The Almighty Buck

DoorDash Paying Drivers $17 Million For Stolen Tips (gizmodo.com) 52

An anonymous reader quotes a report from Gizmodo: As part of a settlement announced by the state of New York's Attorney General, Letitia James, DoorDash has agreed to pay $16.75 million to more than 60,000 Dashers who were supposed to receive that money in the form of tips but instead, the company used it to cover base pay and pocketed the rest. New York's lawsuit alleged that between May 2017 and September 2019, tens of thousands of Dashers were misled by DoorDash's pay model. At the time, the company offered a guaranteed wage to drivers -- the minimum amount that they could expect to make from a job. But instead of paying that guarantee and letting drivers keep their tips, DoorDash counted the tip toward their base pay and kept what was left. [...]

Per the AG's lawsuit, DoorDash showed a message to customers that said "Dashers will always receive 100 percent of the tip" -- a statement that is technically true but does not clarify that "tip" is actually the delivery drivers' wage. New York argued that disclosures explaining how tips worked were buried in online documents and "customers had no way of knowing that DoorDash was using tips to reduce its own costs." DoorDash did eventually change its payment model to ensure "earnings will increase by the exact amount a customer tips on every order," but New York's case represents drivers finally getting those tips they earned during the period when the company was less transparent about who was actually pocketing that extra cash. Dashers eligible for the settlement will be contacted by the settlement administrator so they can get their piece of the pie that was rightfully theirs in the first place.

Power

Is the AI Boom Leading to More Natural Gas-Powered Utilities? (msn.com) 41

New power plants burning natural gas are being built all across America, reports the Washington Post, calling it a gas boom "driven in large part by AI."

They blame tech companies like Microsoft and Meta — which "looked to gas amid a shortage of adequate new clean energy" — while noting that those companies "say they plan to offset their development of natural gas capacity with equal investments in clean energy like solar and wind." [E]ven coal is making a comeback. But the biggest push is for gas, with more than 220 plants in various stages of development nationwide. They are often pitched as a bridge until more clean power is available, sometimes with promises the plants will eventually be equipped with nascent technology that traps greenhouse gas emissions. But the timeline for installing such "carbon capture" is vague. "These companies are building these massive new gas plants that are going to be there for 30 to 50 years," said Bill Weihl, a former director of sustainability at Facebook and founder of the nonprofit ClimateVoice. "That's not a bridge. It is a giant bomb in our carbon budget...."

Public filings from some of the big tech companies driving this development show their greenhouse gas emissions are soaring... "The last few years have revealed that a global energy transition is more complex and less linear than anticipated," Microsoft's board wrote in urging rejection of a December shareholder resolution demanding the company confront the climate risks of AI. "While urgency builds for decarbonization, so does the demand for energy."

Shareholders rejected the resolution. Microsoft is battling with environmental groups over its plans to build a multibillion-dollar data center in Mount Pleasant, Wisconsin, powered with electricity from natural gas. Their petition warns Microsoft's project "will push our state's climate goals out of reach, locking us into 30 more years of fossil fuels." The company said in a statement that it remains committed to erasing its emissions by adding substantial clean power to regional power grids. "By the end of 2025 we expect to meet our goal of adding new sources of carbon-free electricity to the grid equal to 100 percent of the electricity used by our datacenters," the statement said.

Meta says it is doing the same in Louisiana [where it's building a new 4-million-square-foot data center] and is "committed to matching our electricity use with 100 percent clean and renewable energy."

The article includes two revealing quotes:
  • "It is like everyone just gave up," said Aaron Zubaty, CEO of Eolian, a large clean energy developer that works with data centers.
  • American Petroleum Institute President Mike Sommers (who represents the oil and gas industry in Washington), said "The words that have replaced 'energy transition' are 'AI' and 'data centers'. We're transitioning from the energy transition to the energy reality ... We're going to need a lot more oil and gas."

Businesses

OpenAI Plans To Shift Compute Needs From Microsoft To SoftBank (techcrunch.com) 9

According to The Information (paywalled), OpenAI plans to shift most of its computing power from Microsoft to SoftBank-backed Stargate by 2030. TechCrunch reports: That represents a major shift away from Microsoft, OpenAI's biggest shareholder, who fulfills most of the startup's power needs today. The change won't happen overnight. OpenAI still plans to increase its spending on Microsoft-owned data centers in the next few years.

