A Google engineer has warned that a major shift in web browser caching is upending long-standing performance optimization practices. Browsers have overhauled their caching systems that forces websites to maintain separate copies of shared resources instead of reusing them across domains.

The new "double-keyed caching" system, implemented to enhance privacy, is ending the era of shared public content delivery networks, writes Google engineer Addy Osmani. According to Chrome's data, the change has led to a 3.6% increase in cache misses and 4% rise in network bandwidth usage.

Tech workers at major U.S. companies are earning thousands of dollars by referring job candidates they've never met, creating an underground marketplace for employment referrals at firms like Microsoft and Nvidia, according to Bloomberg.

One tech worker cited in the report earned $30,000 in referral bonuses after recommending over 1,000 strangers to his employer over 18 months, resulting in more than six successful hires. While platforms like ReferralHub charge up to $50 per referral, Goldman Sachs and Google said such practices violate their policies. Google requires referrals to be based on personal knowledge of candidates.

Richard Stallman founded the Free Software Foundation as a nonprofit in 1985 with four other directors (including MIT computer science professor Gerald Jay Sussman). Sussman remains on the Board of directors, along with EFF co-founder John Gilmore and five others.

Friday the eight directors published a new article explaining how their goal and principles are protected by the nonprofit's governance structure: An obvious option, used by many organizations, was to let supporters sign up as members and have the members' votes control everything about the organization. We rejected that approach because it would have made the organization vulnerable to being taken over by people who disagreed with its mission... [A]ctivist organizations should be steady in their mission. Already in 1985, we could see that many of the people who appreciated the GNU Project's work (developing useful GNU software packages) did not support our goal and values. To look at software issues in terms of freedom was radical and many were reluctant to consider it... So we chose a structure whereby the FSF's governing body would appoint new people to itself... [T]he FSF voting members consist of all the present board members and some past board members. We have found that having some former board members remain as voting members helps stabilize the base of FSF governance.

The divergence between our values and those of most users was expressed differently after 1998, when the term "open source" was coined. It referred to a class of programs which were free/libre or pretty close, but it stood for the same old values of convenience and success, not the goal of freedom for the users of those programs. For them, "scratching your own itch" replaced liberating the community around us. People could become supporters of "open source" without any change in their ideas of right and wrong... It would have been almost inevitable for supporters of "open source" to join the FSF, then vote to convert it into an "open source" organization, if its structure allowed such a course. Fortunately, we had made sure it did not. So we were able to continue spreading the idea that software freedom is a freedom that everyone needs and everyone is entitled to, just like freedom of speech.

In recent years, several influential "open source" organizations have come to be dominated by large companies. Large companies are accustomed to seeking indirect political power, and astroturf campaigns are one of their usual methods. It would be easy for companies to pay thousands of people to join the FSF if by doing so they could alter its goals and values. Once again, our defensive structure has protected us...

A recent source of disagreement with the free software movement's philosophy comes from those who would like to make software licenses forbid the use of programs for various practices they consider harmful. Such license restrictions would not achieve the goal of ending those practices and each restriction would split the free software community. Use restrictions are inimical to the free software community; whatever we think of the practices they try to forbid, we must oppose making software licenses restrict them. Software developers should not have the power to control what jobs people do with their computers by attaching license restrictions. And when some acts that can be done by using computing call for systematic prohibition, we must not allow companies that offer software or online services to decide which ones. Such restrictions, when they are necessary, must be laws, adopted democratically by legislatures...

What new political disagreements will exist in the free software community ten, twenty or thirty years from now? People may try to disconnect the FSF from its values for reasons we have not anticipated, but we can be confident that our structure will give us a base for standing firm. We recently asked our associate members to help us evaluate the current members of the FSF board of directors through a process that will help us preserve the basic structure that protects the FSF from pressure to change its values. A year ago we used this process to select new board members, and it worked very well.

Sincerely,

The Free Software Foundation Board of Directors

Meta CEO Mark Zuckerberg criticized Apple's innovation record and business practices in a Joe Rogan podcast interview on January 10, claiming the iPhone maker has not "invented anything great in a while" and is "just sitting" on its flagship product 20 years after Steve Jobs created it.

