Register reports: US cybersecurity firm Hunted Labs reported the revelations on Wednesday. The utility in question is fast-glob, which is used to find files and folders that match specific patterns. Its maintainer goes by the handle "mrmlnc", and the Github profile associated with that handle identifies its owner as a Yandex developer named Denis Malinochkin living in a suburb of Moscow. A website associated with that handle also identifies its owner as the same person, as Hunted Labs pointed out.

Hunted Labs told us that it didn't speak to Malinochkin prior to publication of its report today, and that it found no ties between him and any threat actor. According to Hunted Labs, fast-glob is downloaded more than 79 million times a week and is currently used by more than 5,000 public projects in addition to the DoD systems and Node.js container images that include it. That's not to mention private projects that might use it, meaning that the actual number of at-risk projects could be far greater.

While fast-glob has no known CVEs, the utility has deep access to systems that use it, potentially giving Russia a number of attack vectors to exploit. Fast-glob could attack filesystems directly to expose and steal info, launch a DoS or glob-injection attack, include a kill switch to stop downstream software from functioning properly, or inject additional malware, a list Hunted Labs said is hardly exhaustive. [...] Hunted Labs cofounder Haden Smith told The Register that the ties are cause for concern. "Every piece of code written by Russians isn't automatically suspect, but popular packages with no external oversight are ripe for the taking by state or state-backed actors looking to further their aims," Smith told us in an email. "As a whole, the open source community should be paying more attention to this risk and mitigating it." [...]

Hunted Labs said that the simplest solution for the thousands of projects using fast-glob would be for Malinochkin to add additional maintainers and enhance project oversight, as the only other alternative would be for anyone using it to find a suitable replacement. "Open source software doesn't need a CVE to be dangerous," Hunted Labs said of the matter. "It only needs access, obscurity, and complacency," something we've noted before is an ongoing problem for open source projects. This serves as another powerful reminder that knowing who writes your code is just as critical as understanding what the code does," Hunted Labs concluded.

Dish's parent company EchoStar is selling $23 billion worth of 5G spectrum licenses to AT&T and shifting Boost Mobile onto AT&T and T-Mobile networks, effectively abandoning its bid to become the fourth major U.S. wireless carrier. The Verge reports: As part of T-Mobile's deal to acquire Sprint in 2019, the Department of Justice stipulated that another company must replace it as the fourth major wireless carrier. Dish came forward to acquire Boost Mobile from Sprint, paying $1.4 billion to purchase the budget carrier and other prepaid assets. Since then, Dish has spent billions acquiring spectrum to build out its own 5G network, which the company said was close to reaching 80 percent of the US population as of last year, in line with the Federal Communications Commission's deadline to meet certain coverage requirements.

But Dish struggled to repay mounting debt, leading it to rejoin EchoStar, the company it originally spun off from in 2008. And at the same time, it came under renewed pressure from the FCC to make use of its spectrum. In April, the Elon Musk-owned SpaceX wrote a letter to the FCC saying EchoStar "barely uses" the AWS-4 (2GHz) spectrum band for satellite connectivity. Weeks later, FCC chair Brendan Carr opened an investigation into EchoStar's 5G expansion, criticizing the company's slow buildout and claiming that it had lost Boost Mobile customers since its acquisition of the carrier. Carr also questioned EchoStar's use of the AWS-4 spectrum, which isn't included in its deal with AT&T.

In July, Carr said that he's not concerned with having a fourth mobile provider, saying during an open meeting that there isn't a "magic number" of carriers needed in the US to maintain competition. "We're always looking at a confluence of different factors to make sure that there's sufficient competition," he said, as reported by Fierce Network. Now, EchoStar will become a hybrid mobile network operator, which is a carrier that operates on its own network, in addition to using other companies' infrastructure. As noted in the press release, Boost Mobile will provide connectivity through AT&T towers and the T-Mobile network. "This ensures the survival of Boost Mobile," [said Roger Entner, founder and lead analyst at Recon Analytics]. "It gives them money, but at the end, they don't have much of a network left."