During that time, OpenAI's overall costs are set to grow dramatically. The Information reports that OpenAI projects to burn $20 billion in cash during 2027, far more than the $5 billion it reportedly burned through in 2024. By 2030, OpenAI reportedly forecasts that its costs around running AI models, also known as inference, will outpace what the startup spends on training AI models.

Businesses

Will Amazon's Return-to-Office Mandate Revitalize Downtown Seattle? (seattlemag.com) 73

"Amazon required employees to work from the office five days a week starting January 2nd," writes the Seattle Times, "a change from the company's three-day in-office mandate that had been in effect since May 2023."

And as Seattle's largest employer (with 50,000 Seattle-based workers), this had an impact, according to data the Times cites from the nonprofit Downtown Seattle Association: In January, downtown Seattle recorded the second-highest daily average for weekday worker foot traffic since March 2020. It also saw 2 million unique visitors on its sidewalks last month. That represents 94% of the visitors downtown Seattle saw in January 2019, the Downtown Seattle Association found...

In a statement Friday, Amazon said "we're excited by the innovation, collaboration and connection we've seen already with our teams working in person together...." Jon Scholes [the president of the Downtown Seattle Association] said Amazon's return has been a boon for downtown Seattle. As the city's largest employer, its mandate instantly brought more people to shop and dine around South Lake Union, the Denny Triangle and surrounding neighborhoods... "I think we're seeing people get reacquainted with the reasons they liked working downtown prepandemic," Scholes said. He expects to continue seeing an uptick in foot traffic over the course of the year as more companies follow Amazon's lead and the weather warms up.

But Seattle magazine says the statistics show foot traffic in neighborhoods where Amazon's offices are located (South Lake Union and Denny Regrade) "at 74% of that of January 2019. Overall, downtown-area foot traffic was 9% higher than it was a year ago, though only 57% of the pre-pandemic average."
Printer

How 3D-Printed Parts Changed the NASCAR Cup Series (popsci.com) 40

Longtime Slashdot reader schwit1 shares a report from Popular Science: In 2021, NASCAR unveiled its Next Gen platform that included a number of rule changes from the previous iteration. Now fully symmetrical and using composite body panels instead of metal, the latest NASCAR vehicles are more like the street versions of the Chevrolet Camaro, the Ford Mustang, and the Toyota TRD Camry. Race car driving isn't an inexpensive sport, and one of the goals for the Next Gen platform was to reduce operating costs and create parity across the board. Technique Chassis, the sole chassis manufacturer for the NASCAR Cup Series, builds a modular offering in three parts. As a result, everyone is starting with the same platform, and finding a competitive advantage is in the tiniest details. One smart way to differentiate from the competition is 3D-printed parts. But this isn't your hobbyist level 3D printing.

Minnesota-based Stratasys specializes in "additive manufacturing," the process of creating an object by building it one layer at a time. Stratasys Senior Global Director of Automotive & Mobility Fadi Abro explains that this term is synonymous with 3D printing. However, the industry often reserves that description for hobby-level projects on smaller, non-industrial printers, while additive manufacturing represents robust industrial solutions. Additive manufacturing is the exact inverse of subtractive manufacturing, which requires cutting away at a solid chunk of material to achieve a final product. In art terms, additive manufacturing would be like sculpting with modeling clay while subtractive is akin to carving a shape from a block of marble. As it relates to NASCAR, Stratasys provides parts like ducts, covers, brackets, and tubing. Together with the racing organization, Stratasys reviews the current driver needs and makes recommendations for other parts and modifications. [...]

The kind of printers Stratasys builds aren't the type you buy at your local electronics store, either. Each industrial-grade 3D printer costs anywhere from $20,000 to $600,000. Using this kind of equipment isn't without precedent, and builds at SEMA's annual extravaganza feature 3D parts we wouldn't have dreamed of a few years ago. [...] In the past few months, Stratasys has been on a roll, signing an extension to its 20-year partnership with the Joe Gibbs Racing team and earning the title of "Official 3D Printing Partner of NASCAR." Competition for this market continues to heat up, however, as there are startups and legacy companies pushing hard. Around the world, 3D printing companies abound. Stratasys has one major factor on its side: 35 years of experience. What's new is that today's printing is more accurate, it's faster, the materials are more robust, Abro says.
"I think what's changed drastically over the past five to seven years has been all about material development," Abro explains. "We're seeing materials that are just incredible, whether it's how resistant to heat they are or how strong they are compared to how much they weigh."