Zuckerberg accused Apple of using arbitrary App Store rules and 30% developer fees to offset declining iPhone sales. He also said Apple blocks competitors from accessing iPhone protocols, citing Meta's failed attempt to integrate its Ray-Ban smart glasses with Apple's connectivity features. The Meta chief also criticized Apple's $3,500 Vision Pro headset, calling it inferior to Meta's $300-400 device.

It's "what some experts consider the most advanced military AI initiative ever to be deployed," reports the Washington Post.

But the Israeli military's AI-powered intelligence practices are also "under scrutiny. Genocide charges against Israel brought to The Hague by South Africa question whether crucial decisions about bombing targets in Gaza were made by software, an investigation that could hasten a global debate about the role of AI technology in warfare." After the brutal Oct. 7, 2023, attack by Hamas, the Israel Defense Forces deluged Gaza with bombs, drawing on a database painstakingly compiled through the years that detailed home addresses, tunnels and other infrastructure critical to the militant group. But then the target bank ran low. To maintain the war's breakneck pace, the IDF turned to an elaborate artificial intelligence tool called Habsora — or "the Gospel" — which could quickly generate hundreds of additional targets. The use of AI to rapidly refill IDF's target bank allowed the military to continue its campaign uninterrupted, according to two people familiar with the operation. It is an example of how the decade-long program to place advanced AI tools at the center of IDF's intelligence operations has contributed to the violence of Israel's 14-month war in Gaza... People familiar with the IDF's practices, including soldiers who have served in the war, say Israel's military has significantly expanded the number of acceptable civilian casualties from historic norms. Some argue this shift is enabled by automation, which has made it easier to speedily generate large quantities of targets, including of low-level militants who participated in the Oct. 7 attacks.
In a statement to The Post, the IDF argued that "If anything, these tools have minimized collateral damage and raised the accuracy of the human-led process." The IDF requires an officer to sign off on any recommendations from its "big data processing" systems, according to an intelligence official who spoke on the condition of anonymity because Israel does not release division leaders' names. The Gospel and other AI tools do not make decisions autonomously, the person added...Recommendations that survive vetting by an intelligence analyst are placed in the target bank by a senior officer...

Another machine learning tool, called Lavender, uses a percentage score to predict how likely a Palestinian is to be a member of a militant group, allowing the IDF to quickly generate a large volume of potential human targets... The rule mandating two pieces of human-derived intelligence to validate a prediction from Lavender was dropped to one at the outset of the war, according to two people familiar with the efforts. In some cases in the Gaza division, soldiers who were poorly trained in using the technology attacked human targets without corroborating Lavender's predictions at all, the soldier said.
The article includes an ominous quote from Steven Feldstein, a senior fellow at the Carnegie Endowment who researches the use of AI in war. Feldstein acknowledges questions of accuracy, but also notes the accelerated speed of the systems, and the ultimate higher death count. His conclusion?

"What's happening in Gaza is a forerunner of a broader shift in how war is being fought."

Traditional airlines worldwide are rapidly eliminating long-standing perks from their basic fares, blurring the line between full-service and budget carriers, according to industry analysis of 90 major airlines.

Air Canada's decision to ban standard carry-on luggage for its lowest-fare passengers from January 3 marks the latest rollback, joining United Airlines, Finnair, and others. Most legacy carriers, including British Airways, Air France, and Lufthansa, have already stripped checked baggage and seat selection from basic fares, signaling an industry-wide shift toward budget airline practices.

Reuters reports: Finnish police said on Sunday they had found tracks that drag on for dozens of kilometres along the bottom of the Baltic Sea where a tanker carrying Russian oil is suspected of breaking a power line and four telecoms cables with its anchor... A break in the 658 megawatt (MW) Estlink 2 power cable between Finland and Estonia occurred at midday on Wednesday, leaving only the 358 MW Estlink 1 linking the two countries, grid operators said. They said Estlink 2 might not be back in service before August.
In an interesting twist, the New York Times reports that the ship "bears all the hallmarks of vessels belonging to Russia's shadow fleet, officials said, and had embarked from a Russian port shortly before the cables were cut." If confirmed, it would be the first known instance of a shadow fleet vessel being used to intentionally sabotage critical infrastructure in Europe — and, officials and experts said, a clear escalation by Russia in its conflict with the West... NATO's general secretary, Mark Rutte, responding to requests from the leaders of Finland and Estonia, both member nations, said the Atlantic alliance would "enhance" its military presence in the Baltic Sea...

