Mozilla

Mozilla: YouTube's Dislike Button Largely Fails To Stop Unwanted Recommendations (mozilla.org) 75

AmiMoJo shares a report from the Mozilla Foundation: YouTube's user controls -- buttons like "Dislike " and "Not interested" -- largely fail to help users avoid unwanted recommendations like misinformation and violent content, according to new research by Mozilla. An accompanying survey also found that YouTube's controls routinely frustrate and confuse users. Indeed, Mozilla's research found that people who are experiencing unwanted recommendations and turn to the platform's user controls for assistance prevent less than half of unwanted recommendations.

This is especially troubling because Mozilla's past research shows that YouTube recommends videos that violate its very own community guidelines, like misinformation, violent content, hate speech, and spam. For example, one user in this most recent research asked YouTube to stop recommending war footage from Ukraine -- but shortly after was recommended even more grisly content from the region. The study, titled "Does This Button Work? Investigating YouTube's ineffective user controls" is the culmination of months of rigorous qualitative and quantitative research. The study was made possible by the data of more than 20,000 participants who used Mozilla's RegretsReporter browser extension, and by data about more than 500 million YouTube videos.
These are the top findings, as highlighted in the report: People don't trust YouTube's user controls. More than a third (39.3%) of people surveyed felt YouTube's user controls did not impact their recommendations at all, and 23% felt the controls had a mixed response. Said one interviewee: "Nothing changed. Sometimes I would report things as misleading and spam and the next day it was back in [...] Even when you block certain sources they eventually return."

People take matters into their own hands. Our study found that people did not always understand how YouTube's controls affect their recommendations, and so took a jury rigged approach instead. People will log out, create new accounts, or use privacy tools just to manage their YouTube recommendations. Said one user: "When the Superbowl came around ... if someone recommended a particular commercial, I used to log out of YouTube, watch the commercial, and then log back in."

The data confirms people are right. The most "effective" user control was "Don't recommend channel," but compared to users who do not make use of YouTube's user controls, only 43% of unwanted recommendations are prevented -- and recommendations from the unwanted channel sometimes persist. Other controls were even less effective: The "Not Interested" tool prevented only 11% of unwanted recommendations.

YouTube can fix this problem. YouTube has the power to confront this issue and do a better job at enabling people to control their recommendations. Our research outlines several concrete suggestions to put people back into the driver's seat, like making YouTube's controls more proactive, allowing users to shape their own experience; and giving researchers increased access to YouTube's API and other tools.
Further reading: YouTube Targets TikTok With Revenue Sharing For Shorts, Partner Program Expansion
Youtube

YouTube Targets TikTok With Revenue Sharing For Shorts, Partner Program Expansion (techcrunch.com) 23

Today, YouTube announced major changes to its YouTube Partner Program, allowing creators to earn ad revenue on Shorts, its TikTok competitor. TechCrunch reports: Now, Shorts creators can qualify for the Partner Program, which allows creators to earn ad revenue from YouTube. The existing Partner Program requires YouTubers to have over 1,000 subscribers and 4,000 watch hours in the last year. Now, Shorts creators can join the Partner Program if they have at least 10 million views on the platform over the last 90 days. As members of the Partner Program, these creators will earn 45% of ad revenue from their videos.

"I'm proud to say this is the first time real revenue sharing is being offered for short form video on any platform at scale," said YouTube Chief Product Officer Neal Mohan. He's right. TikTok has started experimenting with ad revenue sharing, but its efforts seem to focus more on the advertiser than the creator, as only the top 4% of all videos on TikTok can be monetized through its TikTok Pulse program. For the most part, creators have found it increasingly difficult to make money from TikTok's Creator Fund. [...]

YouTube Shorts is poised to become TikTok's biggest competitor. If creators can make more money on Shorts than on TikTok, then they're incentivized to make original content for the YouTube platform. YouTube also shared that this update to the Partner Program will enable the platform to license more music for use in Shorts, which could help encourage creators to use Shorts more often. Creators in the program will be compensated the same, regardless of whether they use licensed music. YouTube also unveiled Creator Music, now in beta testing. Creators can browse a large catalog of songs to purchase for use in their content, with the terms of the music rights spelled out in simple terms. They'll also be able to opt for tracks with new revenue-sharing option where both creators and music rights holders earn money from their content.

