Censorship

Russia Blocks OONI Explorer, a Large Open Dataset On Internet Censorship (ooni.org) 13

As of September 11th, Russia has blocked access to OONI Explorer, citing concerns over circumvention tools. This block affects Russian users' ability to access not only circumvention data but also the extensive dataset on global internet censorship that OONI provides. From a blog post: OONI Explorer is one of the largest open datasets on internet censorship around the world. We first launched this web platform back in 2016 with the goal of enabling researchers, journalists, and human rights defenders to investigate internet censorship based on empirical network measurement data that is contributed by OONI Probe users worldwide. Every day, we publish new measurements from around the world in real-time.

Today, OONI Explorer hosts more than 2 billion network measurements collected from 27 thousand distinct networks in 242 countries and territories since 2012. Out of all countries, OONI Probe users in Russia contribute the second largest volume of measurements (following the U.S, where OONI Probe users contribute the most measurements out of any country). This has enabled us to study various cases of internet censorship in Russia, such as the blocking of Tor, the blocking of independent news media websites, and how internet censorship in Russia changed amid the war in Ukraine.

In this report, we share OONI data on the blocking of OONI Explorer in Russia.

Google

Google Complains To EU Over Microsoft Cloud Practices (reuters.com) 22

Alphabet unit Google filed a complaint to the European Commission on Wednesday against what it said were Microsoft's anti-competitive practices to lock customers into Microsoft's cloud platform Azure. From a report: Google, whose biggest cloud computing rivals are Microsoft and Amazon Web Services, said Microsoft was exploiting its dominant Windows Server operating system to prevent competition. Google Cloud Vice President Amit Zavery told a briefing that Microsoft made customers pay a 400% mark-up to keep running Windows Server on rival cloud computing operators. This did not apply if they used Azure. Users of rival cloud systems would also get later and more limited security updates, Zavery said.

Google pointed to a 2023 study by cloud services organization CISPE which found that European businesses and public sector bodies were paying up to 1 billion euros ($1.12 billion) per year on Microsoft licensing penalties. Microsoft in July clinched a 20-million-euro deal to settle an antitrust complaint about its cloud computing licensing practices with CISPE, averting an EU investigation. However, the settlement did not include Amazon Web Services, Google Cloud Platform and AliCloud, prompting criticism from the first two companies.

IT

New California Law Requires One-Click Subscription Cancellations (thedesk.net) 89

A new law in California will make it easier for consumers to cancel their streaming subscriptions and similar products when they enroll in automatic renewal of those services. From a report: The law, passed through Assembly Bill (AB) 2863, will require companies that offer automatic subscription renewals through one-click purchases to also offer customers a way to cancel their subscriptions through the same one-click method. California already had one of the toughest subscription cancellation laws in the country, requiring companies to offer a way to cancel a recurring subscription through the Internet if they allowed customers to sign up for a service that way.

The initial law was meant to prevent companies from allowing customers to purchase a subscription through the web, while forcing them to call a hotline to cancel them. Consumer advocacy groups complained that companies would often subject customers to frustrating long wait times on the phone with the hope that they would eventually hang up without cancelling their service. While the law was good in theory, it contained at least one loophole: Companies were in compliance as long as they offered a way for customers to cancel their subscriptions online, but could make them click several links or visit several webpages with opt-in requirements before a cancellation request was processed.

The Internet

45 Years Ago CompuServe Connected the World Before the World Wide Web (wosu.org) 118

Tony Isaac shares a report from WOSU Public Media: Silicon Valley has the reputation of being the birthplace of our hyper-connected Internet age, the hub of companies such as Apple, Google and Facebook. However, a pioneering company here in central Ohio is responsible for developing and popularizing many of the technologies we take for granted today. A listener submitted a question to WOSU's Curious Cbus series wanting to know more about the legacy of CompuServe and what it meant to go online before the Internet. That legacy was recently commemorated by the Ohio History Connection when they installed a historical marker in Upper Arlington -- near the corner of Arlington Center and Henderson roads -- where the company located its computer center and corporate building in 1973. The plaque explains that CompuServe was "the first major online information service provider," and that its subscribers were among the first to have access to email, online newspapers and magazines and the ability to share and download files. CompuServe, founded in 1969 in Ohio as a subsidiary of Golden United Life Insurance, began as a computer time-sharing service for businesses. In 1979, it launched an online service for consumers, partnering with RadioShack since they "were key in reaching early computer users."

Acquired by H&R Block in 1980, CompuServe became a leader in digital innovations like email, online newspapers, and chat forums, with The Columbus Dispatch becoming the first online newspaper. "... it turned out that what was most popular is not reading reliable news sources, but just shooting the breeze with your friends or arguing with strangers over politics," said former tech journalist and early Compuserve user Dylan Tweney.