"It's better, faster, cheaper. It's faster to print something than to mill it, and then it's certainly cheaper in a multitude of different ways. Number one, there's not as much skill required for 3D printing as there is in CNC machining; you need a more traditional manufacturing method."
Programming

What Do Linux Kernel Developers Think of Rust? (thenewstack.io) 42

Keynotes at this year's FOSDEM included free AI models and systemd, reports Heise.de — and also a progress report from Miguel Ojeda, supervisor of the Rust integration in the Linux kernel. Only eight people remain in the core team around Rust for Linux... Miguel Ojeda therefore launched a survey among kernel developers, including those outside the Rust community, and presented some of the more important voices in his FOSDEM talk. The overall mood towards Rust remains favorable, especially as Linus Torvalds and Greg Kroah-Hartman are convinced of the necessity of Rust integration. This is less about rapid progress and more about finding new talent for kernel development in the future.
The reaction was mostly positive, judging by Ojeda's slides:

- "2025 will be the year of Rust GPU drivers..." — Daniel Almedia

- "I think the introduction of Rust in the kernel is one of the most exciting development experiments we've seen in a long time." — Andrea Righi

- "[T]he project faces unique challenges. Rust's biggest weakness, as a language, is that relatively few people speak it. Indeed, Rust is not a language for beginners, and systems-level development complicates things even more. That said, the Linux kernel project has historically attracted developers who love challenging software — if there's an open source group willing to put the extra effort for a better OS, it's the kernel devs." — Carlos Bilbao

- "I played a little with [Rust] in user space, and I just absolutely hate the cargo concept... I hate having to pull down other code that I do not trust. At least with shared libraries, I can trust a third party to have done the build and all that... [While Rust should continue to grow in the kernel], if a subset of C becomes as safe as Rust, it may make Rust obsolete..." Steven Rostedt

Rostedt wasn't sure if Rust would attract more kernel contributors, but did venture this opinion. "I feel Rust is more of a language that younger developers want to learn, and C is their dad's language."

But still "contention exists within the kernel development community between those pro-Rust and -C camps," argues The New Stack, citing the latest remarks from kernel maintainer Christoph Hellwig (who had earlier likened the mixing of Rust and C to cancer). Three days later Hellwig reiterated his position again on the Linux kernel mailing list: "Every additional bit that another language creeps in drastically reduces the maintainability of the kernel as an integrated project. The only reason Linux managed to survive so long is by not having internal boundaries, and adding another language completely breaks this. You might not like my answer, but I will do everything I can do to stop this. This is NOT because I hate Rust. While not my favourite language it's definitively one of the best new ones and I encourage people to use it for new projects where it fits. I do not want it anywhere near a huge C code base that I need to maintain."
But the article also notes that Google "has been a staunch supporter of adding Rust to the kernel for Linux running in its Android phones." The use of Rust in the kernel is seen as a way to avoid memory vulnerabilities associated with C and C++ code and to add more stability to the Android OS. "Google's wanting to replace C code with Rust represents a small piece of the kernel but it would have a huge impact since we are talking about billions of phones," Ojeda told me after his talk.

In addition to Google, Rust adoption and enthusiasm for it is increasing as Rust gets more architectural support and as "maintainers become more comfortable with it," Ojeda told me. "Maintainers have already told me that if they could, then they would start writing Rust now," Ojeda said. "If they could drop C, they would do it...."

Amid the controversy, there has been a steady stream of vocal support for Ojeda. Much of his discussion also covered statements given by advocates for Rust in the kernel, ranging from lead developers of the kernel and including Linux creator Linus Torvalds himself to technology leads from Red Hat, Samsung, Google, Microsoft and others.

Government

Bill Banning Social Media For Youngsters Advances (politico.com) 86

The Senate Commerce Committee approved the Kids Off Social Media Act, banning children under 13 from social media and requiring federally funded schools to restrict access on networks and devices. Politico reports: The panel approved the Kids Off Social Media Act -- sponsored by the panel's chair, Texas Republican Ted Cruz, and a senior Democrat on the panel, Hawaii's Brian Schatz -- by voice vote, clearing the way for consideration by the full Senate. Only Ed Markey (D-Mass.) asked to be recorded as a no on the bill. "When you've got Ted Cruz and myself in agreement on something, you've pretty much captured the ideological spectrum of the whole Congress," Sen. Schatz told POLITICO's Gabby Miller.