Communications

FCC Approves Space-Based Texting Service From Lynk (techcrunch.com) 13

The FCC has approved Lynk's satellite-to-phone connectivity service that will allow people to send and receive texts via satellites in space. According to TechCrunch, all that's left is "selecting a mobile network partner to bring it to market here in the States." From the report: Lynk demonstrated a direct satellite-to-phone (and back) emergency connectivity service late last year with its test orbital cell tower. Far from an orbital broadband connection or a legacy satellite band that has you pointing your phone at an invisible dot in the sky, Lynk would provide intermittent (think every half hour or so) 2-way SMS service via ordinary cellular bands that just happen to reach orbit. It's intended for emergencies, check-ins from the back country, and spreading information in places where networks are down, such as disaster zones.

It's not easy to send a text to or from an antenna moving several thousand miles per hour, and CEO Charles Miller confirmed that it took a few years for them to make it happen. So when major companies say they're working on it, he doesn't feel too much heat. "That's the benefit of having invented the tech five years ago: There's a bunch of hard things that no one else has done yet. I'm not saying they can't, just that they haven't yet," he told me. "We validated this and patented it in 2017. We did it from space yesterday and the day before -- we have the world's only active cell tower in space."

Of course, you could have a thousand of them and it wouldn't matter unless you have regulatory approval and partners in the mobile space. That's the next step for Lynk, and although they have 15 contracts spanning 36 countries around the world and are preparing for commercial launch, the United States FCC is the "gold standard" for this kind of testing and validation. That's not just because they have the best facilities -- the FCC approval process is also the de facto battleground where companies attempt to run interference on one another. [...] Today's order approves Lynk's satellite services to operate in general, having showed that they will not interfere with other services, radio bands, and so on. A separate approval will be needed when Lynk finds a partner to go to market with -- but the more difficult and drawn out question of safety and interference is already answered.

Graphics

EVGA Abandons the GPU Market, Reportedly Citing Conflicts With Nvidia (tomshardware.com) 72

UnknowingFool writes: After a decades long partnership with Nvidia, EVGA has announced they are ending their relationship. Citing conflicts with Nvidia, EVGA CEO Andrew Han said the company will not partner with Intel nor AMD, and will be exiting the GPU market completely. The company will continue to make existing RTX 30-series cards until their stock runs out but will not release a 4000 series card. YouTube channels JayZTwoCents and GamersNexus broke the news after sitting down with EVGA CEO Andrew Han to discuss his frustrations with Nvidia as a partner. Jon Peddie Research also published a brief article on the matter.
Transportation

Rolls Royce Exits Boom's Supersonic Airliner Project (flightglobal.com) 51

Rolls-Royce has ended its involvement in a project by Boom Supersonic to develop a faster-than-sound passenger airliner, leaving unclear the powerplant options available to Boom. FlightGlobal reports: "We are appreciative of Rolls-Royce's work over the last few years, but it became clear that Rolls' proposed engine design and legacy business model is not the best option for Overture's future airline operators or passengers," Boom said on 7 September. "Later this year, we will announce our selected engine partner and our transformational approach for reliable, cost-effective and sustainable supersonic flight."

Earlier in the day, news broke that R-R had backed out of the Boom project. "We've completed our contract with Boom and delivered various engineering studies for their Overture supersonic program," the UK engine manufacturer says. "After careful consideration, Rolls-Royce has determined that the commercial aviation supersonic market is not currently a priority for us and, therefore, will not pursue further work on the program at this time. It has been a pleasure to work with the Boom team and we wish them every success in the future."

Boom, with offices in Denver, has been developing a supersonic aircraft called Overture that it says will carry up to 80 passengers and cruise at Mach 1.7. It initially intended for Overture to have two engines, but recently changed to a four-engined design. The company has been targeting first flight of Overture in 2026 and first delivery in 2029. "Overture remains on track to carry passengers in 2029, and we are looking forward to making our engine announcement later this year," Boom says.