Despite competing with Prodigy and AOL through the 1990s, CompuServe struggled with the rise of the internet. AOL acquired the company in 1997, but CompuServe remains a digital pioneer for fostering online communities. "For a lot of people, CompuServe was a connection to the world and their first introduction to the idea that their computer could be more than a computer," said Tweney. "It was a communications device, an information device."
Government

California Governor Vetoes Bill Requiring Opt-Out Signals For Sale of User Data (arstechnica.com) 51

An anonymous reader quotes a report from Ars Technica: California Gov. Gavin Newsom vetoed a bill that would have required makers of web browsers and mobile operating systems to let consumers send opt-out preference signals that could limit businesses' use of personal information. The bill approved by the State Legislature last month would have required an opt-out signal "that communicates the consumer's choice to opt out of the sale and sharing of the consumer's personal information or to limit the use of the consumer's sensitive personal information." It would have made it illegal for a business to offer a web browser or mobile operating system without a setting that lets consumers "send an opt-out preference signal to businesses with which the consumer interacts."

In a veto message (PDF) sent to the Legislature Friday, Newsom said he would not sign the bill. Newsom wrote that he shares the "desire to enhance consumer privacy," noting that he previously signed a bill "requir[ing] the California Privacy Protection Agency to establish an accessible deletion mechanism allowing consumers to request that data brokers delete all of their personal information." But Newsom said he is opposed to the new bill's mandate on operating systems. "I am concerned, however, about placing a mandate on operating system (OS) developers at this time," the governor wrote. "No major mobile OS incorporates an option for an opt-out signal. By contrast, most Internet browsers either include such an option or, if users choose, they can download a plug-in with the same functionality. To ensure the ongoing usability of mobile devices, it's best if design questions are first addressed by developers, rather than by regulators. For this reason, I cannot sign this bill." Vetoes can be overridden with a two-thirds vote in each chamber. The bill was approved 59-12 in the Assembly and 31-7 in the Senate. But the State Legislature hasn't overridden a veto in decades.
"It's troubling the power that companies such as Google appear to have over the governor's office," said Justin Kloczko, tech and privacy advocate for Consumer Watchdog, a nonprofit group in California. "What the governor didn't mention is that Google Chrome, Apple Safari and Microsoft Edge don't offer a global opt-out and they make up for nearly 90 percent of the browser market share. That's what matters. And people don't want to install plug-ins. Safari, which is the default browsers on iPhones, doesn't even accept a plug-in."
United States

DOJ Sues Visa For Locking Out Rival Payment Platforms (theverge.com) 35

The Department of Justice has filed an antitrust lawsuit against Visa, alleging that the financial services firm has an illegal monopoly over debit network markets and has attempted to unlawfully crush competitors, including fintech companies like PayPal and Square. From a report: The lawsuit follows a multiyear investigation of Visa which the company disclosed in 2021. "We allege that Visa has unlawfully amassed the power to extract fees that far exceed what it could charge in a competitive market," Attorney General Merrick Garland said in a statement. "Merchants and banks pass along those costs to consumers, either by raising prices or reducing quality or service. As a result, Visa's unlawful conduct affects not just the price of one thing -- but the price of nearly everything."

Visa makes more than $7 billion a year in payment processing fees alone, and more than 60 percent of debit transactions in the United States run on Visa's network, the complaint claims. The government alleges that Visa's market dominance is partly due to the "web of exclusionary agreements" it imposes on businesses and banks. Visa has also attempted to "smother" competitors -- including smaller debit networks and newer fintech companies -- the complaint alleges. Visa executives allegedly feel particularly threatened by Apple, which the company has described as an "existential threat," the DOJ claims.

The Internet

Cloudflare's New Marketplace Will Let Websites Charge AI Bots For Scraping (techcrunch.com) 12

An anonymous reader quotes a report from TechCrunch: Cloudflare announced plans on Monday to launch a marketplace in the next year where website owners can sell AI model providers access to scrape their site's content. The marketplace is the final step of Cloudflare CEO Matthew Prince's larger plan to give publishers greater control over how and when AI bots scrape their websites. "If you don't compensate creators one way or another, then they stop creating, and that's the bit which has to get solved," said Prince in an interview with TechCrunch.

As the first step in its new plan, on Monday, Cloudflare launched free observability tools for customers, called AI Audit. Website owners will get a dashboard to view analytics on why, when, and how often AI models are crawling their sites for information. Cloudflare will also let customers block AI bots from their sites with the click of a button. Website owners can block all web scrapers using AI Audit, or let certain web scrapers through if they have deals or find their scraping beneficial. A demo of AI Audit shared with TechCrunch showed how website owners can use the tool, which is able to see where each scraper that visits your site comes from, and offers selective windows to see how many times scrapers from OpenAI, Meta, Amazon, and other AI model providers are visiting your site. [...]

