"We recently published a number of updates to our licensing materials," the Free Software Foundation announced Thursday, adding that "While we generally post individual announcements for these types of important changes, there were so many in such a short span that we needed to combine them all in one place." We added the Commons Clause to our list of nonfree licenses. Not a stand-alone license in and of itself, it is meant to be added to an existing free license to prevent using the work commercially, rendering the work nonfree. It's particularly nasty given that the name, and the fact that it is attached to pre-existing free licenses, may make it seem as if the work is still free software.

If a previously existing project that was under a free license adds the Commons Clause, users should work to fork that program and continue using it under the free license. If it isn't worth forking, users should simply avoid the package. We are glad to see that in the case of Redis modules using the Commons Clause, people are stepping up to maintain free versions.
There's also a new addition to their GNU Licenses FAQ which explains what the GNU GPL says about translating code into another programming language. ("If the original program carries a free license, that license gives permission to translate it. How you can use and license the translated program is determined by that license. If the original program is licensed under certain versions of the GNU GPL, the translated program must be covered by the same versions of the GNU GPL...") And they've also clarified how to handle projects that combine code under multiple compatible licenses.

The FSF has also updated a document commenting on various licenses, clarifying that the Fraunhofer FDK AAC free software license "is incompatible with any version of the GNU GPL. It has a special danger in the form of a term expressly stating it does not grant you any patent licenses, with an enticement to buy some.

"Because of this, and because the license author is a known patent aggressor, we encourage you to be careful about using or redistributing any software under this license..."

"It's the biggest chess event of the year as World Champion Magnus Carlsen will try to defend his title against the American challenger Fabiano Caruana," reports Chess.com -- which is webcasting game two right now (7 a.m. PST, 3 p.m. London/GMT).

After seven grueling hours and 115 moves on Friday, the first game of their 12-game competition ended in a draw -- though challenger Caruana acknowledged that "I was quite fortunate to end up with a draw... I was outplayed after the opening... I think I was clearly losing, for a long time I was losing." This was not the most pleasant experience to defend this extremely long game with white. I think I was quite fortunate to end up with a draw... There was definitely a lot of nerves. It is a very different feeling playing the first game of a world championship match.... Normally with white you shouldn't be too happy with a draw, but considering my position I am very happy. I am relieved to have escaped."
Slate reports Caruana has spent $50,000 on chess coaching just in 2018 in hopes of claiming the 1 million euro prize. Ironically, the match's "ceremonial starter", actor Woody Harrelson, bungled Caruana's first move by knocking over his king -- and then by moving the wrong pawn. "Caruana was ready to accept the mistake and continue with the match before officials gave Harrelson a third chance and he finally moved the correct piece."

Defending champion Magnus Carlsen later admitted that "I couldn't quite find the knockout before the time trouble.... I tried to find a way to exchange in order to play for a win, but I couldn't find it. Then I just moved around hoping to force a blunder, but I didn't succeed."

An anonymous reader quotes a report from Motherboard: This week, U.S. Cyber Command (CYBERCOM), a part of the military tasked with hacking and cybersecurity focused missions, started publicly releasing unclassified samples of adversaries' malware it has discovered. CYBERCOM says the move is to improve information sharing among the cybersecurity community, but in some ways it could be seen as a signal to those who hack U.S. systems: we may release your tools to the wider world. On Friday, CYBERCOM uploaded multiple files to VirusTotal, a Google-owned search engine and repository for malware. Once uploaded, VirusTotal users can download the malware, see which anti-virus or cybersecurity products likely detect it, and see links to other pieces of malicious code.

One of the two samples CYBERCOM distributed on Friday is marked as coming from APT28, a Russian government-linked hacking group, by several different cybersecurity firms, according to VirusTotal. Those include Kaspersky Lab, Symantec, and Crowdstrike, among others. APT28 is also known as Sofacy and Fancy Bear. The malware itself does not appear to still be active.

Microsoft has released a free AV1 video codec for Windows 10 devices that's available via the Microsoft Store.

"Play AV1 videos on your Windows 10 device. This extension is an early beta version of the AV1 software decoder that lets you play videos that have been encoded using the AV1 video coding standard developed by the Alliance for Open Media," the company says. "Since this is an early release, you might see some performance issues when playing AV1 videos. We're continuing to improve this extension. If you allow apps to be updated automatically, you should get the latest updates and improvements when we release them." Softpedia reports: Oddly enough, the codec can only be installed on devices running Windows 10 October 2018 Update, which is no longer up for grabs after Microsoft pulled it last month. It remains to be seen how often Microsoft updates the codec in the coming months, but I've already tried it out for a test earlier today and the initial release seems to be running just fine. You can install the codec from the Microsoft Store to be notified when new versions are out, and make sure you report any potential issues to Microsoft for more bug fixes.

iFixit has released their teardown of the new Mac mini, providing a look inside the portable desktop computer. Some of the notable findings include user-upgradable RAM and soldered CPU and SSD. Mac Rumors reports: While the RAM in the previous-gen Mac mini from 2014 was soldered to the logic board, the new Mac mini has user-upgradeable RAM, as discovered earlier this week. As seen in older iMacs, the RAM is protected by a perforated shield that allows the memory modules to operate at a high frequency of 2666 MHz without interfering with other device functions, according to iFixit. To upgrade the RAM, the shield can be removed by unfastening four Torx screws.

