An anonymous reader writes: FitMetrix, a fitness technology and performance tracking company owned by gym booking giant Mindbody, has exposed millions of user records because it left several of its servers without a password. The company builds fitness tracking software for gyms and group classes -- like CrossFit and SoulCycle -- that displays heart rate and other fitness metric information for interactive workouts. FitMetrix was acquired by gym and wellness scheduling service Mindbody earlier this year for $15.3 million, according to a government filing. Last week, a security researcher found three FitMetrix unprotected servers leaking customer data. It isn't known how long the servers had been exposed, but the servers were indexed by Shodan, a search engine for open ports and databases, in September.

The servers included two of the same ElasticSearch instances and a storage server -- all hosted on Amazon Web Service -- yet none were protected by a password, allowing anyone who knew where to look to access the data on millions of users. Bob Diachenko, Hacken.io's director of cyber risk research, found the databases containing 113.5 million records -- though it's not known how many users were directly affected. Each record contained a user's name, gender, email address, phone numbers, profile photos, their primary workout location, emergency contacts and more. Many of the records were not fully complete.

Why is a receipt for cough drops the height of a small child? Rachel Sugar, writing for Vox: CVS is a drugstore much like other drugstores, with one important difference: The receipts are very long. How long are the receipts? For at least a decade, concerned shoppers have dedicated themselves to this question, producing a robust body of phone-picture literature on the subject. You could not major in CVS receipt studies, probably, but you could minor.

Not all CVS receipts are created equal. If you, a non-loyal shopper, mosey into CVS and buy some Tylenol and a package of seasonal candy, you will get a receipt that is unspectacular (read: a normal length). To get one of the iconically long CVS receipts, you need to use your ExtraCare card, which means you need to be an ExtraCare member. (You can join as long as you are willing to turn over your name and phone number in exchange for better deals.) People on the internet have documented this phenomenon with a vigor usually reserved for cats climbing in and out of boxes. On Twitter and on Instagram, shoppers stand next to their CVS receipts, which are often as tall as they are, and sometimes taller.

A Russian-American space crew have been forced to make an emergency landing in Kazakhstan after their Soyuz rocket suffered a failure shortly after launching from Russia's Baikonur cosmodrome in one of the most serious space incidents in recent years. From a report: The launch began as a routine affair. Missions bound for the International Space Station (ISS) have been conducted every few months for the past 20 years. But 119 seconds into Thursday's flight, mission controllers on the Nasa broadcast began to speak of a failure. Shaky footage from the capsule's cabin seen during the live broadcast appeared to show objects floating mid-launch. The crew told mission control they felt weightless, an indication of a problem during that stage of the flight. Agitated voices flooding the radio link between mission control and the capsule could be heard on the Nasa broadcast. Details and the exact sequence of events remain unclear, but shortly afterwards the crew initiated an abort and ejected their capsule from the rocket. Judging by the time at which the failure took place, it involved separation of the rocket's second stage -- just before the ship would have ignited the third stage for its final kick to exit the atmosphere. A commentator on Nasa's live broadcast later said that rescue teams had reached the capsule's landing site and the two-person crew were in "good condition."

An anonymous reader quotes a report from Quartz: Alphabet's driverless-car company Waymo announced a new milestone today (Oct. 10): its vehicles have driven a collective 10 million miles on U.S. roads. With cars in six states, Waymo has really been racking up the miles since April 2017, when it launched a program giving rides to passengers around the Phoenix, Arizona area. At that point, Waymo cars had driven not quite 3 million miles since the company's earliest days as a research project within Google in 2009. But in the last 18 months, the company more than tripled its road mileage.

Competing with other companies with autonomous-vehicle programs like Uber, Tesla, Apple, and GM's Cruise, Waymo is leading the pack in terms of road miles driven. [...] The company's next 10 million miles, CEO John Krafcik said in today's announcement, will focus on "striking the balance" between its safety-first algorithms and driving assertively in everyday maneuvers, like merging, and navigating bad weather. But it's worth keeping things in perspective: U.S. drivers rack up some 3 trillion miles each year, so Waymo still has some ground to cover.