Since Russia began assembling its fleet, the number of shadow vessels traversing the oceans has grown by hundreds and now makes up 17 percent of the total global oil tanker fleet... Nearly 70 percent of Russia's oil is being transported by shadow tankers, according to an analysis published in October by the Kyiv School of Economics Institute, a research organization based in Ukraine... The authorities in Finland are still investigating whether the "Eagle S" engaged in a criminal act. But the sheer size of the shadow fleet might have made using some of these vessels for sabotage irresistible to Russia, [said Elisabeth Braw, a senior fellow at the Atlantic Council who has researched and written about shadow fleets]...

While it's still not certain that this week's cable cutting was done intentionally, the Baltic Sea, for a number of reasons, is an ideal arena to carry out sabotage operations. It is relatively shallow and is crisscrossed with essential undersea cables and pipelines that provide energy, as well as internet and phone services, to a number of European countries that are NATO members. Russia has relatively unfettered access to the sea from several ports, and its commercial vessels, protected by international maritime law, can move around international waters largely unmolested... The suspicions that Russia was using shadow vessels for more than just escaping sanctions existed before this week's cable cutting. Last April, the head of Sweden's Navy told a local news outlet that there was evidence such ships were being used to conduct signals intelligence on behalf of Russia and that some fishing vessels had been spotted with antennas and masts not normally seen on commercial vessels. Since the war began, there has also been an uptick in suspicious episodes resulting in damage to critical undersea infrastructure...

Hours after Finland's energy grid operator alerted the police that an undersea power cable was damaged on Wednesday, Finnish officers descended by helicopter to the ship's deck and took over the bridge, preventing the vessel from sailing farther. By Friday, it remained at anchor in the Gulf of Finland, guarded by a Finnish Defense Forces missile boat and a Border Guard patrol vessel.
The cable incident happened just weeks after the EU issued new sanctions targetting Russia's shadow fleet, Euronews reports. "A handful of Chinese companies suspected of enabling Russia's production of drones are also blacklisted as part of the agreement, a diplomat told Euronews." The "shadow fleet" has been accused of deceptive practices, including transmitting falsified data and turning off their transporters to become invisible to satellite systems, and conducting multiple ship-to-ship transfers to conceal the origin of the oil barrels...

President Biden on Monday signed the SHARE IT Act (H.R. 9566) into law, mandating federal agencies share custom-developed code with each other to prevent duplicative software development contracts and reduce the $12 billion annual government software expenditure. The law requires agencies to publicly list metadata about custom code, establish sharing policies, and align development with best practices while exempting classified, national security, and privacy-sensitive code. FedScoop reports: Under the law, agency chief information officers are required to develop policies within 180 days of enactment that implement the act. Those policies need to ensure that custom-developed code aligns with best practices, establish a process for making the metadata for custom code publicly available, and outline a standardized reporting process. Per the new law, metadata includes information about whether custom code was developed under a contract or shared in a repository, the contract number, and a hyperlink to the repository where the code was shared. The legislation also has industry support. Stan Shepard, Atlassian's general counsel, said that the company shares "the belief that greater collaboration and sharing of custom code will promote openness, efficiency, and innovation across the federal enterprise."

The Federal Trade Commission has launched a broad antitrust investigation into Microsoft's business practices, focusing on how the company bundles its Office products with cybersecurity and cloud computing services.

The probe follows ProPublica reporting that revealed Microsoft offered free temporary upgrades of federal agencies' software licenses to include advanced cybersecurity features, leading to long-term contracts once the trial period ended. The strategy helped Microsoft expand its government business while displacing competitors in both cybersecurity and cloud computing markets.

The investigation includes scrutiny of Microsoft's identity management product Entra ID, formerly Azure Active Directory. The FTC has issued a civil investigative demand compelling the company to turn over information. The probe represents one of FTC Chair Lina Khan's final moves before leadership changes under the Biden administration. Microsoft confirmed receiving the demand but called it "broad, wide ranging, and requests things that are out of the realm of possibility to even be logical."