Microsoft

Microsoft EU Cloud Revisions Just So Happen To Exclude Google, Amazon (arstechnica.com) 38

Facing European antitrust scrutiny, Microsoft has made it easier to virtualize its software on non-Microsoft cloud infrastructure -- just so long as that infrastructure isn't owned by notable competitors Amazon, Google, or Alibaba. From a report: The conflict, months in the making, is striking for a company that has largely avoided the antitrust scrutiny of its rivals, and eagerly sought to distance itself from the anti-competitive complaints and government actions that beset Microsoft in the late 1990s. Microsoft outlined the changes that would take effect on October 1 in a blog post. Nicole Dezen, chief partner officer, wrote that Microsoft "believes in the value of the partner ecosystem" and changed outsourcing and hosting terms that "will benefit partners and customers globally."

New licensing terms would make it easier for Microsoft's enterprise customers to bring Microsoft software to non-Microsoft infrastructure and scale the cost and size of theirs or their customer's Microsoft systems on their own hardware, according to Dezen's post. But Microsoft wants to be clear about something: Its Services Provider Licensing Agreement (SPLA) was meant for customers that are offering hosting "from their own data centers," not buying Microsoft licenses to "host on others' data centers." To "strengthen the hoster ecosystem," Dezen writes, Microsoft will remove the ability to outsource to Alibaba, Amazon Web Services, Google, Microsoft's Azure cloud, or anybody using those companies as part of their hosting. Amazon and Google have weighed in, and they do not believe Microsoft is showing its newer, less anti-competitive side. "Microsoft is now doubling down on the same harmful practices by implementing even more restrictions in an unfair attempt to limit the competition it faces -- rather than listening to its customers and restoring fair software licensing in the cloud for everyone," an Amazon spokesperson told Reuters.

Businesses

Neobanks Are Struggling To Make Good on Their Lofty Promises (bloomberg.com) 17

Some offers of high rates and low fees have strings attached. From a report: Digit is a trendy financial technology company in San Francisco that offers traditional banking services online, complete with a tool that can automatically allocate a portion of customers' deposits to a savings account to match their investing goals. The service comes with a "no overdraft guarantee." Sound too good to be true? According to the Consumer Financial Protection Bureau, some of it is. Earlier this month the regulator hit Digit, now part of Oportun Financial, a lender in San Carlos, Calif., with a $2.7 million fine for falsely advertising the no-overdraft guarantee. Turns out, the algorithm Digit used to move funds around drained some customers' checking accounts, triggering the overdraft fees. Even after customers complained, Digit failed to reimburse them, despite saying it would, the CFPB found. "While we disagree with the CFPB on this matter, we are happy to have it settled," says an Oportun spokesperson. The company says fewer than 2,000 customers were overcharged.

Digit isn't the only consumer finance company failing to meet the lofty expectations its own advertising sets. There are about 60 other such fintechs, known as "challenger banks" or "neobanks," in the US, offering a similar suite of products. They have about 23 million customers, a figure that's expected to more than double -- to 50 million -- by 2025, according to consumer finance website Bankrate.com. Despite the name, they aren't banks but technology companies that form partnerships with obscure, conventional banks to give customers digital access to their money. In doing so, neobanks can offer Federal Deposit Insurance Corp. protection to checking and savings accounts. In Digit's case, its banking-services partner is South Dakota-based MetaBank, which says it wasn't involved in the CFPB matter.

Businesses

Qualcomm Is Plotting a Return To Server Market With New Chip (bloomberg.com) 13

Qualcomm is taking another run at the market for server processors, Bloomberg News reported Thursday, citing people familiar with its plans, betting it can tap a fast-growing industry and decrease its reliance on smartphones. From a report: The company is seeking customers for a product stemming from last year's purchase of chip startup Nuvia, according to the people, who asked not to be identified because the discussions are private. Amazon.com AWS business, one of the biggest server chip buyers, has agreed to take a look at Qualcomm's offerings, they said. Chief Executive Officer Cristiano Amon is trying to turn Qualcomm into a broader provider of semiconductors, rather than just the top maker of smartphone chips. But an earlier push into the server market was abandoned four years ago under his predecessor. At the time, the company was trying to cut costs and placate investors after fending off a hostile takeover by Broadcom.