AI

'Forget ChatGPT: Why Researchers Now Run Small AIs On Their Laptops' (nature.com) 48

Nature published an introduction to running an LLM locally, starting with the example of a bioinformatician who's using AI to generate readable summaries for his database of immune-system protein structures. "But he doesn't use ChatGPT, or any other web-based LLM." He just runs the AI on his Mac... Two more recent trends have blossomed. First, organizations are making 'open weights' versions of LLMs, in which the weights and biases used to train a model are publicly available, so that users can download and run them locally, if they have the computing power. Second, technology firms are making scaled-down versions that can be run on consumer hardware — and that rival the performance of older, larger models. Researchers might use such tools to save money, protect the confidentiality of patients or corporations, or ensure reproducibility... As computers get faster and models become more efficient, people will increasingly have AIs running on their laptops or mobile devices for all but the most intensive needs. Scientists will finally have AI assistants at their fingertips — but the actual algorithms, not just remote access to them.
The article's list of small open-weights models includes Meta's Llama, Google DeepMind's Gemma, Alibaba's Qwen, Apple's DCLM, Mistral's NeMo, and OLMo from the Allen Institute for AI. And then there's Microsoft: Although the California tech firm OpenAI hasn't open-weighted its current GPT models, its partner Microsoft in Redmond, Washington, has been on a spree, releasing the small language models Phi-1, Phi-1.5 and Phi-2 in 2023, then four versions of Phi-3 and three versions of Phi-3.5 this year. The Phi-3 and Phi-3.5 models have between 3.8 billion and 14 billion active parameters, and two models (Phi-3-vision and Phi-3.5-vision) handle images1. By some benchmarks, even the smallest Phi model outperforms OpenAI's GPT-3.5 Turbo from 2023, rumoured to have 20 billion parameters... Microsoft used LLMs to write millions of short stories and textbooks in which one thing builds on another. The result of training on this text, says Sébastien Bubeck, Microsoft's vice-president for generative AI, is a model that fits on a mobile phone but has the power of the initial 2022 version of ChatGPT. "If you are able to craft a data set that is very rich in those reasoning tokens, then the signal will be much richer," he says...

Sharon Machlis, a former editor at the website InfoWorld, who lives in Framingham, Massachusetts, wrote a guide to using LLMs locally, covering a dozen options.

The bioinformatician shares another benefit: you don't have to worry about the company updating their models (leading to different outputs). "In most of science, you want things that are reproducible. And it's always a worry if you're not in control of the reproducibility of what you're generating."

And finally, the article reminds readers that "Researchers can build on these tools to create custom applications..." Whichever approach you choose, local LLMs should soon be good enough for most applications, says Stephen Hood, who heads open-source AI at the tech firm Mozilla in San Francisco. "The rate of progress on those over the past year has been astounding," he says. As for what those applications might be, that's for users to decide. "Don't be afraid to get your hands dirty," Zakka says. "You might be pleasantly surprised by the results."
Firefox

Zen Browser: a New Firefox-based Alternative to Chromium Browsers (zen-browser.app) 80

First released on July 11th, the Firefox-based Zen browser is "taking a different approach to the user interface," according to the blog It's FOSS.

The Register says the project "reminds us strongly of Arc, a radical Chromium-based web browser... to modernize the standard web browser UI by revising some fundamental assumptions." [Arc] removes the URL bar from front and center, gets rid of the simple flat list of tabs, and so on. Zen is trying to do some similar things, but in a slightly more moderate way — and it's doing it on the basis of Mozilla's Firefox codebase... Instead of the tired old horizontal tab bar you'll see in both Firefox and Chrome, Zen implements its own tab bar... By default, this tab bar is narrow and just shows page icons — but there are some extra controls at the bottom of the sidebar, one of which expands the sidebar to show page titles too. For us, it worked better than Vivaldi's fancier sidebar.
The article concludes it's "a new effort to modernize web browsing by bringing tiling, workspaces, and so on — and it's blissfully free of Google code." One Reddit comment swooned over Zen's "extraordinary" implementation of a distraction-free "Compact Mode" (hiding things like the sidebar and top bar). And It's Foss described it as a "tranquil," browser, "written using CSS, C++, JavaScript, and a few other programming languages, with a community of over 30 people contributing to it." The layout of the interface felt quite clean to me; there were handy buttons on the top to control the webpage, manage extensions, and a menu with additional options... The split-view functionality allows you to open up two different tabs on the same screen, allowing for easy multitasking when working across different webpages... I split two tabs, but in my testing, I could split over 10+ tabs... If you have a larger monitor, then you are in for a treat...

The Zen Sidebar feature... can run web apps alongside any open tabs. This can be helpful in situations where you need to quickly access a service like a note-taking app, Wikipedia, Telegram, and others.

On the customization side of things, you will find that Zen Browser supports everything that Firefox does, be it the settings, adding new extensions/themes/plugins, etc.