In 2024, North Korean state-sponsored hackers stole $1.34 billion in cryptocurrency across 47 attacks, marking a 102.88% increase from 2023 and accounting for 61% of global crypto theft. BleepingComputer reports: Although the total number of incidents in 2024 reached a record-breaking 303, the total losses figure isn't unprecedented, as 2022 remains the most damaging year with $3.7 billion. Chainalysis says most of the incidents this year occurred between January and July, during which 72% of the total amount for 2024 was stolen. The report highlights the DMM Bitcoin hack from May, where over $305 million was lost, and the WazirX cyberheist from July, which resulted in the loss of $235 million.

As for what types of platforms suffered the most damage, DeFi platforms were followed by centralized services. Regarding the means, the analysts report that private key compromises accounted for 44% of the losses, while exploitation of security flaws corresponded to just 6.3% of stolen cryptocurrency. This is a sign that security audits have a significant effect on reducing exploitable flaws on the platforms. However, stricter security practices in the handling of private keys need to be implemented.

An anonymous reader quotes a report from The Verge: The Consumer Financial Protection Bureau (CFPB) is suing Walmart and payroll service provider Branch Messenger for alleged illegal payment practices for gig workers. The bureau says Walmart was opening direct deposit accounts using Spark delivery drivers' social security numbers without their consent. The accounts also can come with intense fees that, according to the complaint, would add either 2 percent or $2.99 per transaction, whichever is higher. It also says Walmart repeatedly promised to provide drivers with same-day payments through the platform starting in July 2021 but never delivered on that.

The Bureau alleges that for approximately two years starting around June 2021, defendants engaged in unfair, abusive, and deceptive practices in violation of the Consumer Financial Protection Act of 2010, including by requiring Spark Drivers to receive their compensation in Branch Accounts, opening Branch Accounts for Spark Drivers without their informed consent or, in many instances, on an unauthorized basis, and making deceptive statements about Branch to Spark Drivers. Spark delivery workers have been complaining about Walmart's Branch Messenger account requirements for years, which forced workers to use these accounts with no option to direct deposit to a preferred credit union or local bank. Walmart allegedly told workers they'd be terminated if they didn't accept the Branch accounts.

The Biden administration has launched a Section 301 investigation into China's semiconductor industry, citing concerns over non-market practices, supply chain dependencies, and national security risks. The Hill reports: In a fact sheet, the White House said China "routinely engages in non-market policies and practices, as well as industrial targeting, of the semiconductor industry" that harms competition and creates "dangerous supply chain dependencies."

The Biden administration said the Office of the United States Trade Representative would launch a Section 301 investigation to examine China's targeting of semiconductor chips for dominance, an effort to see whether the practices are unfairly hurting U.S. trade and take potential action. The investigation will broadly probe Chinese nonmarket practices and policies related to semiconductors and look at how the products are incorporated into industries for defense, auto, aerospace, medical, telecommunications and power. It will also examine production of silicon carbide substrates or other wafers used as inputs for semiconductors. The probe launches four weeks before President-elect Donald Trump takes office. "The effort could offer Trump a ready avenue to begin imposing some of the hefty 60% tariffs he has threatened on Chinese imports," notes Reuters.

"Departing President Joe Biden has already imposed a 50% U.S. tariff on Chinese semiconductors that starts on Jan. 1. His administration also has tightened export curbs on advanced artificial intelligence and memory chips and chipmaking equipment."

The Linux Foundation partnered with GitHub and Harvard's Laboratory for Innovation Science to research organization-driven investments in open source software — the how and the why — surveying over 500 organizations around the world.

So what are the highlights from the published report? The median responding organization invests $520,600 (2023 USD) of annual value to OSS.

Responding organizations annually invest $1.7 billion in open source, which can be extrapolated to estimate that approximately $7.7 billion is invested across the entire open source ecosystem annually. 86% of investment is in the form of contribution labor by employees and contractors working for the funding organization, with the remaining 14% being direct financial contributions.
But the ultimate goal of the research was ideas "to improve monitoring and investing in open source" (to "create a more sustainable and impactful open source economy...") In this research, we discovered a few key obstacles that make this kind of data capture challenging... [O]rganizations have blind spots when it comes to the specifics of their contributions. Many respondents knew where they contribute, but only a portion of those could answer how many labor hours went into their OSS contributions or the percentage of budget that went to OSS. Second, the decentralized nature of organizational contributions, without explicit policies or centralized groups that encourage and organize this effort, make reporting even more challenging...