The U.S. Air Force on Wednesday awarded funds to three rocket companies to help them complete development of their boosters. The three winners include:

United Launch Services: $967,000,000 for the development of the Vulcan Centaur launch system.
Northrop Grumman: $791,601,015 for development of the Omega launch system
Blue Origin: $500,000,000 for the development of the New Glenn launch system

The obvious company missing from the list is SpaceX, which did not win an award. Aerojet Rocketdyne also failed to win an award since it "does not appear to have a customer for its AR1 rocket engine, which the military initially supported," Ars Technica reports. From the report: These are hugely consequential awards for the rocket companies. Essentially the U.S. Air Force, which launches more complex, heavy payloads than any other entity in the world, believes these boosters will have a significant role to play in those missions during the next decade. And when the military has confidence in your vehicle, commercial satellite contracts are more likely to follow as well. After speaking with a couple of aerospace sources, Ars has a few theories as to why SpaceX didn't win an award: For one, SpaceX has already built and flown a rocket that can reach all of the Air Force's reference orbits -- the Falcon Heavy. Moreover, the Falcon Heavy is already certified for the Air Force and has won contracts. Air Force officials may also feel that, through NASA contracts for commercial cargo and crew, the government already facilitated development of the Falcon Heavy -- which uses three Falcon 9 rocket cores. It also depends upon what SpaceX bid for. The government would have been more inclined to fund development of an advanced upper stage for the Falcon Heavy or vertical integration facilities. But it seems like the military would not have been as interested in the Big Falcon Rocket, which is more booster than it deems necessary at this time. So if SpaceX bid the BFR, that is one possible explanation for no award.

Last November, Razer unveiled a smartphone designed for gamers who value performance and power over bells and whistles like waterproofing and wireless charging. At an event Wednesday night, Razer took the wraps off its successor, aptly named Razer Phone 2, which sports a brighter, notch-less, 5.72-inch IGZO LCD display with a 2560x1440 resolution and HDR, wireless charging, IP67 water- and dust-resistance rating, and RGB lighting behind the Razer logo on the rear. Given the addition of waterproofing and wireless charging, the Razer Phone 2 appears to be much more well-rounded than its predecessor, making the decision all the more difficult when shopping for a premium, high-end smartphone. AnandTech reports: This display is rated at 645 nits peak, up to 50% higher than the previous Razer Phone, and also supports HDR. Razer states that the display also has wide color gamut, which turns out to be 98.4% of DCI-P3. Also on the front, it has two front facing speakers in identical positions to the previous generation, and it has a front facing camera and sensor (albeit with swapped positions). That front camera is an 8MP f/2.0 unit, capable of recording at 1080p60, a user-requested feature for streaming and selfie recording. The front of the device is Corning Gorilla Glass 5, an upgrade from GG3 in the last generation.

When we move to the rear, things change much more noticeably. Instead of the aluminum rear, Razer has a full Gorilla Glass 5 back, which helps enable Qi Wireless Charging, a much requested feature. This is alongside QuickCharge 4+ through a Type-C cable. On the rear we have the dual cameras, this time placed in the center just above the logo. This time around Razer has gone with a 20MP Sony IMX363 f/1.75 main camera with OIS, and an 8MP Sony IMX 351 f/2.6 telephoto camera to enable some extra zoom functionality. Below the cameras is the Razer logo, which has a full 16.8million color RGB LED underneath which users can adjust through the onboard Chroma software. The Razer Phone 2 is still very much power-focused, as it features Qualcomm's latest Snapdragon 845 CPU with a "vapor chamber cooling" which can allow the phone to draw 20-30% more power than other flagships. There's 8GB of LPDDR4X memory, 64GB of UFS storage with support for a microSD card, and a whopping 4,000mAh. Razer says their new smartphone will be priced at $799 and will start shipping in mid-November.

An anonymous reader quotes a report from Gizmodo: Australian scientists have discovered a previously unknown chain of volcanic seamounts near Tasmania. The area appears to be brimming with marine life, including a surprising number of whales who may be using the undersea volcanoes as a navigational tool. The volcanic chain was discovered by scientists from the Australian National University and CSIRO, Australia's national science agency, while on a 25-day mission aboard the research vessel Investigator to conduct detailed seafloor maps of the region. The undersea volcanoes are about 250 miles (400 kilometers) east of Tasmania, and they're quite deep.

The tallest of the seamounts extends 3,000 meters (9,800 feet) from the seafloor, so they're not tiny. It's hard to believe that something so large has gone undetected for so long, but our oceans are notoriously understudied. A mere 20 percent of Earth's oceans has been explored, according to the National Oceanic and Atmospheric Administration. [T]he seamounts appeared to serve as a kind of mid-ocean oasis for a host of marine organisms. In addition to finding copious amounts of plankton in the area, the researchers observed various seabirds and a surprising number of whales. The volcanic seamounts, the researchers say, are likely important stopping points for migratory animals, particularly whales, who rely on seafloor structures for navigation. The volcanoes are likely serving as important signposts as the whales travel from their winter breeding areas to summer feeding grounds, the researchers say.