This time around, Qualcomm has Nuvia, staffed with chip designers from companies such as Apple. Amon, who acquired the business for about $1.4 billion in 2021, has said that its work will help revitalize Qualcomm's high-end offerings for smartphones. But Nuvia was founded as a provider of technology for the server industry. The market for cloud computing infrastructure -- the kind of equipment that Amazon, Google and Microsoft use to whisk data around the world -- generated $73.9 billion last year, according to research firm IDC. That was up 8.8% from 2020. The owners of giant cloud data centers have long relied on Intel's chip technology for their servers. But they're increasingly embracing processors that use designs from Arm, a key partner in phone chips for San Diego-based Qualcomm.

Businesses

Crypto-Driven GPU Crash Makes Nvidia Miss Q2 Projections By $1.4 Billion (arstechnica.com) 46

In preliminary second-quarter financial results announced today, Nvidia's year-over-year growth is "down from a previously forecasted $8.1 billion, a miss of $1.4 billion," reports Ars Technica. "Nvidia blamed this shortfall on weaker-than-expected demand for its gaming products, including its GeForce graphics processors." The full results won't arrive until the end of the month. From the report: Nvidia pointed to "a reduction in channel partner sales," meaning that partners like Evga, MSI, Asus, Zotac, Gigabyte, and others were selling fewer new GPUs than anticipated. This drop can be attributed partly to a crash in the value of mining-based cryptocurrencies like Bitcoin and Ethereum -- fewer miners are buying these cards, and miners looking to unload their GPUs on the secondhand market are also giving gamers a cheaper source for graphics cards. "As we expect the macroeconomic conditions affecting sell-through to continue, we took actions with our Gaming partners to adjust channel prices and inventory," said Nvidia CEO Jensen Huang. That means we may see further price drops for existing GeForce GPUs, which have already been dropping in price throughout the year. Some cards still haven't reverted to their originally advertised prices, but they're getting closer all the time.

In better news for Nvidia, the small overall increase in revenue [$6.7 billion] is driven almost exclusively by the company's data center business, including GPU-accelerated AI and machine learning applications and GPU acceleration for cloud-hosted virtual machines. Nvidia's data center revenue is projected to be up 61 percent from last year, from $2.37 billion to $3.81 billion. Nvidia will supposedly launch its next-generation RTX 4000 series GPUs later this year. Based on the new Lovelace architecture, these GPUs may appeal to some gamers who originally sat out the RTX 3000 series due to shortages and inflated prices and are now avoiding the GPUs because they know a replacement is around the corner.

The Internet

Broadband Subscriber Growth Slows To Pre-Pandemic Levels (axios.com) 14

Cable companies are being downgraded by Wall Street analysts in response to weak broadband growth coming out of the pandemic. From a report: Cable companies have managed to stay afloat amid the cord-cutting crisis thanks to their booming broadband businesses. But some analysts see that safety net beginning to fade. Jonathan Chaplin, managing partner at New Street Research, wrote in two notes to clients that the firm has lowered its broadband subscriber estimates for the second time this year for both Charter and Comcast. "We have limited conviction in a quick recovery, given limited visibility all around," he wrote regarding Charter. "We are hoping for a turnaround later in the quarter but have low conviction," he wrote regarding Comcast. Comcast's stock slid last week after it reported flat broadband subscriber additions for the second quarter of 2022. The telecom giant was still able to increase broadband revenues, but its growth has been slowed by increased competition and more users relying on mobile hotspots and fixed wireless plans. Charter lost broadband subscribers for the first time last quarter. Executives cited customers rolling off the government's broadband subsidy program as a major contributor to its customer loss. "Excluding that headwind, we organically grew 38,000 internet customers in the quarter," Charter chief financial officer Jessica Fischer told investors.
Privacy

Google's Nest Will Provide Data to Police Without a Warrant (petapixel.com) 81

As reported by CNET, Google will allow law enforcement to access data from its Nest products -- or theoretically any other data you store with Google -- without a warrant. PetaPixel reports: "If we reasonably believe that we can prevent someone from dying or from suffering serious physical harm, we may provide information to a government agency -- for example, in the case of bomb threats, school shootings, kidnappings, suicide prevention, and missing person cases," reads Google's TOS page on government requests for user information. "We still consider these requests in light of applicable laws and our policies."