The Register points out it's easy to give it a try. "Being based on Firefox means that as well as running existing extensions, it can connect to Mozilla's Sync service and pick up not just your bookmarks, but also your tabs from other instances."

And beyond all that, "There's just something satisfying about switching browsers every now and again..." argues the tech site Pocket-Lint: Zen Browser's vertical tabs layout is superb and feels much better than anything available in standard Firefox. [Firefox recently offered vertical tabs and a new sidebar experience in Nightly/Firefox Labs 131.] The tab bar can be set to automatically hide and show up whenever you hover near it, and it also contains quick access buttons to bookmarks, settings, and browsing history. The tab bar also contains a profile switcher...

One of the greatest parts of the Zen Browser is the community that has popped up around it. At its heart, Zen Browser is a community-driven project... Zen Browser themes are aesthetic and functional tweaks to the UI. While there aren't a ton available right now, the ones that are show a lot of promise for the browser's future... I've personally gotten great use out of the Super URL Bar theme, which makes your URL bar expand and become the focus of your screen while typing in it... There's a lot you can do to make Zen Browser feel nearly exactly like what you want it to feel like.

The "Business Standard calls it "an open-source alternative to Chromium-based browsers," adding "Where Zen truly shines is it offers a range of customisation, tab management, and workspace management..." Their theme store offers a range of options, including modifications to the bookmark toolbar, a floating URL bar, private mode theming, and removal of browser padding. In addition to these, users can also choose from custom colour schemes and built-in theming options... The Sidebar is another neat feature which allows you to open tabs in a smaller, smartphone-sized window. You can view websites in mobile layout by using this panel.
It's "focused on being always at the latest version of Firefox," according to its official site, noting that Firefox is known for its security features. But then, "We also have additional security features like https only built into Zen Browser to help keep you safe online." And it also promises automated Releases "to ensure security."

It's FOSS adds that you can get Zen Browser for Linux, Windows, and macOS from its official website (adding "They also offer it on the Flathub store for further accessibility on Linux.")

And its source code is available on GitHub.
Programming

'Compile and Run C in JavaScript', Promises Bun (thenewstack.io) 54

The JavaScript runtime Bun is a Node.js/Deno alternative (that's also a bundler/test runner/package manager).

And Bun 1.1.28 now includes experimental support for ">compiling and running native C from JavaScript, according to this report from The New Stack: "From compression to cryptography to networking to the web browser you're reading this on, the world runs on C," wrote Jarred Sumner, creator of Bun. "If it's not written in C, it speaks the C ABI (C++, Rust, Zig, etc.) and is available as a C library. C and the C ABI are the past, present, and future of systems programming." This is a low-boilerplate way to use C libraries and system libraries from JavaScript, he said, adding that this feature allows the same project that runs JavaScript to also run C without a separate build step... "It's good for glue code that binds C or C-like libraries to JavaScript. Sometimes, you want to use a C library or system API from JavaScript, and that library was never meant to be used from JavaScript," Sumner added.

It's currently possible to achieve this by compiling to WebAssembly or writing a N-API (napi) addon or V8 C++ API library addon, the team explained. But both are suboptimal... WebAssembly can do this but its isolated memory model comes with serious tradeoffs, the team wrote, including an inability to make system calls and a requirement to clone everything. "Modern processors support about 280 TB of addressable memory (48 bits). WebAssembly is 32-bit and can only access its own memory," Sumner wrote. "That means by default, passing strings and binary data JavaScript WebAssembly must clone every time. For many projects, this negates any performance gain from leveraging WebAssembly."

The latest version of Bun, released Friday, builds on this by adding N-API (nap) support to cc [Bun's C compiler, which uses TinyCC to compile the C code]. "This makes it easier to return JavaScript strings, objects, arrays and other non-primitive values from C code," wrote Sumner. "You can continue to use types like int, float, double to send & receive primitive values from C code, but now you can also use N-API types! Also, this works when using dlopen to load shared libraries with bun:ffi (such as Rust or C++ libraries with C ABI exports)....

"TinyCC compiles to decently performant C, but it won't do advanced optimizations that Clang or GCC does like autovectorization or very specialized CPU instructions," Sumner wrote. "You probably won't get much of a performance gain from micro-optimizing small parts of your codebase through C, but happy to be proven wrong!"

AI

Project Analyzing Human Language Usage Shuts Down Because 'Generative AI Has Polluted the Data' (404media.co) 93

The creator of an open source project that scraped the internet to determine the ever-changing popularity of different words in human language usage says that they are sunsetting the project because generative AI spam has poisoned the internet to a level where the project no longer has any utility. 404 Media: Wordfreq is a program that tracked the ever-changing ways people used more than 40 different languages by analyzing millions of sources across Wikipedia, movie and TV subtitles, news articles, books, websites, Twitter, and Reddit. The system could be used to analyze changing language habits as slang and popular culture changed and language evolved, and was a resource for academics who study such things. In a note on the project's GitHub, creator Robyn Speer wrote that the project "will not be updated anymore."