[W]e recommend that policies and practices are put in place to encourage employees to self-report their contributions, and do so using their employee email addresses to leave fingerprints on their work. We also suggest that open source work is consolidated under a single banner, such as an Open Source Program Office (OSPO). Finally, we suggest incorporating contribution monitoring into the organization's pipeline. We developed a toolkit to help improve data capture and monitoring.

An anonymous reader quotes a report from Gizmodo: Hackers aligned with the Chinese government have infiltrated U.S. telecommunications infrastructure so deeply that it allowed the interception of unencrypted communications on a number of people, according to reports that first emerged in October. The operation, dubbed Salt Typhoon, apparently allowed hackers to listen to phone calls and nab text messages, and the penetration has been so extensive they haven't even been booted from the telecom networks yet. The Cybersecurity and Infrastructure Security Agency (CISA) issued guidance this week on best practices for protecting "highly targeted individuals," which includes a new warning (PDF) about text messages.

"Do not use SMS as a second factor for authentication. SMS messages are not encrypted—a threat actor with access to a telecommunication provider's network who intercepts these messages can read them. SMS MFA is not phishing-resistant and is therefore not strong authentication for accounts of highly targeted individuals," the guidance, which has been posted online, reads. Not every service even allows for multi-factor authentication and sometimes text messages are the only option. But when you have a choice, it's better to use phishing-resistant methods like passkeys or authenticator apps. CISA prefaces its guidance by insisting it's only really speaking about high-value targets. The telecommunications hack mentioned above has been called the "worst hack in our nation's history," according to Sen. Mark Warner (D-VA).

The U.S. government is urging senior government officials and politicians to ditch phone calls and text messages following intrusions at major American telecommunications companies blamed on Chinese hackers. From a report: In written guidance, opens new tab released on Wednesday, the Cybersecurity and Infrastructure Security Agency said "individuals who are in senior government or senior political positions" should "immediately review and apply" a series of best practices around the use of mobile devices.

The first recommendation: "Use only end-to-end encrypted communications." End-to-end encryption -- a data protection technique which aims to make data unreadable by anyone except its sender and its recipient -- is baked into various chat apps, including Meta's WhatsApp, Apple's iMessage, and the privacy-focused app Signal. Neither regular phone calls nor text messages are end-to-end encrypted, which means they can be monitored, either by the telephone companies, law enforcement, or - potentially - hackers who've broken into the phone companies' infrastructure.

An anonymous reader shared this report from The Verge: Waymo's driverless vehicles can detect emergency vehicles, know how to respond to hand signals for traffic cops, and can be disabled manually when something goes wrong, according to an independent review of the company's first responder protocols. As such, the Alphabet company's first responder protocols passed an independent review conducted by Tüv Süd, a German tech inspection company. The firm's assessment found that Waymo's First Responder Program "meets industry standards" for responding to emergency situations, which is in line with the best practices set out in the Society of Automotive Engineers (SAE)...

Waymo is staking out the position that it goes beyond what's required to prove that its vehicles are trustworthy... The company has also publicly released its own guide for first responders who are responding to incidents involving autonomous vehicles. The 32-page document includes a toll free number for getting in touch with remote operators, a visual guide for disabling the vehicle's autonomous mode, and instructions for how to disconnect the high-voltage battery. Waymo also hosts training sessions for police and fire officials in the cities in which it operates. The company says it has trained 15,000 first responders from over 75 agencies.
Gizmodo notes that Waymo's self-driving cars are already live for paying customers in San Francisco, Los Angeles, and Austin, "with deployment in Miami coming soon." But Waymo's self-driving cars still attract some mockery online, reports TechCrunch: A video is circulating on social media showing a Waymo robotaxi going round and round on a roundabout — as if it is stuck in a loop. A Waymo spokesperson told TechCrunch there were no passengers onboard the vehicle in the video and said the company has already addressed the issue by deploying a software update to its fleet.