An unnamed Nest spokesperson did tell CNET that the company tries to give its users notice when it provides their data under these circumstances. Google "reserves the right" to make emergency disclosures to law enforcement even when there is no legal requirement to do so. "A provider like Google may disclose information to law enforcement without a subpoena or a warrant 'if the provider, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of communications relating to the emergency,'" a Nest spokesperson tells CNET.

While Amazon and Google have both said they would hand over a user's data to law enforcement without a warrant, Arlo, Apple, Wyze, and Anker, owner of Eufy, all confirmed to CNET that they won't give authorities access to a user's smart home camera's footage unless they're shown a warrant or court order. These companies would be legally bound to provide data to the authorities if they were shown a legal document. But, unlike Google and Amazon, they will not otherwise share camera footage with law enforcement, even if they had an emergency request for data. Apple's default setting for video cameras connected via Homekit is end-to-end encryption which means the company is unable to share user video at all.
In an updated statement, a Google spokesperson clarified that they have never sent Nest data to authorities, "but it's important that we reserve the right to do so."

They added: "To reiterate, and as we've specified in our privacy commitments, we will only share video footage and audio recordings with third-party apps and services that work with our devices if you or a member of your home explicitly gives us permission, and we'll only ask for this permission in order to provide a helpful experience from an approved partner (such as a home security service provider)."
Businesses

Netflix Taps Microsoft as Partner For Ads Service (netflix.com) 33

Netflix: In April we announced that we will introduce a new lower priced ad-supported subscription plan for consumers, in addition to our existing ads-free basic, standard and premium plans. Today we are pleased to announce that we have selected Microsoft as our global advertising technology and sales partner. Microsoft has the proven ability to support all our advertising needs as we work together to build a new ad-supported offering. More importantly, Microsoft offered the flexibility to innovate over time on both the technology and sales side, as well as strong privacy protections for our members. It's very early days and we have much to work through. But our long term goal is clear. More choice for consumers and a premium, better-than-linear TV brand experience for advertisers. We're excited to work with Microsoft as we bring this new service to life.
Emulation (Games)

Xbox Series X Can Run Windows 98, Along With Classic PC Games of The Era (purexbox.com) 23

Alex Battaglia from the YouTube channel "Digital Foundry" was able to use the "RetroArch" software emulator to run Windows 98 on the Xbox Series X, along with several PC games of the era. "Technically, you're supposed to be an Xbox developer to access this, and you will need to sign up to the paid Microsoft Partner program and turn on 'Developer Mode' for your system to activate it," notes Pure Xbox. "In DF's case, rather than directly playing emulated games through RetroArch, they used the program to install Windows 98 software." From the report: Beyond the novelty of actually booting up Win98 on a modern console the channel then decided to test out some games, running through the older version of Windows. Playthroughs of Turok, Command & Conquer, Quake 2 and more were all pretty successful, although the act of loading them onto the software requires a bit of messing about (you have to create ISO files and transfer them over -- sadly, Xbox's disc drive can't read the original discs). Of course, this wouldn't be a Digital Foundry video without some performance comparisons, so the team did just that. The video compares hardware of the era with Xbox Series X's emulation, and while the console often lags behind due to the fact that it's literally emulating an entire version of Windows, and then a game on top of that, it fares pretty well overall. You can watch Digital Foundry's video here.
Facebook