Other silicon on the logic board of this particular Mac mini includes the Apple T2 security chip, a 3.6GHz quad-core Intel Core i3 processor, Intel UHD Graphics 630, 128GB of flash storage from Toshiba, an Intel JHL7540 Thunderbolt 3 controller, and a Gigabit Ethernet controller from Broadcom. Despite the good news about the RAM, the CPU and SSD are soldered to the logic board, as are many ports, so this isn't a truly modular Mac mini. iFixit awarded the new Mac mini a repairability score of 6/10, with 10 being the easiest to repair, topping the latest MacBook Air, MacBook, MacBook Pro, iMac, and iMac Pro, and trailing only the 2013 Mac Pro.

An anonymous reader quotes a report from Bloomberg: Amazon.com Inc. has taken another step toward eliminating software from Oracle Corp. that has long helped the e-commerce giant run its retail business. An executive with Amazon's cloud-computing unit hit back at Oracle Executive Chairman Larry Ellison, who ridiculed the internet giant as recently as last month for relying on Oracle databases to track transactions and store information, even though Amazon sells competing software, including Redshift, Aurora and DynamoDB. Amazon's effort to end its use of Oracle's products has made new progress, Andy Jassy, the chief executive officer of Amazon Web Services, tweeted Friday. "In latest episode of 'uh huh, keep talkin' Larry,' Amazon's Consumer business turned off its Oracle data warehouse Nov. 1 and moved to Redshift," Jassy wrote. By the end of 2018, Amazon will stop using 88 percent of its Oracle databases, including 97 percent of its mission-critical databases, he added.

According to federal contracting documents, the U.S. Drug Enforcement Administration (DEA) and Immigration and Customs Enforcement (ICE) have hidden an undisclosed number of covert surveillance cameras inside streetlights around the country. Quartz reports: According to government procurement data, the DEA has paid a Houston, Texas company called Cowboy Streetlight Concealments LLC roughly $22,000 since June 2018 for "video recording and reproducing equipment." ICE paid out about $28,000 to Cowboy Streetlight Concealments over the same period of time. It's unclear where the DEA and ICE streetlight cameras have been installed, or where the next deployments will take place. ICE offices in Dallas, Houston, and San Antonio have provided funding for recent acquisitions from Cowboy Streetlight Concealments; the DEA's most recent purchases were funded by the agency's Office of Investigative Technology, which is located in Lorton, Virginia. "We do streetlight concealments and camera enclosures," Christie Crawford, who owns Cowboy Streetlight Concealments with her husband, told Quartz. "Basically, there's businesses out there that will build concealments for the government and that's what we do. They specify what's best for them, and we make it. And that's about all I can probably say."

dmoberhaus writes: Perceptual ad blockers were supposed to be the "superweapon" that put an end to the arms race between advertisers and users. According to new research, however, perceptual ad blockers will come out on the losing side in the war against internet advertisers and expose users to a host of new attack vectors in the process. Researchers at Stanford tricked six different visual classifiers used in perceptual ad blockers with adversarial ads designed to trick the ad blockers by making nearly imperceptible changes to the ads. "The researchers tried several different adversarial attacks on the perceptual ad blockers' visual classifiers," Motherboard reports. "One attack, for example, slightly altered the AdChoices logo that is commonly used to disclose advertisements to fool the perceptual ad blocker. In another attack, the researchers demonstrated how website publishers could overlay a transparent mask over a website that would allow ads to evade perceptual ad blockers."

"The aim of our work is not to downplay the merits of ad-blocking, nor discredit the perceptual ad blocking philosophy, which is sound when instantiated with a robust visual ad detector," the researchers concluded. "Rather, our overarching goal is to highlight and raise awareness on the vulnerabilities that arise in building ad blockers with current computer vision systems."

Prima Games, the publishing company that has printed video game strategy guides since it was founded in 1990, is shutting down. "The label will no longer publish new guides starting now, and it will officially shutter in the spring," reports Kotaku. From the report: Thanks to the rise of sites like GameFAQs -- and major gaming publications like IGN commissioning their own online guides, which bring in monstrous amounts of traffic -- print strategy guides have struggled for years now. In 2015, Prima purchased and swallowed its biggest competitor, BradyGames, and has been consistently churning out guides for both print and the web, but it wasn't enough to survive what the company called "a significant decline" in the world of print video game guides.