"Generative AI has polluted the data," she wrote. "I don't think anyone has reliable information about post-2021 language usage by humans." She said that open web scraping was an important part of the project's data sources and "now the web at large is full of slop generated by large language models, written by no one to communicate nothing. Including this slop in the data skews the word frequencies." While there has always been spam on the internet and in the datasets that Wordfreq used, "it was manageable and often identifiable. Large language models generate text that masquerades as real language with intention behind it, even though there is none, and their output crops up everywhere," she wrote.

Windows

Microsoft Launches a Windows App For iPhones, Macs, and Android Devices (theverge.com) 19

Microsoft has launched a new Windows app that serves as a hub for streaming Windows environments from services like Windows 365 and Azure Virtual Desktop. However, it's limited to Microsoft work and school accounts with "no signs that Microsoft plans to support consumer accounts," notes The Verge's Tom Warren. From the report: This new unified app has been in testing for nearly a year, and includes a customizable home screen, multi-monitor support, and USB redirection so you can use local devices like webcams, storage devices, and printers as if they were plugged directly into a cloud PC. This Windows app is limited to Microsoft work and school accounts, as it's primarily designed for existing users of Remote Desktop clients for Windows and other operating systems to move to. Microsoft has had similar apps for connecting to PCs remotely in Windows for decades, including the Remote Desktop Connection app that still ships as part of Windows 11. These apps, including the new Windows one, are useful for connecting to work PCs from a personal laptop or PC. The Windows app is available from the Microsoft Store and Apple App Store. An Android version enters public preview mode today.
Privacy

Chinese Spies Spent Months Inside Aerospace Engineering Firm's Network Via Legacy IT (theregister.com) 16

The Register's Jessica Lyons reports: Chinese state-sponsored spies have been spotted inside a global engineering firm's network, having gained initial entry using an admin portal's default credentials on an IBM AIX server. In an exclusive interview with The Register, Binary Defense's Director of Security Research John Dwyer said the cyber snoops first compromised one of the victim's three unmanaged AIX servers in March, and remained inside the US-headquartered manufacturer's IT environment for four months while poking around for more boxes to commandeer. It's a tale that should be a warning to those with long- or almost-forgotten machines connected to their networks; those with shadow IT deployments; and those with unmanaged equipment. While the rest of your environment is protected by whatever threat detection you have in place, these legacy services are perfect starting points for miscreants.

This particular company, which Dwyer declined to name, makes components for public and private aerospace organizations and other critical sectors, including oil and gas. The intrusion has been attributed to an unnamed People's Republic of China team, whose motivation appears to be espionage and blueprint theft. It's worth noting the Feds have issued multiple security alerts this year about Beijing's spy crews including APT40 and Volt Typhoon, which has been accused of burrowing into American networks in preparation for destructive cyberattacks.

After discovering China's agents within its network in August, the manufacturer alerted local and federal law enforcement agencies and worked with government cybersecurity officials on attribution and mitigation, we're told. Binary Defense was also called in to investigate. Before being caught and subsequently booted off the network, the Chinese intruders uploaded a web shell and established persistent access, thus giving them full, remote access to the IT network -- putting the spies in a prime position for potential intellectual property theft and supply-chain manipulation. If a compromised component makes it out of the supply chain and into machinery in production, whoever is using that equipment or vehicle will end up feeling the brunt when that component fails, goes rogue, or goes awry.

"The scary side of it is: With our supply chain, we have an assumed risk chain, where whoever is consuming the final product -- whether it is the government, the US Department of the Defense, school systems â" assumes all of the risks of all the interconnected pieces of the supply chain," Dwyer told The Register. Plus, he added, adversarial nations are well aware of this, "and the attacks continually seem to be shifting left." That is to say, attempts to meddle with products are happening earlier and earlier in the supply-chain pipeline, thus affecting more and more victims and being more deep-rooted in systems. Breaking into a classified network to steal designs or cause trouble is not super easy. "But can I get into a piece of the supply chain at a manufacturing center that isn't beholden to the same standards and accomplish my goals and objectives?" Dwyer asked. The answer, of course, is yes. [...]