Meta Is Finally Closing Its Cryptocurrency Project Novi (cnet.com) 27

"What little is left of Meta's once-ambitious cryptocurrency project is limping to an end," reports CNET: A pilot program for Novi, the social media giant's money-transfer service that uses a cryptocurrency wallet of the same name, will cease operating on Sept. 1, according to a notice on its website. The Novi pilot served Guatemala and parts of the US when it launched in October 2021. "The Novi pilot is ending soon," according to the notice, which was reported earlier by Bloomberg News. "We've made it easy for you to get your remaining balance and download your Novi information." Another page on the site encourages users to withdraw balances "as soon as possible." The planned phaseout of Novi is hardly surprising. Earlier this year, Meta and its partners pulled the plug on Diem, a related cryptocurrency project that was launched under the moniker Libra in 2019, when Meta was still called Facebook... The Libra-Diem-Novi project got little love in its brief history. Partners bolted, details shifted, and legislators criticized the plans. CEO Mark Zuckerberg eventually shifted his interest to the metaverse and an end to the crypto plans seemed inevitable.
Protocol points out that Novi "was a far cry from what Meta CEO Mark Zuckerberg and then-Meta executive David Marcus originally envisioned." They unveiled plans for a stablecoin, initially called Libra, in 2019, with plans to launch it in 2020, along with a crypto wallet called Calibra. It soon faced resistance from regulators around the globe. The token was renamed Diem and the wallet Novi, but the new name didn't change official skepticism... Marcus left Meta last year, and Meta sold assets related to the project to its banking partner, Silvergate. Novi was supposed to become the new brand for all of Meta's financial products, including Facebook Pay. But after Marcus' departure, Meta started downplaying the Novi name. Meta's financial operations became Meta Financial Technologies in March, and Facebook Pay became Meta Pay in June.

Meta hasn't completely abandoned its blockchain ambitions, signaling that support for cryptocurrency payments will eventually be built into Meta Pay.

United States

Countries Form New NATO-Like 'Mineral Security' Alliance to Ensure EV Supplies (yahoo.com) 53

"A metallic NATO is starting to take shape," writes the senior metals columnist at Reuters, "though no-one is calling it that just yet." The Minerals Security Partnership is in theory open to all countries that are committed to "responsible critical mineral supply chains to support economic prosperity and climate objectives". But the coalition assembled by the United States is one of like-minded countries such as Australia, Canada, the United Kingdom, France and Germany with an Asian axis in the form of Japan and South Korea. [Also the European Commission, as well as Finland and Sweden.]

It is defined as much as anything by who is not on the invite list — China and Russia.

China's dominance of key enabling minerals such as lithium and rare earths is the single biggest reason why Western countries are looking to build their own supply chains. Russia, a major producer of nickel, aluminium and platinum group metals, is now also a highly problematic trading partner as its war in Ukraine that the Kremlin calls a "special military operation" grinds on. A previously highly globalised minerals supply network looks set to split into politically polarised spheres of influence, a tectonic realignment with far-reaching implications. The United States and Europe have realised that they can't build out purely domestic supply chains quickly enough to meet demand from the electric vehicle transition....

The process was already well underway before the U.S. State Department announced the formation of the Minerals Security Partnership on June 14. U.S. and Canadian officials have been working closely as Canada fleshes out a promised C$3.8 billion ($3.02 billion) package to boost production of lithium, copper and other strategic minerals. European Commission Vice-President Maros Sefcovic has just been in Norway to seal "a strategic partnership" on battery technologies and critical raw materials.

The article points out America's Department of Defense is already investing $120 million in a new plant for heavy rare earths separation — and has chosen an Australian company as its partner.

Shortly thereafter the Defense Department noted an online disinformation campaign against its new partner (according to U.S.-based cybersecurity firm Mandiant), disinformation which Reuters describes as "a pro-China propaganda campaign" using fake social media accounts to try to stir up opposition.
Security

NSA Shares Tips On Securing Windows Devices With PowerShell (bleepingcomputer.com) 38

An anonymous reader quotes a report from BleepingComputer: The National Security Agency (NSA) and cybersecurity partner agencies issued an advisory today recommending system administrators to use PowerShell to prevent and detect malicious activity on Windows machines. PowerShell is frequently used in cyberattacks, leveraged mostly in the post-exploitation stage, but the security capabilities embedded in Microsoft's automation and configuration tool can also benefit defenders in their forensics efforts, improve incident response, and to automate repetitive tasks. The NSA and cyber security centers in the U.S. (CISA), New Zealand (NZ NCSC), and the U.K. (NCSC-UK) have created a set of recommendations for using PowerShell to mitigate cyber threats instead of removing or disabling it, which would lower defensive capabilities.