BrianFagioli shares a report from NERDS.xyz: Hosting.com has acquired Rocket.net, bringing the fast-growing managed WordPress hosting company under its corporate umbrella. The move gives hosting.com a proven SaaS platform and a strong brand in WordPress hosting, while Rocket.net gains the capital and global reach of a much larger player. Financial details of the deal were not disclosed.

Rocket.net will continue to operate under its own name, but it is now part of hosting.com's family of brands. As part of the deal, Rocket.net founder and CEO Ben Gabler has been appointed Chief Product Officer at hosting.com, where he will lead product and software engineering across the entire company. [...] For hosting.com, the acquisition strengthens its ability to serve a wider range of customers. The company, founded in 2019, already operates more than 20 data centers, powers over 3 million websites, and serves 600,000 customers worldwide with a team of 900 employees.

The Rocket.net platform will now be rolled out across hosting.com's global footprint, including the USA, UK, Germany, and Singapore, as well as new regions such as Mexico, the UAE, and Australia. Both companies stress that their commitment to WordPress and open source will remain intact. Hosting.com already sponsors global WordCamps and encourages employees to contribute to the WordPress project, while Rocket.net has long positioned itself as a champion of the open web.

The Document Foundation, which operates the popular open source productivity suite LibreOffice, is positioning the suite's newest release, v25.8, as a strategic asset for digital sovereignty, targeting governments and enterprises seeking independence from foreign software vendors and cloud infrastructure.

The Document Foundation released the update last week with zero telemetry architecture, full offline capability, and OpenPGP encryption for documents, directly addressing national security concerns about extraterritorial surveillance and software backdoors. The suite requires no internet access for any features and maintains complete transparency through open source code that governments can audit. Government bodies in Germany, Denmark, and France, alongside national ministries in Italy and Brazil, have deployed LibreOffice to meet GDPR compliance, national procurement laws, and IT localization mandates while eliminating unpredictable licensing costs from proprietary vendors.

"It's time to own your documents, own your infrastructure, and own your future," the foundation wrote in a blog post.

More than 30,000 Python developers from around the world answered questions for the Python Software Foundation's annual survey — and PSF Fellow Michael Kennedy tells the Python community what they've learned in a new blog post. Some highlights: Most still use older Python versions despite benefits of newer releases... Many of us (15%) are running on the very latest released version of Python, but more likely than not, we're using a version a year old or older (83%). [Although less than 1% are using "Python 3.5 or lower".] The survey also indicates that many of us are using Docker and containers to execute our code, which makes this 83% or higher number even more surprising... You simply choose a newer runtime, and your code runs faster. CPython has been extremely good at backward compatibility. There's rarely significant effort involved in upgrading... [He calculates some cloud users are paying up to $420,000 and $5.6M more in compute costs.] If your company realizes you are burning an extra $0.4M-$5M a year because you haven't gotten around to spending the day it takes to upgrade, that'll be a tough conversation...

Rust is how we speed up Python now... The Python Language Summit of 2025 revealed that "Somewhere between one-quarter and one-third of all native code being uploaded to PyPI for new projects uses Rust", indicating that "people are choosing to start new projects using Rust". Looking into the survey results, we see that Rust usage grew from 27% to 33% for binary extensions to Python packages... [The blog post later advises Python developers to learn to read basic Rust, "not to replace Python, but to complement it," since Rust "is becoming increasingly important in the most significant portions of the Python ecosystem."]

PostgreSQL is the king of Python databases, and only it's growing, going from 43% to 49%. That's +14% year over year, which is remarkable for a 28-year-old open-source project... [E]very single database in the top six grew in usage year over year. This is likely another indicator that web development itself is growing again, as discussed above...