Mozilla

Mozilla Exits the Fediverse, Will Shutter Its Mastodon Server In December (techcrunch.com) 62

Mozilla is exiting the fediverse by shutting down its Mozilla.social Mastodon server on December 17. Moving forward, the company will focus on Firefox and AI, aligning with its strategy under interim CEO Laura Chambers to scale back investments in non-core products. TechCrunch reports: Mozilla.social was a small instance, having only 270 active users at the time of Tuesday's announcement. By comparison, the most popular Mastodon instance, Mastodon.social, has over 247,500 monthly active users. Mozilla had telegraphed its plans to scale back on its fediverse investments earlier this year after the CEO stepped down. At the time, Mozilla board member Laura Chambers took over the job as the interim CEO of Mozilla Corporation through the end of 2024. Shortly after the change in leadership, Mozilla said it would refocus its product strategy around Firefox and AI and significantly scale back or even shutter other efforts. Among those products affected by the pullback were its VPN, Relay, and Online Footprint Scrubber, in addition to its Mastodon instance, the company said at the time. Meanwhile, its virtual world Hubs was shut down.

The redirection of Mozilla's efforts came after its flagship product, the Firefox web browser, spent years losing market share. That left room for other competitors, like the startup Arc, to take hold in the alternative browser market. Months prior to this change in strategy, Mozilla had been touting the fediverse's potential, but under Chambers, the company said that a more "modest approach" to the fediverse would have allowed it to participate with "greater agility." In an internal memo, Mozilla signaled that going forward, a "much smaller team" would participate in the Mastodon ecosystem. However, it didn't say at the time that the Mozilla.social instance would shut down, adding that it would continue to bring small experiments to those who participated on its instance.
Mozilla said it was a "hard decision."

"Thank you for being part of the Mozilla.social community and providing feedback during our closed beta. You can continue to use Mozilla.social until December 17," a post on Mastodon reads. Users can download their data or migrate their accounts at the respective links.
Encryption

Chrome Switching To NIST-Approved ML-KEM Quantum Encryption (bleepingcomputer.com) 52

Google is updating the post-quantum cryptography in Chrome, replacing the experimental Kyber with the fully standardized Module Lattice Key Encapsulation Mechanism (ML-KEM) to enhance protection against quantum computing attacks. BleepingComputer reports: This change comes roughly five months after Google rolled out the post-quantum secure TLS key encapsulation system on Chrome stable for all users, which also caused some problems with TLS exchanges. The move from Kyber to ML-KEM though is not related to those early problems, that got resolved soon after manifesting. Rather, its a strategic choice to abandon an experimental system for a NIST-approved and fully standardized mechanism.

ML-KEM was fully endorsed by the U.S. National Institute of Standards and Technology (NIST) in mid-August, with the agency publishing the complete technical specifications of the final version at the time. Google explains that despite the technical changes from Kyber to ML-KEM being minor, the two are essentially incompatible, so a switch had to be made. "The changes to the final version of ML-KEM make it incompatible with the previously deployed version of Kyber," explains Google. "As a result, the codepoint in TLS for hybrid post-quantum key exchange is changing from 0x6399 for Kyber768+X25519, to 0x11EC for ML-KEM768+X25519."

Businesses

Intel Plans To Turn Foundry Business Into Subsidiary, Allow For Outside Funding (cnbc.com) 24

Intel shares surged 8% after announcing plans to make its foundry business an independent unit with its own board and potential for outside capital, part of CEO Pat Gelsinger's strategy to restructure the company amid financial challenges. The company is also exploring the possibility of spinning off the foundry business, pausing some European manufacturing projects, and expanding its AI chip production partnership with Amazon Web Services to regain market share in the growing AI server chip industry. CNBC reports: As part of CEO Pat Gelsinger's effort to turn around the struggling chipmaker, Intel said in a memo to employees that it will also sell off part of its stake in Altera. Gelsinger said the restructuring would allow the foundry business to "evaluate independent sources of funding,â and comes days after Intel's board met to assess the direction and future of the company. The foundry business, which Intel plans to use to manufacture chips for other customers, has been a big drag on its bottom line, with the company spending roughly $25 billion on it in each of the last two years. Beyond just considering outside funding, Intel is weighing whether to spin off the foundry business, possibly into a separate publicly traded company, according to a person with knowledge of the matter who declined to be named in order to discuss confidential information. With a standalone "operating board" and a cleaner corporate structure, the mechanics of a separation become far easier than trying to turn a fully integrated unit into a separate company. [...] Intel will also pause its fabrication efforts in Poland and Germany "by approximately two years based on anticipated market demand," Gelsinger said, and pull back on its plans for its Malaysian factory. U.S. manufacturing projects will remain unaffected, the company said.

In addition to the foundry announcement, Intel said it entered into a deal with Amazon Web Services to produce custom chips for AI, extending a long-running partnership between the two companies. Amazon is a big customer of Intel chips to power its AWS servers, and will buy a custom Xeon processor from Intel as well, Intel said. The move will potentially give Intel a new foothold in the growing industry for AI server chips. While Intel has several products that can be used for AI, including Gaudi 3, Nvidia has largely taken control of the market. Amazon has been developing its own AI chips, including one called Trainium, for over five years. Microsoft and Google have also invested heavily in custom chips to run AI, aiming to offer less expensive processors than Nvidia's general-purpose graphics processing units. Intel said that it would carry out its most advanced manufacturing, including the AI chip for AWS, at its plant in Ohio that's currently under construction. "All eyes will remain on us," Gelsinger said. "We need to fight for every inch and execute better than ever before. Because that's the only way to quiet our critics and deliver the results we know we're capable of achieving."