On Tuesday, Google announced the Google Home Hub, a 7-inch display that gives you visual information, making it easier to control smart home appliances and view photos and the weather. The unusual thing about it is that it doesn't run the smart display software that it introduced for third-party OEMs. Ars Technica explains: First, let's talk about what the third-party smart displays run. When Google created its smart display software, it also came up with a turnkey solution for OEMs. So far, we've seen Lenovo, LG, and Samsung's JBL all produce devices on the same basic platform. Just like with smartphones, these devices are all an extension of the Android/Qualcomm partnership -- they run Android Things on Qualcomm's SD624 Home Hub Platform. Android Things is Google's stripped-down version of Android that is purpose-built for IoT products, and the third-party smart displays are the first commercial devices to run the OS.

Unlike regular phone Android, Android Things is not customizable by third-parties. All Android Things devices use an OS image direct from Google, and Google centrally distributes updates to all Android Things devices for three years. Android Things doesn't really have an interface. It's designed to get a device up and running and show a single app, which on the smart displays is the Google Smart Display app. Qualcomm's "Home Hub" platform was purposely built to run Android Things and this Google Assistant software -- the SD624 is for smart displays, while the less powerful SDA212 is for speakers. When it came time to build the Google Home Hub, Google didn't use any of this. After talking to Google's VP of product management, Diya Jolly, Ars Technica's Ron Amadeo discovered that the Home Hub is actually built on Google's Cast platform and uses an Amlogic chip instead of Qualcomm's SD624 Home Hub Platform.

When asked why Google was using a totally different platform from the third parties, Jolly told Amadeo, "There's no particular reason. We just felt we could bring the experience to bear with Cast, and the experiences are the same. We would have easily given the third-parties Cast if they wanted it, but I think most developers are comfortable using Android Things." Amadeo seems to think it has to do with the low price, as it undercuts the cheapest third-party Google smart display (Lenovo's 8-inch model) by fifty bucks.

At the company's first developer conference, Magic Leap announced they are opening orders of the Magic Leap One Creator's Edition headset to the 48 contiguous states of the USA. If you're in Hawaii or Alaska, no dice. TechCrunch reports: Previously, you had to be in Chicago, LA, Miami, NYC, San Francisco or Seattle in order to get your hands on it. Also, if you had previously ordered the headset in one of those cities, someone would come to you, drop it off and get you set up personally. That service is expanding to 50 cities, but you also don't need to have someone set it up for you in order to buy one now. It's worth reiterating that this thing costs $2,295. The company is doing a financing plan with Affirm so that interested buyers can spread the cost of the device over 24 months.

An anonymous reader quotes a report from Bloomberg: Amazon is sweetening the pay for some of its longtime warehouse workers after employees criticized the loss of bonuses and stock awards as part of the company's pledge to boost all wages to at least $15 an hour. The world's largest online retailer grabbed headlines last week with its minimum-pay pledge -- followed by concerns from veteran workers who feared their compensation would actually decline because the company also eliminated bonuses and stock awards. Amazon said any workers already earning $15 would get raises of $1 per hour. Now, some of those employees are learning their hourly raises will actually be $1.25 an hour. Additionally, Amazon is introducing a new cash bonus of $1,500 to $3,000 for tenure milestones at five, 10, 15 and 20 years. Workers with good attendance in the month of December will also get a $100 bonus, according to the company. "All hourly Operations and Customer Service employees will see an increase in their total compensation as a result of this announcement," Amazon said in a statement. "The significant increase in hourly cash wages effective Nov. 1 more than compensates for the phase out of incentive pay and future (stock) grants."

Japanese retailer Uniqlo in Tokyo's Ariake district has managed to cut 90% of its staff and replace them with robots that are capable of inspecting and sorting the clothing housed there. The automation also allows them to operate 24 hours a day. Quartz reports: The company recently remodeled the existing warehouse with an automated system created in partnership with Daifuku, a provider of material handling systems. Now that the system is running, the company revealed during a walkthrough of the new facility, Uniqlo has been able to cut staff at the warehouse by 90%. The Japan News described how the automation works: "The robotic system is designed to transfer products delivered to the warehouse by truck, read electronic tags attached to the products and confirm their stock numbers and other information. When shipping, the system wraps products placed on a conveyor belt in cardboard and attaches labels to them. Only a small portion of work at the warehouse needs to be done by employees, the company said."