[N]early half of the respondents (49%) plan to try AI coding agents in the coming year. Program managers at major tech companies have stated that they almost cannot hire developers who don't embrace agentic AI. The productive delta between those using it and those who avoid it is simply too great (estimated at about 30% greater productivity with AI).
It's their eighth annual survey (conducted in collaboration with JetBrains last October and November). But even though Python is 34 years old, it's still evolving. "In just the past few months, we have seen two new high-performance typing tools released," notes the blog post. (The ty and Pyrefly typecheckers — both written in Rust.) And Python 3.14 will be the first version of Python to completely support free-threaded Python... Just last week, the steering council and core developers officially accepted this as a permanent part of the language and runtime... Developers and data scientists will have to think more carefully about threaded code with locks, race conditions, and the performance benefits that come with it. Package maintainers, especially those with native code extensions, may have to rewrite some of their code to support free-threaded Python so they themselves do not enter race conditions and deadlocks.

There is a massive upside to this as well. I'm currently writing this on the cheapest Apple Mac Mini M4. This computer comes with 10 CPU cores. That means until this change manifests in Python, the maximum performance I can get out of a single Python process is 10% of what my machine is actually capable of. Once free-threaded Python is fully part of the ecosystem, I should get much closer to maximum capacity with a standard Python program using threading and the async and await keywords.
Some other notable findings from the survey:

• Data science is now over half of all Python. This year, 51% of all surveyed Python developers are involved in data exploration and processing, with pandas and NumPy being the tools most commonly used for this.

• Exactly 50% of respondents have less than two years of professional coding experience! And 39% have less than two years of experience with Python (even in hobbyist or educational settings)...

• "The survey tells us that one-third of devs contributed to open source. This manifests primarily as code and documentation/tutorial additions."

"The ultimate test of climate projections is to compare them with what has played out..." says earth sciences professor Torbjörn Törnqvist, lead author on a new study published in the open-access journal Earth's Future (published by the American Geophysical Union).

But after "decades of observations," he says his researchers "were quite amazed how good those early projections were, especially when you think about how crude the models were back then, compared to what is available now." "For anyone who questions the role of humans in changing our climate, here is some of the best proof that we have understood for decades what is really happening, and that we can make credible projections...."

A new era of monitoring global sea-level change took off when satellites were launched in the early 1990s to measure the height of the ocean surface. This showed that the rate of global sea-level rise since that time has averaged about one eighth of an inch per year. Only more recently, it became possible to detect that the rate of global sea-level rise is accelerating. When NASA researchers demonstrated in October 2024 that the rate has doubled during this 30-year period, the time was right to compare this finding with projections that were made during the mid-1990s, independent of the satellite measurements.

In 1996, the Intergovernmental Panel on Climate Change published an assessment report soon after the satellite-based sea-level measurements had started. It projected that the most likely amount of global sea-level rise over the next 30 years would be almost 8 centimeters (3 inches), remarkably close to the 9 centimeters that has occurred.

But it also underestimated the role of melting ice sheets by more than 2 centimeters (about 1 inch). At the time, little was known about the role of warming ocean waters and how that could destabilize marine sectors of the Antarctic Ice Sheet from below. Ice flow from the Greenland Ice Sheet into the ocean has also been faster than foreseen.
"The findings provide confidence in model-based climate projections," according to the paper. Again, its two key points:

• The largest disparities between projections and observations were due to underestimated dynamic mass loss of ice sheets

• Comparison of past projections with subsequent observations gives confidence in future climate projections

Thanks to Slashdot reader Mr. Dollar Ton for sharing the news.

"Only a tiny fraction of the more than 7,000 languages on Earth are supported by artificial intelligence models," reported SiliconANGLE this week. So Nvidia announced "a massive new AI-ready dataset and models to support the development of high-quality AI translation for European languages." The new dataset, named Granary, is a massive open-source corpus of multilingual audio, including more than a million hours of audio, plus 650,000 hours of speech recognition and 350,000 hours of speech translation. Nvidia's speech AI team collaborated with researchers from Carnegie Mellon University and Fondazione Bruno Kessler to process unlabeled audio and public speech data into information usable for AI training... Granary includes 25 European languages, representing nearly all of the European Union's 24 official languages, plus Russian and Ukrainian. The dataset also contains languages with limited available data, such as Croatian, Estonian and Maltese. This is critically important because providing these underrepresented human-annotated datasets will enable developers to create more inclusive speech technologies for audiences who speak those languages, while using less training data in their AI applications and models... The team demonstrated in their research paper that, compared to other popular datasets, it takes around half as much Granary training data to achieve high accuracy for automatic speech recognition and automatic speech translation.