Games

Original 'Flappy Bird' Creator Disavows New Version - and Its Possible Crypto Ties (forbes.com) 28

Flappy Bird's original creator hasn't posted anything on social media since 2017. Until today.

"This morning, the game's creator Dong Nguyen posted a characteristically terse comment stating that he has nothing to do with the revival," reports TechCrunch, "and that he 'did not sell anything.' He added, 'I also don't support crypto'... The post makes it clear that Nguyen is not involved with the new project, and that he doesn't seem particularly happy about it." As for Nguyen's reference to crypto, while the foundation's current PR materials don't mention anything crypto-related, Varun Biniwale did some digging around hidden pages on the Flappy Bird Foundation website and found a reference to Flappy Bird flying "higher than ever on Solana as it soars into Web 3.0," though it's not clear whether that refers to upcoming features or abandoned plans.
More from Fortune: Exactly what is going to happen with this zombified version of Flappy Bird is unclear, but digging through data and files has revealed things like different birds, loot boxes, and the idea that this is some sort of crypto play by the company involved. From a page on their website about the new Flappy Bird... "[D]evelopers and creators can build, play and earn from the legendary Flappy Bird IP."
Fortune concludes "it's crypto, it's NFTs and everyone is so annoyed by this almost every tweet of the resurrected Twitter account has even been 'Community Noted' revealing its crypto ties and snapping up of Nguyen's trademark."

PC Gamer adds that the Foundation acquired the Flappy Bird trademark from Gametech Holdings LLC. "And here there's a slight whiff of skullduggery." Dong Nguyen originally applied for the trademark in 2014, alongside a little drawing of the logo. This application then seemed to sit in limbo for many years, eventually being opposed by a Delaware-based company called Gametech. As this was going on, the U.S. patent office granted a trademark registration for Flappy Bird in 2018 (four years after the game was removed from sale) to another Delaware company called Mobile Media Matters. While I can't be exact on the link between Mobile Media Matters and Gametech, both companies' legal filings give the same Delaware address.

Subsequent to this there's been a legal disagreement between Gametech and Dong Nguyen, except Nguyen doesn't seem to have bothered representing himself or standing up for the trademark, which has ultimately led to it being classed as abandoned (a decade after he filed for it) and acquired by Gametech...

The Flappy Bird Foundation does have one ready-made comeback. As well as the rights to Flappy Bird it has acquired the rights to Piou Piou vs. Cactus, a mobile title that was the primary inspiration behind Flappy Bird, and employs the game's creator who goes by the handle, ahem, of Kek. "Today is a milestone not just in gaming but for me personally," says Kek. "It's so cool to see how influential Piou Piou has been for developers and hundreds of millions of gamers over the years. It's incredible to work alongside such a dedicated team of fans and creators who are truly passionate about changing the industry narrative and together bringing the original Flappy Bird back to life...." Way back in 2014, Kek said he'd contacted Nguyen about the resemblance, "and he told me he doesn't think he knew about my game when he made Flappy Bird. The games are very similar. And even if I did not invent the gameplay concept, the graphics are very close, and, of course, the concept."

The games are undeniably similar, but there are differences, and obviously the most important one is that, for whatever reason, Piou Piou didn't do much while Flappy Bird went stratospheric with a similar idea three years later.

Needless to say, the announcement and press release of the Flappy Bird Foundation does not mention Dong Nguyen once.

AI

How Amazon's Secret Weapon in Chip Design is Amazon (ieee.org) 18

In 2015 Amazon purchased chip designer Annapurna Labs, remembers IEEE Spectrum, "and proceeded to design CPUs, AI accelerators, servers, and data centers as a vertically-integrated operation."

The article argues that while AMD, Nvidia, and other big-name processor companies may also want to control the full stack (purchasing server, software, and interconnect companies) — Amazon Web Services "got there ahead of most of the competition." (IEEE Spectrum interviews Ali Saidi, technical lead for the AWS Graviton series of CPUs, and Rami Sinno, director of engineering at Annapurna Labs, on "the advantage of vertically-integrated design — and Amazon-scale...") Sinno: I was working at Arm, and I was looking for the next adventure, looking at where the industry is heading and what I want my legacy to be. I looked at two things: One is vertically integrated companies, because this is where most of the innovation is — the interesting stuff is happening when you control the full hardware and software stack and deliver directly to customers.