An anonymous reader shared this report from the SF Standard: San Francisco police found Open AI whistleblower Suchir Balaji, 26, dead in his Lower Haight apartment November 26, SiliconValley.com reported on Friday. Police said there is "no evidence of foul play. "The manner of death has been determined to be suicide," David Serrano Sewell, director of the office of the city's chief medical examiner, told The Standard by email.

Balaji, a former researcher for the company, accused OpenAI of using copyrighted material to train ChatGPT shortly after he quit the company in August. The New York Times profiled Balaji in a story focused on his whistleblowing in October. Multiple lawsuits against Open AI are expected to present information Balaji unearthed as key evidence.
More details from TechCrunch: After nearly four years working at OpenAI, Balaji quit the company when he realized the technology would bring more harm than good to society, he told The New York Times. Balaji's main concern was the way OpenAI allegedly used copyright data, and he believed its practices were damaging to the internet.

"We are devastated to learn of this incredibly sad news today and our hearts go out to Suchir's loved ones during this difficult time," said an OpenAI spokesperson in an email to TechCrunch...

On November 25, one day before police found Balaji's body, a court filing named the former OpenAI employee in a copyright lawsuit brought against the startup. As part of a good faith compromise, OpenAI agreed to search Balaji's custodial file related to the copyright concerns he had recently raised.

An anonymous reader shares a report: BeReal, the in the moment social media platform, is far from its 2022 heyday, but that hasn't stopped one organization from going after it. Austrian advocacy group Noyb has filed a complaint surrounding the platform's data consent banner practices. The organization claims that the banner disappears if users accept that their personal data can inform advertising practices, but if they click reject then the banner appears daily.

Noyb filed its complaint with the French data protection authority (CNIL) as Voodoo, a French company, bought BeReal in June -- the practice in question started in July. "BeReal's daily attempt to pressure its users into accepting the tracking for personalised advertising has a significant impact on user behaviour. Consent given under these circumstances is not freely given, which means it doesn't meet the requirements established in Article 4(11) GDPR," Noyb argued in its complaint. It asked the CNIL to fine BeReal and force it to be compliant.

An anonymous reader shares a report: Google recently asked the U.S. government to break up Microsoft's exclusive agreement to host OpenAI's technology on its cloud servers, according to a person who has been directly involved in the effort. The conversation took place after the Federal Trade Commission, one of the primary federal antitrust enforcement agencies, asked Google about Microsoft's business practices as part of a broader investigation, this person said.

Firms that compete with Microsoft in renting out cloud servers, including Google and Amazon, want to host OpenAI's artificial intelligence themselves so their cloud customers don't need to also tap Microsoft servers to get access to the startup's technology, this person said.

The head of America's FCC "has drafted plans to regulate the cybersecurity of telecommunications companies," reports the Washington Post, and the plans could include financial penalties phone network operators with insufficient security — "the first time the agency has asserted such powers under federal wiretapping law." Rosenworcel said the FCC's authority in this matter comes from Section 105 of the Communications Assistance for Law Enforcement Act [passed in 1994] — a single sentence that stipulates, without elaboration, that telecommunications carriers should ensure systems security "in accordance with regulations prescribed by the Commission." As one of the measures, she is seeking to require network providers to submit an annual certification to the FCC that they are implementing a cybersecurity risk management plan. In addition to imposing fines, the FCC could coordinate with other agencies to pursue criminal penalties against carriers deemed too careless on cybersecurity...

Biden administration officials said voluntary efforts to protect against aggressive Chinese hacking activity have fallen short. "We've had for the last decade voluntary public-private partnership efforts," Neuberger told The Post in a recent interview. "But we continue to see successful breaches, and in many cases, as with ransomware attacks, we continue to see pretty basic cybersecurity practices not being followed." With China's hackers becoming more brazen, pre-positioning themselves in U.S. critical networks, "we need to lock our digital doors," Neuberger said...

Cyber requirements can make a difference, she said. After the Colonial Pipeline ransomware attack in 2021 shut down one of the nation's largest energy pipelines for several days, creating a national security scare, the Transportation Security Administration issued several security directives, and today, all of the country's several dozen critical pipeline companies are in compliance, she said. Similar directives were subsequently issued for rail and aviation sectors, and the compliance rates in those industries are now at 68 and 57 percent respectively, she said.