Alongside Granary, Nvidia also released new Canary and Parakeet models to demonstrate what can be created with the dataset... The new Canary is available under a fairly permissive license for commercial and research use, expanding Canary's current languages from four to 25. It offers transcription and translation quality comparable to models three times larger while running inference up to 10 times faster. At 1 billion parameters, it can run completely on-device on most next-gen flagship smartphones for speech translation on the fly.

Reviewers are more likely to approve a manuscript if their own work is cited in subsequent versions than are reviewers who are not cited, according to an analysis of 18,400 articles from four open-access publications. From a report: The study, which is yet to be peer reviewed, was posted online as a preprint earlier this month. The study was inspired by anecdotes from authors who cited articles only because reviewers asked them to, says study author Adrian Barnett, who researches peer review and meta-research at Queensland University of Technology in Brisbane, Australia. Sometimes, these requests are fine, he says. But if reviewers ask for too many citations or the reason to cite their work is not justified, the peer-review process can become transactional, says Barnett. Citations increase a researcher's h-index, a metric reflecting the impact of their publications.

The women-only dating-advice app Tea "has been hit with 10 potential class action lawsuits in federal and state court," NBC News reported last week, "after a data breach led to the leak of thousands of selfies, ID photos and private conversations online." The suits could result in Tea having to pay tens of millions of dollars in damages to the plaintiffs, which could be catastrophic for the company, an expert told NBC News... One of the suits lists the right-wing online discussion board 4chan and the social platform X as defendants, alleging that they allowed bad actors to spread users' personal information.
But meanwhile, a new competing app for men called "TeaOnHer" has already been launched. And it was also found to have enormous security flaws, reports TechCrunch, that "exposed its users' personal information, including photos of their driver's licenses and other government-issued identity documents..." [W]hen we looked at the TeaOnHer's public internet records, it had no meaningful information other than a single subdomain, appserver.teaonher.com. When we opened this page in our browser, what loaded was the landing page for TeaOnHer's API (for the curious, we uploaded a copy here)... It was on this landing page that we found the exposed email address and plaintext password (which wasn't that far off from "password") for [TeaOnHer developer Xavier] Lampkin's account to access the TeaOnHer "admin panel"... This API landing page included an endpoint called /docs, which contained the API's auto-generated documentation (powered by a product called Swagger UI) that contained the full list of commands that can be performed on the API [including administrator commands to return user data]...

While it's not uncommon for developers to publish their API documentation, the problem here was that some API requests could be made without any authentication — no passwords or credentials were needed...

The records returned from TeaOnHer's server contained users' unique identifiers within the app (essentially a string of random letters and numbers), their public profile screen name, and self-reported age and location, along with their private email address. The records also included web address links containing photos of the users' driver's licenses and corresponding selfies. Worse, these photos of driver's licenses, government-issued IDs, and selfies were stored in an Amazon-hosted S3 cloud server set as publicly accessible to anyone with their web addresses. This public setting lets anyone with a link to someone's identity documents open the files from anywhere with no restrictions...

The bugs were so easy to find that it would be sheer luck if nobody malicious found them before we did. We asked, but Lampkin would not say if he has the technical ability, such as logs, to determine if anyone had used (or misused) the API at any time to gain access to users' verification documents, such as by scraping web addresses from the API. In the days since our report to Lampkin, the API landing page has been taken down, along with its documentation page, and it now displays only the state of the server that the TeaOnHer API is running on as "healthy."
The flaws were discovered while TeaOnHer was the #2 free app in the Apple App Store, the article points out. And while these flaws "appear to be resolved," the article notes a larger issue. "Shoddy coding and security flaws highlight the ongoing privacy risks inherent in requiring users to submit sensitive information to use apps and websites,"

And TeaOnHer also had another authentication issue. A female reporter at Cosmopolitan also noted Friday that TeaOnHer "lets you browse through profiles before your verifications are complete. So literally anyone (like myself) can read reviews..."