Reducing the risk of threat actors abusing PowerShell requires leveraging capabilities in the framework such as PowerShell remoting, which does not expose plain-text credentials when executing commands remotely on Windows hosts. Administrators should be aware that enabling this feature on private networks automatically adds a new rule in Windows Firewall that permits all connections. Customizing Windows Firewall to allow connections only from trusted endpoints and networks helps reduce an attacker's chance for successful lateral movement. For remote connections, the agencies advise using the Secure Shell protocol (SSH), supported in PowerShell 7, to add the convenience and security of public-key authentication:

- remote connections don't need HTTPS with SSL certificates
- no need for Trusted Hosts, as required when remoting over WinRM outside a domain
- secure remote management over SSH without a password for all commands and connections
- PowerShell remoting between Windows and Linux hosts

Another recommendation is to reduce PowerShell operations with the help of AppLocker or Windows Defender Application Control (WDAC) to set the tool to function in Constrained Language Mode (CLM), thus denying operations outside the policies defined by the administrator. Recording PowerShell activity and monitoring the logs are two recommendations that could help administrators find signs of potential abuse. The NSA and its partners propose turning on features like Deep Script Block Logging (DSBL), Module Logging, and Over-the-Shoulder transcription (OTS). The first two enable building a comprehensive database of logs that can be used to look for suspicious or malicious PowerShell activity, including hidden action and the commands and scripts used in the process. With OTS, administrators get records of every PowerShell input or output, which could help determine an attacker's intentions in the environment.
The full document, titled "Keeping PowerShell: Security Measures to Use and Embrace" is available here (PDF).
Businesses

Founder Alleges That YC-Backed Fintech Startup is 'Copy-and-Pasting' Its Business (techcrunch.com) 31

A new startup lifting elements of competing businesses is far from unusual in today's venture world, but sometimes competing founders don't find the imitation all that flattering. From a report: Andy Bromberg, CEO of the a16z-backed startup Eco, is claiming that Pebble, another fintech startup that came out of stealth this morning, "plagiarized" Eco's materials and business model. Bromberg posted a Twitter thread this afternoon saying Pebble engaged in "copy-and-pasting, immaturity, lying, and espionage." In the thread, Bromberg detailed the background behind his claims, and he also spoke to TechCrunch about the allegations.

Bromberg claims the Pebble co-founders, CEO Aaron Bai and CTO Sahil Phadnis, impersonated Y Combinator investors to get access to Eco's waitlist. He also alleges that Phadnis asked detailed questions about Eco's backend under the guise of looking for employment and that multiple aspects of Pebble's product and marketing language are essentially copy-pasted from Eco. TechCrunch covered the news earlier this week that Pebble, which participated in Y Combinator's Winter 2022 cohort, raised $6.2 million in seed funding from YC itself alongside LightShed Ventures, Eniac Ventures, Global Founders Capital, Montage Ventures, Soma Capital and angel investors.

On its website, Pebble, founded last year, calls itself "the first app that pays you to save, spend, and send your money -- all in one balance." It launched with two core products -- a 5% APY interest offering for customer cash deposits, and a 5% cash back offering when customers spend at its partner merchants, which include Uber, Amazon and Chipotle, Pebble CEO Aaron Bai said. The former product is based on the model of taking in customer funds, converting them to stablecoins, and lending them out to institutions, Bai explained at the time. Bromberg subsequently told TechCrunch that both core products were based on two of Eco's core offerings.