[...] "KOSMA comes from very good intentions of lawmakers, and establishing national screen time standards for schools is sensible. However, the bill's in-effect requirements on access to protected information jeopardize all Americans' digital privacy and endanger free speech online," said Amy Bos, NetChoice director of state and federal affairs. The trade association represents big tech firms including Meta and Google. Netchoice has been aggressive in combating social media legislation by arguing that these laws illegally restrict -- and in some cases compel -- speech. [...] A Commerce Committee aide told POLITICO that because social media platforms already voluntarily require users to be at least 13 years old, the bill does not restrict speech currently available to kids.

Businesses

OpenAI Considering 16 States For Data Center Campuses (cnbc.com) 16

OpenAI is considering building large-scale data center campuses in 16 states as part of the Stargate initiative, a $100 billion joint venture with Oracle and SoftBank aimed at strengthening U.S. AI infrastructure. CNBC reports: On a call with reporters, OpenAI executives said it sent out a request for proposals (RFP) to states less than a week ago. "A project of this size represents an opportunity to both re-industrialize parts of the country, but also to help revitalize where the American Dream is going to go in this intelligence age," Chris Lehane, OpenAI's vice president of global policy, said on the call.

[...] The 16 states OpenAI is currently considering are Arizona, California, Florida, Louisiana, Maryland, Nevada, New York, Ohio, Oregon, Pennsylvania, Utah, Texas, Virginia, Washington, Wisconsin and West Virginia. Construction on the data centers in Abilene, Texas, is currently underway. In the coming months, OpenAI will begin announcing additional construction sites "on a rolling basis," according to the presentation. Each campus is designed to support about one gigawatt of power or more.

OpenAI is aiming to build five to 10 data center campuses total, although executives said that number could rise or fall depending on how much power each campus offers. The company also said it expects each data center campus to generate thousands of jobs. That includes construction and operational roles. But Stargate's first data center in Abilene could lead to the creation of just 57 jobs, according to recent reports.

Movies

Warner Bros. Releases Dozens of Old Films for Free on YouTube, Bypassing Paid Streaming 62

Warner Bros. Discovery has quietly begun releasing dozens of its older films for free on YouTube, marking an unexpected shift in how the major studio handles its back catalog. Over the past month, the company has uploaded more than 30 full-length movies across five YouTube channels, without digital rights management or regional restrictions.

The collection includes both critically acclaimed films like "Waiting for Guffman" and "Michael Collins," as well as commercial disappointments like the 2002 Eddie Murphy film "The Adventures of Pluto Nash." Some releases have significant historical value, such as "Oh, God!" - a 1977 George Burns comedy that earned $51 million at release (equivalent to $265 million in 2024). This move represents a departure from traditional studio practices of protecting content through strict digital rights management and paid streaming services. Warner Bros. owns multiple distribution channels, including the Max streaming service and Turner Classic Movies, which makes the decision to release these films freely on YouTube particularly notable.
Moon

Grand Canyon-Sized Valleys On the Moon Formed Within 10 Minutes (space.com) 25

A new study reveals that two Grand Canyon-sized valleys were formed in less than 10 minutes by "floods of rocks traveling as fast as bullets," reports Space.com. From the report: Scientists analyzed the lunar canyons, named Vallis Schrodinger and Vallis Planck, to find that these huge valleys measure 167 miles long (270 kilometers) and nearly 1.7 miles (2.7 km) deep, and 174 miles long (280 km) and nearly 2.2 miles deep (3.5 km), respectively. In comparison, the Grand Canyon is 277 miles long (446 km) and is, at most, about 1.2 miles deep (1.9 km), the researchers noted. [...] This pair of lunar canyons represents two of many valleys radiating out from Schrodinger basin, a crater about 200 miles wide (320 km) that was blasted out of the lunar crust by a cosmic impact about 3.81 billion years ago. This structure is located in the outer margin of the moon's largest and oldest remaining impact crater, the South Pole-Aitken basin, which measures about 1,490 miles wide (2,400 km) and dates about 4.2 billion to 4.3 billion years old.