Protected KVM (pKVM), the hypervisor powering the Android Virtualization Framework, has officially achieved SESIP Level 5 certification (in testing by cybersecurity lab Dekra against the TrustCB SESIP scheme).

Google's security blog called the certification "a watershed moment," and a "new benchmark" for both open-source security — and for the future of consumer electronics. "It provides a single, open-source, and exceptionally high-quality firmware base that all device manufacturers can build upon." This makes pKVM the first software security system designed for large-scale deployment in consumer electronics to meet this assurance bar. The implications for the future of secure mobile technology are profound. With this level of security assurance, Android is now positioned to securely support the next generation of high-criticality isolated workloads. This includes vital features, such as on-device AI workloads that can operate on ultra-personalized data, with the highest assurances of privacy and integrity...

Achieving Security Evaluation Standard for IoT Platforms (SESIP) Level 5 is a landmark because it incorporates AVA_VAN.5, the highest level of vulnerability analysis and penetration testing under the ISO 15408 (Common Criteria) standard. A system certified to this level has been evaluated to be resistant to highly skilled, knowledgeable, well-motivated, and well-funded attackers who may have insider knowledge and access. This certification is the cornerstone of the next-generation of Android's multi-layered security strategy. Many of the TEEs (Trusted Execution Environments) used in the industry have not been formally certified or have only achieved lower levels of security assurance... Looking ahead, Android device manufacturers will be required to use isolation technology that meets this same level of security for various security operations that the device relies on. Protected KVM ensures that every user can benefit from a consistent, transparent, and verifiably secure foundation.
"This achievement represents just one important aspect of the immense, multi-year dedication from the Linux and KVM developer communities and multiple engineering teams at Google developing pKVM and AVF," the post concludes.

"We look forward to seeing the open-source community and Android ecosystem continue to build on this foundation, delivering a new era of high-assurance mobile technology for users."

Three years ago security researcher Eaton Zveare discovered a vulnerability in Jacuzzi's SmartTub interface allowing access to the personal data of every hot tub owner.

Now Zverae says flaws in an unnamed carmaker's dealership portal "exposed the private information and vehicle data of its customers," reports TechCrunch, "and could have allowed hackers to remotely break into any of its customers' vehicles." Zveare, who works as a security researcher at software delivery company Harness, told TechCrunch the flaw he discovered allowed the creation of a ["national"] admin account that granted "unfettered access" to the unnamed carmaker's centralized web portal. With this access, a malicious hacker could have viewed the personal and financial data of the carmaker's customers, tracked vehicles, and enrolled customers in features that allow owners — or the hackers — to control some of their cars' functions from anywhere.

Zveare said he doesn't plan on naming the vendor, but said it was a widely known automaker with several popular sub-brands.

In an interview with TechCrunch ahead of his talk at the Def Con security conference in Las Vegas on Sunday, Zveare said the bugs put a spotlight on the security of these dealership systems, which grant their employees and associates broad access to customer and vehicle information... The flaws were problematic because the buggy code loaded in the user's browser when opening the portal's login page, allowing the user — in this case, Zveare — to modify the code to bypass the login security checks. Zveare told TechCrunch that the carmaker found no evidence of past exploitation, suggesting he was the first to find it and report it to the carmaker.

When logged in, the account granted access to more than 1,000 of the carmakers' dealers across the United States, he told TechCrunch... With access to the portal, Zveare said it was also possible to pair any vehicle with a mobile account, which allows customers to remotely control some of their cars' functions from an app, such as unlocking their cars... "The takeaway is that only two simple API vulnerabilities blasted the doors open, and it's always related to authentication," said Zveare. "If you're going to get those wrong, then everything just falls down."
Zveare told TechCrunch the portals even included "telematics systems that allowed the real-time location tracking of rental or courtesy cars...

"Zveare said the bugs took about a week to fix in February 2025 soon after his disclosure to the carmaker."

Thanks to long-time Slashdot reader schwit1 for sharing the article.