The Courts

Match Sues Google Over App Store Billing Rules (bloomberg.com) 31

Match Group accused Alphabet's Google in a lawsuit of acting as a monopolist with its app store billing rules, the latest escalation in a brawl over the mobile-app industry. From a report: Match Group, which operates dating apps such as Tinder and OkCupid, alleged that Google breaks federal and state laws and abuses its power with a requirement that app developers use its billing system on Android devices. "Ten years ago, Match Group was Google's partner. We are now its hostage," Match Group said in a complaint filed Monday in northern California federal court.

"Blinded by the possibility of getting an ever-greater cut of the billions of dollars users spend each year on Android apps, Google set out to monopolize the market for how users pay for their Android apps." Google, like Apple, has faced enormous recent legal and political scrutiny over the commission fees and billing restrictions both companies apply to paid services in their app stores. Congress is currently weighing a bill to force Google and Apple to change their business models.

Social Networks

'Buy Now, Pay Later' Is Sending the TikTok Generation Spiraling Into Debt (sfgate.com) 193

SFGATE reports on the alarming rise of "Buy Now, Pay Later" services that are being heavily marketed by influencers and brands on TikTok and Instagram. "Gen Z, in particular, has fallen in love with the short-term loans, spending 925% more now through point-of-sale services than in January 2020," notes the report.

"But coupling nearly instantaneous loans with an influencer-addled social media culture that prioritizes exorbitant spending and normalizes debt could be further jeopardizing the financial futures of young people through just four easy payments." Here's an excerpt from the report: Financial experts who spoke with SFGATE expressed significant concerns about the way companies are targeting Gen Z consumers. "They are marketing very heavily to an audience that is younger, that might not just have as much experience on how to use credit and what credit implications are or what it means to have multiple loans at one time," Marisabel Torres, the California policy director of the Center for Responsible Lending, told SFGATE.

Few of the services do significant credit checks, which would help determine whether people will be able to repay the loans. And plenty of people are spending more than they can afford: 43% of Gen Z users have missed at least one payment, according to a survey by the polling site Piplsay. Of Gen Z consumers who used a point-of-sale loan for something they needed, 30% missed at least two payments, according to a survey by Credit Karma.

The companies are fully aware that their services encourage people to spend more. In fact, several of them market it as a benefit to stores that want to partner with them. "We do see larger cart sizes, larger purchases, relative to what they would put onto their debit cards and credit cards," Libor Michalek, the president of technology at Affirm, told SFGATE. Still, high-level staffers at Affirm and Afterpay -- both based in San Francisco -- positioned their services as more responsible, less predatory alternatives to credit cards and personal loans in interviews with SFGATE. They also emphasized the accessibility of these services, especially for younger consumers looking to bolster their credit and consumers working to restore their credit scores, despite the fact that many of the services don't report on-time payments to credit agencies.
The report concludes by saying regulation is (probably) on its way. California Attorney General Rob Bonta, for example, signaled his support earlier this year for increasing regulations around point-of-sale loans. We're likely to see other states look into it in the coming months and years as well.

"While these services may be a responsible alternative to credit card debt for a good chunk of consumers, it seems increasingly likely that, without regulations, this kind of debt will burden the most financially vulnerable, just as credit cards, payday loans and layaway have in the past," reports SFGATE.
Facebook

Snapchat's Evan Spiegel Dismisses Facebook's Metaverse as 'Hypothetical' (theguardian.com) 28

The Snapchat founder, Evan Spiegel, has dismissed Facebook's "metaverse" ambitions as "ambiguous and hypothetical" as he announced a raft of new augmented reality features coming to phones and Snap's experimental AR Spectacles over the next year. The Guardian: Speaking ahead of the Snap Partner Summit, the company's flagship annual event, Spiegel argued Snapchat was uniquely placed to guide the next decade of technology thanks to the company's vast array of augmented reality services, such as the "lenses" that are used by millions of people every day.

[...] The updates sound like they could be the foundations of a shared virtual universe of the type that Facebook recently decided was so fundamental to its future that it even rebranded the company as Meta. But, Spiegel says, the word "metaverse" is never uttered in Snap's offices. "The reason why we don't use that word is because it's pretty ambiguous and hypothetical. Just ask a room of people how to define it, and everyone's definition is totally different."

Slashdot Top Deals