[...] The scientists estimate that rocky debris flew out from the impact at speeds between 2,125 to 2,860 miles per hour (3,420 to 4,600 km/h). In comparison, a bullet from a 9mm Luger handgun might fly at speeds of about 1,360 mph (2,200 km/h). The researchers suggest the energy needed to create both of these canyons would have been more than 130 times the energy in the current global inventory of nuclear weapons. "The lunar canyons we describe are produced by streams of rock, whereas the Grand Canyon was produced by a river of water," [said David Kring, a geologist at the Lunar and Planetary Institute of the Universities Space Research Association]. "The streams of rock were far more energetic than the river of water, which is why the lunar canyons were produced in minutes and the Grand Canyon produced over millions of years."
The findings have been published in the journal Nature.
AI

Taiwan Says Government Departments Should Not Use DeepSeek, Citing Security Concerns (reuters.com) 37

An anonymous reader shares a report: Taiwan's digital ministry said on Friday that government departments should not use Chinese startup DeepSeek's artificial intelligence (AI) service, saying that as the product is from China it represents a security concern.

Democratically-governed Taiwan has long been wary of Chinese tech given Beijing's sovereignty claims over the island and its military and political threats against the government in Taipei. In a statement, Taiwan's Ministry of Digital Affairs said that government departments are not allowed to use DeepSeek's AI service to "prevent information security risks".

"DeepSeek's AI service is a Chinese product, and its operation involves cross-border transmission and information leakage and other information security concerns, and is a product that jeopardises the country's information security," the ministry said.

Businesses

2025 Will Likely Be Another Brutal Year of Failed Startups, Data Suggests (techcrunch.com) 28

An anonymous reader quotes a report from TechCrunch: TechCrunch gathered data from several sources and found similar trends. In 2024, 966 startups shut down, compared to 769 in 2023, according to Carta. That's a 25.6% increase. One note on methodology: Those numbers are for U.S.-based companies that were Carta customers and left Carta due to bankruptcy or dissolution. There are likely other shutdowns that wouldn't be accounted for through Carta, estimates Peter Walker, Carta's head of insights. [...] Meanwhile, AngelList found that 2024 saw 364 startup winddowns, compared to 233 in 2023. That's a 56.2% jump. However, AngelList CEO Avlok Kohli has a fairly optimistic take, noting that winddowns "are still very low relative to the number of companies that were funded across both years."

Layoffs.fyi found a contradicting trend: 85 tech companies shut down in 2024, compared to 109 in 2023 and 58 in 2022. But as founder Roger Lee acknowledges, that data only includes publicly reported shutdowns "and therefore represents an underestimate." Of those 2024 tech shutdowns, 81% were startups, while the rest were either public companies or previously acquired companies that were later shut down by their parent organizations. So many companies got funded in 2020 and 2021 at heated valuations with famously thin diligence, that it's only logical that up to three years later, an increasing number couldn't raise more cash to fund their operations. Taking investment at too high of a valuation increases the risk such that investors won't want to invest more unless business is growing extremely well. [...]

Looking ahead, Walker also expects we'll continue to see more shutdowns in the first half of 2025, and then a gradual decline for the rest of the year. That projection is based mostly on a time-lag estimate from the peak of funding, which he estimates was the first quarter of 2022 in most stages. So by the first quarter of 2025, "most companies will have either found a new path forward or had to make this difficult choice."
"Tech zombies and a startup graveyard will continue to make headlines," said Dori Yona, CEO and co-founder of SimpleClosure. "Despite the crop of new investments, there are a lot of companies that have raised at high valuations and without enough revenue."
Security

FBI: North Korean IT Workers Steal Source Code To Extort Employers (bleepingcomputer.com) 27

The FBI warned this week that North Korean IT workers are abusing their access to steal source code and extort U.S. companies that have been tricked into hiring them. From a report: The security service alerted public and private sector organizations in the United States and worldwide that North Korea's IT army will facilitate cyber-criminal activities and demand ransoms not to leak online exfiltrated sensitive data stolen from their employers' networks. "North Korean IT workers have copied company code repositories, such as GitHub, to their own user profiles and personal cloud accounts. While not uncommon among software developers, this activity represents a large-scale risk of theft of company code," the FBI said.

"North Korean IT workers could attempt to harvest sensitive company credentials and session cookies to initiate work sessions from non-company devices and for further compromise opportunities." To mitigate these risks, the FBI advised companies to apply the principle of least privilege by disabling local administrator accounts and limiting permissions for remote desktop applications. Organizations should also monitor for unusual network traffic, especially remote connections since North Korean IT personnel often log into the same account from various IP addresses over a short period of time.