And the second thing is, I realized that machine learning, AI in general, is going to be very, very big. I didn't know exactly which direction it was going to take, but I knew that there is something that is going to be generational, and I wanted to be part of that. I already had that experience prior when I was part of the group that was building the chips that go into the Blackberries; that was a fundamental shift in the industry. That feeling was incredible, to be part of something so big, so fundamental. And I thought, "Okay, I have another chance to be part of something fundamental."

[...] At the end of the day, our responsibility is to deliver complete servers in the data center directly for our customers. And if you think from that perspective, you'll be able to optimize and innovate across the full stack. It might not be at the transistor level or at the substrate level or at the board level. It could be something completely different. It could be purely software. And having that knowledge, having that visibility, will allow the engineers to be significantly more productive and delivery to the customer significantly faster. We're not going to bang our head against the wall to optimize the transistor where three lines of code downstream will solve these problems, right...?

We've had very good luck with recent college grads. Recent college grads, especially the past couple of years, have been absolutely phenomenal. I'm very, very pleased with the way that the education system is graduating the engineers and the computer scientists that are interested in the type of jobs that we have for them.

It's an interesting glimpse into the unique world of designing chips at Amazon.

Graviton technical lead Saidi: I've been here about seven and a half years. When I joined AWS, I joined a secret project at the time. I was told: "We're going to build some Arm servers. Tell no one...

"In chip design, there are many different competing optimization points. You have all of these conflicting requirements, you have cost, you have scheduling, you've got power consumption, you've got size, what DRAM technologies are available and when you're going to intersect them... It ends up being this fun, multifaceted optimization problem to figure out what's the best thing that you can build in a timeframe. And you need to get it right."
Security

1.3 Million Android-Based TV Boxes Backdoored; Researchers Still Don't Know How (arstechnica.com) 28

An anonymous reader quotes a report from Ars Technica: Researchers still don't know the cause of a recently discovered malware infection affecting almost 1.3 million streaming devices running an open source version of Android in almost 200 countries. Security firm Doctor Web reported Thursday that malware named Android.Vo1d has backdoored the Android-based boxes by putting malicious components in their system storage area, where they can be updated with additional malware at any time by command-and-control servers. Google representatives said the infected devices are running operating systems based on the Android Open Source Project, a version overseen by Google but distinct from Android TV, a proprietary version restricted to licensed device makers.

Although Doctor Web has a thorough understanding of Vo1d and the exceptional reach it has achieved, company researchers say they have yet to determine the attack vector that has led to the infections. "At the moment, the source of the TV boxes' backdoor infection remains unknown," Thursday's post stated. "One possible infection vector could be an attack by an intermediate malware that exploits operating system vulnerabilities to gain root privileges. Another possible vector could be the use of unofficial firmware versions with built-in root access." The following device models infected by Vo1d are: [R4, TV BOX, KJ-SMART4KVIP].

One possible cause of the infections is that the devices are running outdated versions that are vulnerable to exploits that remotely execute malicious code on them. Versions 7.1, 10.1, and 12.1, for example, were released in 2016, 2019, and 2022, respectively. What's more, Doctor Web said it's not unusual for budget device manufacturers to install older OS versions in streaming boxes and make them appear more attractive by passing them off as more up-to-date models. Further, while only licensed device makers are permitted to modify Google's AndroidTV, any device maker is free to make changes to open source versions. That leaves open the possibility that the devices were infected in the supply chain and were already compromised by the time they were purchased by the end user.
"These off-brand devices discovered to be infected were not Play Protect certified Android devices," Google said in a statement. "If a device isn't Play Protect certified, Google doesn't have a record of security and compatibility test results. Play Protect certified Android devices undergo extensive testing to ensure quality and user safety."

Users can confirm if their device runs Android TV OS via this link and following the steps here.
Japan

Japan Rethinks 24/7 Police Boxes With Rise of Cybercrime (nikkei.com) 12

Japan is overhauling how its ubiquitous 24-hour mini-police stations are operated nationwide as more crime fighting moves from the streets to the web. From a report: Called koban in Japanese, officers at these small police boxes handle a variety of tasks from responding to crime and patrolling neighborhoods to handling lost items. There are also chuzaisho outposts where police officers live full-time. The National Police Agency will update operational rules on Friday to allow some outposts to shut down at night if necessary. It will also allow greater flexibility on the use of mobile or temporary outposts, depending on local needs and staffing considerations.

Prefectural police will decide on changes involving specific outposts. Japan's koban system dates back to 1874 and is believed to have started operating around the clock in the 1880s. There were 6,215 kobans and 5,923 live-in outposts across Japan as of April. They have inspired countries like Singapore and Brazil to set up similar outposts focused on community policing. The change comes amid shifting crime patterns. Roughly 700,000 crime cases were reported in 2023, down more than 70% from the post-World War II peak in 2002. Street crime, like purse-snatching and car break-ins, were down around 80% to 240,000 cases. Instead, online and phone-based crimes, like impersonation scams and romance scams, are on the rise.

Slashdot Top Deals