An anonymous reader quotes a report from CNBC: Facebook on Friday became the latest tech company to end a policy of requiring employees to settle claims of sexual harassment through private arbitration, according to a report by the Wall Street Journal. It will now allow employees to take these types of claims to court. Tech companies have long used arbitration as a method for handling instances of sexual harassment to prevent employees from suing them in court, but that's starting to change. Facebook's move comes shortly after a similar move this week by Google, which came after thousands of its employees walked out in protest last week over its handling of sexual harassment complaints. Additionally, Facebook changed its policy on office dating and will now require employees who are director level or higher to disclose if they are dating a colleague, the report said. Previously, the company only required disclosure if an employee was dating someone they supervised, according to the report.

Google is working with The New York Times to digitize its huge collection of about 7 million historic images. The pictures are apparently kept in the newspaper's "morgue," which contains pictures going back to the 19th century, many of which exist nowhere else in the world. The Verge reports: That's why the company has hired Google, which will use its machine vision smarts to not only scan the hand- and type-written notes attached to each image, but categorize the semantic information they contain (linking data like locations and dates). Google says the Times will also be able to use its object recognition tools to extract even more information from the photos, making them easier to catalog and resurface for future use.

Late last month, HealthCare.gov suffered a data breach exposing 75,000 customers. Details were sparse at the time of the breach, but have now learned that hackers obtained "inappropriate access" to a number of broker and agent accounts, which "engaged in excessive searching" of the government's healthcare marketplace systems. TechCrunch reports: [The Centers for Medicare and Medicaid Services (CMS)] didn't say how the attackers gained access to the accounts, but said it shut off the affected accounts "immediately." In a letter sent to affected customers this week (and buried on the Healthcare.gov website), CMS disclosed that sensitive personal data -- including partial Social Security numbers, immigration status and some tax information -- may have been taken. According to the letter, the data included name, date of birth, address, sex, and the last four digits of the Social Security number (SSN), if SSN was provided on the application. Other information could include expected income, tax filing status, family relationships, whether the applicant is a citizen or an immigrant, immigration document types and numbers, employer name, pregnancy status, health insurance status, and more. The government did say that no bank account information was stolen.

An anonymous reader quotes a report from Recode: To dozens of cities across the United States, Amazon's widely publicized search for a "second headquarters" looked like thousands of new jobs, up for grabs. To Pivot co-host Scott Galloway, it now looks like a "ruse." "I lease office space all the time for my businesses and I always tell my real estate agent, 'We can lease any office in the world as long as I can walk there from where I live,'" Galloway said on the latest episode. "Amazon is now talking about having three headquarters, Seattle, Crystal City and Long Island City. The Bezos's also own three homes, and the average distance from those three homes to a headquarters is 6.4 miles.

"This was never a contest," he added. "It was a con meant to induce ridiculous terms that they then took to the cites all along that they knew they were going to be in." In other words: By soliciting bids from lots of place where it was never going to move, Galloway alleges, Amazon was probably able to get more tax breaks from the pre-determined "winners." "I would bet, Kara, that when they pick two cities and they went to 2 and 3, they didn't say, 'Well, only half our headquarters is going there, so we're going to let you cut the tax subsidies and incentives in half,'" he explained. "This just has ill will written all over it, and I think people started to figure out what was going on ... It's the Olympics on steroids. A lot of high fives and ribbon cutting, and then 10 years later, we realize it was a bad idea."

A vacuum giant may be looking to hoover up some of the wearable tech market. From a report: Dyson is considering making a wearable air purifier that could double as headphones, according to Bloomberg, which reported the company submitted patents for wearable air-purifying tech earlier this year. Air purifiers are popular in Asia, especially in China where atmospheric pollution is a serious issue. Air purifiers remove pollutants through filtration, electrostatic precipitation or ionization. Many Chinese citizens also wear face masks when they go outside to avoid inhaling air pollution.

China has violated an accord it signed with the U.S. three years ago pledging not to engage in hacking for the purpose of economic espionage, a senior U.S. intelligence official said this week. From a report: The 2015 bilateral agreement had significantly reduced the amount of Chinese cybertheft targeting American companies, but Beijing's commitment to the deal has eroded, said Rob Joyce, senior adviser for cybersecurity strategy at the National Security Agency. "It is clear they are well beyond the bounds of the agreement today that was forged between our two countries," Joyce said during a panel conversation at the Aspen Cyber Summit.

Joyce's comments were the latest sign of Washington's rising frustration over China's alleged violation of the pact signed between then-President Barack Obama and Chinese President Xi Jinping. Last week, then-Attorney General Jeff Sessions also said China wasn't adhering to the deal, in which the U.S. and China agreed not to conduct cyber operations against each other to steal intellectual property or other forms of economic intelligence.