The Courts

FDIC Sues 17 Former Silicon Valley Bank Execs Over Collapse (cnn.com) 31

"The FDIC sued 17 former executives and directors of Silicon Valley Bank on Thursday, seeking to recover billions of dollars for alleged gross negligence and breaches of fiduciary duty," reports Reuters. The move comes almost two years after Silicon Valley Bank's March 2023 collapse, which shocked financial markets and ended up benefiting big players like JPMorgan Chase. From the report: In a complaint filed in San Francisco federal court, the FDIC, in its capacity the bank's receiver, said the defendants ignored fundamental standards of prudent banking and the bank's own risk policies in letting the bank take on excessive risks to boost short-term profit and its stock price. The FDIC faulted the bank's overreliance on unhedged, interest rate-sensitive long-term government bonds such as US Treasuries and mortgage-backed securities, as rates looked set to -- and eventually did -- rise. It also objected to the payment of a "grossly imprudent" $294 million dividend to its parent that drained needed capital "at a time of financial distress and management weakness" in December 2022, less than three months before its demise.

"SVB represents a case of egregious mismanagement of interest-rate and liquidity risks by the bank's former officers and directors," the complaint said. The defendants include former Chief Executive Gregory Becker, former Chief Financial Officer Daniel Beck, four other former executives and 11 former directors.

United States

US Employee Engagement Sinks To 10-Year Low (gallup.com) 223

Employee engagement in the U.S. fell to its lowest level in a decade in 2024, Gallup reported Tuesday, with only 31% of employees engaged. This matches the figure last seen in 2014. The percentage of actively disengaged employees, at 17%, also reflects 2014 levels. Gallup: The percentage of engaged employees has declined by two percentage points since 2023, highlighting a growing trend of employee detachment from organizations, particularly among workers younger than 35.

These are among the findings of Gallup's most recent annual update of U.S. employee engagement. Though engagement increased slightly midyear, it declined through the rest of 2024, finishing the year at its decade low. In Gallup's trend dating back to 2000, employee engagement peaked in 2020, at 36%, following a decade of steady growth, but it has generally trended downward since then.

Each point change in engagement represents approximately 1.6 million full- or part-time employees in the U.S. The declines since 2020 equate to about 8 million fewer engaged employees, including 3.2 million fewer compared to 2023. Among the 12 engagement elements that Gallup measures, those that saw the most significant declines in 2024 (by three points or more in "strongly agree" ratings) include:
Clarity of expectations. Just 46% of employees clearly know what is expected of them at work, down 10 points from a high of 56% in March 2020.
Feeling someone at work cares about them as a person. Currently, 39% of employees feel strongly that someone cares about them, a drop from 47% in March 2020.
Someone encouraging their development. Only 30% strongly agree that someone at work encourages their development, down from 36% in March 2020.

People of all ages come to work seeking role clarity, strong relationships and opportunities for development, but managers, combined, are progressively failing to meet these basic needs. However, managers themselves are faring no better than those they manage, with only 31% engaged.

Encryption

Ransomware Crew Abuses AWS Native Encryption, Sets Data-Destruct Timer for 7 Days (theregister.com) 18

A new ransomware group called Codefinger targets AWS S3 buckets by exploiting compromised or publicly exposed AWS keys to encrypt victims' data using AWS's own SSE-C encryption, rendering it inaccessible without the attacker-generated AES-256 keys. While other security researchers have documented techniques for encrypting S3 buckets, "this is the first instance we know of leveraging AWS's native secure encryption infrastructure via SSE-C in the wild," Tim West, VP of services with the Halcyon RISE Team, told The Register. "Historically AWS Identity IAM keys are leaked and used for data theft but if this approach gains widespread adoption, it could represent a significant systemic risk to organizations relying on AWS S3 for the storage of critical data," he warned. From the report: ... in addition to encrypting the data, Codefinder marks the compromised files for deletion within seven days using the S3 Object Lifecycle Management API â" the criminals themselves do not threaten to leak or sell the data, we're told. "This is unique in that most ransomware operators and affiliate attackers do not engage in straight up data destruction as part of a double extortion scheme or to otherwise put pressure on the victim to pay the ransom demand," West said. "Data destruction represents an additional risk to targeted organizations."

Codefinger also leaves a ransom note in each affected directory that includes the attacker's Bitcoin address and a client ID associated with the encrypted data. "The note warns that changes to account permissions or files will end negotiations," the Halcyon researchers said in a report about S3 bucket attacks shared with The Register. While West declined to name or provide any additional details about the two Codefinger victims -- including if they paid the ransom demands -- he suggests that AWS customers restrict the use of SSE-C.