The Tokyo warehouse is just a first step in a larger plan for Uniqlo's parent company, Fast Retailing. It has announced a strategic partnership with Daifuku with the goal of automating all Fast Retailing's brand warehouses in Japan and overseas. Uniqlo plans to invest 100 billion yen (about $887 million) in the project over an unspecified timeframe. (The Japan News reported that it costs about 1 billion to 10 billion yen to automate an existing warehouse.) Uniqlo believes the system will help it minimize storage costs and, importantly, deliver products faster around the world. The company has set a target of 3 trillion yen (about $26.6 billion) in annual revenue. Last year its revenue was about 1.86 trillion yen (pdf).

21st Century Fox CEO James Murdoch is the lead candidate to replace Elon Musk as Tesla chairman, the Financial Times reported today. The company has until November 13 to appoint an independent chairman of the board, part of settlements reached last month between Tesla, Musk and U.S. regulators in the wake of Musk tweeting in August that he had secured funding to take the company private. Reuters reports: The U.S. Securities and Exchange Commission, which said the statement was fraudulent, allowed the billionaire to retain his role as CEO while stripping him of his chairmanship and imposing a penalty of $20 million on each party. Murdoch, who is a nonexecutive director of Tesla, has signaled he wants the job, the report said. The son of Fox mogul Rupert Murdoch, he joined Tesla's board in July 2017 after years of work with media companies. He has no experience in manufacturing and has never led a company that makes cars or electric vehicles.

Murdoch currently serves on the boards of 21st Century Fox and News Corp. He stepped down from the board of Sky Plc on Tuesday following the completion of Comcast Corp's takeover of the broadcaster. Glass Lewis research director Courteney Keatinge said in a telephone interview on Wednesday that while Murdoch's departure from Sky could alleviate some concerns, the Tesla chairmanship would still require a big time commitment as the company faces pressures on many fronts. Update: In a tweet late Wednesday, Musk said Financial Times' report was inaccurate.

An anonymous reader quotes a report from The Verge: For months, Google has been trying to stay out of the way of the growing tech backlash, but yesterday, the dam finally broke with news of a bug in the rarely used Google+ network that exposed private information for as many as 500,000 users. Google found and fixed the bug back in March, around the same time the Cambridge Analytica story was heating up in earnest. [...] The vulnerability itself seems to have been relatively small in scope. The heart of the problem was a specific developer API that could be used to see non-public information. But crucially, there's no evidence that it actually was used to see private data, and given the thin user base, it's not clear how much non-public data there really was to see. The API was theoretically accessible to anyone who asked, but only 432 people actually applied for access (again, it's Google+), so it's plausible that none of them ever thought of using it this way.

The bigger problem for Google isn't the crime, but the cover-up. The vulnerability was fixed in March, but Google didn't come clean until seven months later when The Wall Street Journal got hold of some of the memos discussing the bug. [...] Part of the disconnect comes from the fact that, legally, Google is in the clear. There are lots of laws about reporting breaches -- primarily the GDPR but also a string of state-level bills -- but by that standard, what happened to Google+ wasn't technically a breach. Those laws are concerned with unauthorized access to user information, codifying the basic idea that if someone steals your credit card or phone number, you have a right to know about it. But Google just found that data was available to developers, not that any data was actually taken. With no clear data stolen, Google had no legal reporting requirements. As far as the lawyers were concerned, it wasn't a breach, and quietly fixing the problem was good enough.

Today, Mozilla, along with Omidyar Network, Schmidt Futures, and Craig Newmark Philanthropies, is launching a competition for professors and educators to effectively integrate ethics into computer science education at the undergraduate level. From a report: The context, called the Responsible Computer Science Challenge, will award up to $3.5 million over the next two years to proposals focused on how to make ethics relevant to young technologists. "You can't take an ethics course from 50 or even 25 years ago and drop it in the middle of a computer science program and expect it to grab people or be particularly applicable," Mitchell Baker, the founder and chairwoman of the Mozilla Foundation, said. "We are looking to encourage ways of teaching ethics that make sense in a computer science program, that make sense today, and that make sense in understanding questions of data."