"This can be achieved by leveraging the Condition element in IAM policies to prevent unauthorized applications of SSE-C on S3 buckets, ensuring that only approved data and users can utilize this feature," he explained. Plus, it's important to monitor and regularly audit AWS keys, as these make very attractive targets for all types of criminals looking to break into companies' cloud environments and steal data. "Permissions should be reviewed frequently to confirm they align with the principle of least privilege, while unused keys should be disabled, and active ones rotated regularly to minimize exposure," West said.
An AWS spokesperson said it notifies affected customers of exposed keys and "quickly takes any necessary actions, such as applying quarantine policies to minimize risks for customers without disrupting their IT environment."

They also directed users to this post about what to do upon noticing unauthorized activity.
Earth

California's Wildfires Still Burn. Prison Inmates Join the Fight (npr.org) 101

As an ecological disaster devastated two coastal California cities, more than 7,500 firefighters pushed back against the wildfires. 900 of them are inmates, reports NPR. That's about 12%: California is one of more than a dozen states that operates conservation camps, commonly known as fire camps, for incarcerated people to train to fight fires and respond to other disasters... There are now 35 such camps in California, all of which are minimum-security facilities... When they are not fighting fires, they also respond to floods and other disasters and emergencies. Otherwise, the crews do community service work in areas close to their camp, according to the state corrections department...

A 2018 Time investigation found that incarcerated firefighters are at a higher risk for serious injuries. They also are more than four times as likely to get cuts, bruises or broken bones compared to professional firefighters working the same fires, the report found. They were also more than eight times as likely to face injuries after inhaling smoke, ash and other debris compared with other firefighters, the report said.

"Two of the camps are for incarcerated women," reports the BBC. One of them — since released — remembers that "It felt like you were doing something that mattered instead of rotting away in a cell," according to the nonprofit new site CalMatters. They can also earn credits that help reduce their prison sentences, the BBC learned from the California Department of Corrections and Rehabilitation.

Friday one local California news report shared the perspective of formerly incarcerated Californian, Matthew Hahn (from a 2021 Washington Post column). "Yes, the decision to take part is largely made under duress, given the alternative. Yes, incarcerated firefighters are paid pennies for an invaluable task. And yes, it is difficult though not impossible for participants to become firefighters after leaving prison," Hahn said. "Despite this, fire camps remain the most humane places to do time in the California prison system."
From that 2021 Washington Post column: California prisons have, on average, three times the murder rate of the country overall and twice the rate of all American prisons. These figures don't take into account the sheer number of physical assaults that occur behind prison walls. Prison feels like a dangerous place because it is. Whether it's individual assaults or large-scale riots, the potential for violence is ever-present. Fire camp represents a reprieve from that risk. Sure, people can die in fire camp as well — at least three convict-firefighters have died working to contain fires in California since 2017 — but the threat doesn't weigh on the mind like the prospect of being murdered by a fellow prisoner. I will never forget the relief I felt the day I set foot in a fire camp in Los Angeles County, like an enormous burden had been lifted...

[When his 12-man crew was called to fight the Jesusita Fire], the fire had ignited one home's deck and was slowly burning its way to the structure. We cut the deck off the house, saving the home. I often fantasize about the owners returning to see it still standing, unaware and probably unconcerned that an incarcerated fire crew had saved it. There was satisfaction in knowing that our work was as valuable as that of any other firefighter working the blaze and that the gratitude expressed toward first responders included us.

There are other reasons for prisoners to choose fire camp if given the opportunity. They are often located in secluded natural settings, giving inmates the chance to live in an environment that doesn't remotely resemble a prison. There are no walls, and sometimes there aren't even fences. Gun towers are conspicuously absent, and the guards aren't even armed.... [C]onsider the guy pushing a broom in his cell block making the equivalent of one Top Ramen noodle packet per day, just so he can have the privilege of making a collect call to his mother. Or think of the man scrubbing the streaks out of the guards' toilets, making seven cents an hour, half of which goes to pay court fees and restitution, just so he can have those couple of hours outside his cage for the day...

So, while we may have faced the heat of a wildfire for a few bucks a day, and we may have saved a few homes and been happy doing so, understand that we were rational actors. We wanted to be there, where some of our dignity was returned to us.

Google

Google Wants to Track Your Digital Fingerprints Again (mashable.com) 54

Google is reintroducing "digital fingerprinting" in five weeks, reports Mashable, describing it as "a data collection process that ingests all of your online signals (from IP address to complex browser information) and pinpoints unique users or devices." Or, to put it another way, Google "is tracking your online behavior in the name of advertising."

The UK's Information Commissioner's Office called Google's decision "irresponsible": it is likely to reduce people's choice and control over how their information is collected. The change to Google's policy means that fingerprinting could now replace the functions of third-party cookies... Google itself has previously said that fingerprinting does not meet users' expectations for privacy, as users cannot easily consent to it as they would cookies. This in turn means they cannot control how their information is collected. To quote Google's own position on fingerprinting from 2019: "We think this subverts user choice and is wrong...." When the new policy comes into force on 16 February 2025, organisations using Google's advertising technology will be able to deploy fingerprinting without being in breach of Google's own policies. Given Google's position and scale in the online advertising ecosystem, this is significant.
Their post ends with a warning that those hoping to use fingerprinting for advertising "will need to demonstrate how they are complying with the requirements of data protection law. These include providing users with transparency, securing freely-given consent, ensuring fair processing and upholding information rights such as the right to erasure."

But security and privacy researcher Lukasz Olejnik asks if Google's move is the biggest privacy erosion in 10 years.... Could this mark the end of nearly a decade of progress in internet and web privacy? It would be unfortunate if the newly developing AI economy started from a decrease of privacy and data protection standards. Some analysts or observers might then be inclined to wonder whether this approach to privacy online might signal similar attitudes in other future Google products, like AI... The shift is rather drastic. Where clear restrictions once existed, the new policy removes the prohibition (so allows such uses) and now only requires disclosure... [I]f the ICO's claims about Google sharing IP addresses within the adtech ecosystem are accurate, this represents a significant policy shift with critical implications for privacy, trust, and the integrity of previously proposed Privacy Sandbox initiatives.
Their post includes a disturbing thought. "Reversing the stance on fingerprinting could open the door to further data collection, including to crafting dynamic, generative AI-powered ads tailored with huge precision. Indeed, such applications would require new data..."

Thanks to long-time Slashdot reader sinij for sharing the news.
The Almighty Buck

India's Payments Push is Cutting Out Visa and Mastercard (techcrunch.com) 42

India's homegrown digital payments ecosystem, anchored by two systems, is challenging Visa and Mastercard's dominance in the world's most populous nation. The backbone is UPI, a nine-year-old bank-to-bank payment network that processes over 13 billion monthly transactions through QR codes and phone numbers, accounting for 71% of all transactions and 36% of consumer spending, according to Bernstein.

RuPay, India's domestic card network, has leveraged its exclusive right to process credit card transactions through UPI to double its volume to $7.43 billion in fiscal 2025's first seven months. It now represents 28% of credit card transactions, up from 10% last year. Small merchants are adopting the system as RuPay only charges fees on transactions above $23.3. India's central bank has also mandated banks let customers choose their card network, ending exclusive deals with global providers.
China

US Adds Tencent, CATL To List of Chinese Firms Aiding Beijing's Military (reuters.com) 29

An anonymous reader quotes a report from Reuters: The U.S. Defense Department said on Monday it has added Chinese tech giants including gaming and social media leader Tencent Holdings and battery maker CATL to a list of firms it says work with China's military. The list also included chip maker Changxin Memory Technologies, Quectel Wireless and drone maker Autel Robotics, according to a document published on Monday. The annually updated list (PDF) of Chinese military companies, formally mandated under U.S. law as the "Section 1260H list," designated 134 companies, according to a notice posted to the Federal Register.

U.S.-traded shares of Tencent, which is also the parent of Chinese instant messaging app WeChat, fell 8% in over-the-counter trading. Tencent said in a statement that its inclusion on the list was "clearly a mistake." It added: "We are not a military company or supplier. Unlike sanctions or export controls, this listing has no impact on our business." CATL called the designation a mistake, saying it "is not engaged in any military related activities." A Quectel spokesperson said the company "does not work with the military in any country and will ask the Pentagon to reconsider its designation, which clearly has been made in error."

While the designation does not involve immediate bans, it can be a blow to the reputations of affected companies and represents a stark warning to U.S. entities and firms about the risks of conducting business with them. It could also add pressure on the Treasury Department to sanction the companies. Two previously listed companies, drone maker DJI and Lidar-maker Hesai Technologies, both sued the Pentagon last year over their previous designations, but remain on the updated list. The Pentagon also removed six companies it said no longer met the requirements for the designation, including AI firm Beijing Megvii Technology, China Railway Construction Corporation Limited, China State Construction Group Co and China Telecommunications Corporation.

Slashdot Top Deals