Comcast has been embroiled in a legal battle since 2016 regarding potentially deceptive business practices surrounding its "Service Protection Plan" -- a $6 a month program which covered almost nothing. But as an amended complaint recently filed by the Washington state attorney general alleges, Comcast didn't just dupe customers, it may have signed them up for the plan without their knowledge. From a report: You might expect such a plan to, uh, protect the service a customer is paying for, by decreasing or eliminating the cost of repairs in the event something goes haywire. Not so! The fine print of the program excludes in-wall wiring and some outdoor wiring. This led the attorney general to conclude that the plan "simply covers the technician visiting the customer's house and declaring that the customer's equipment is broken."

A Chinese entrepreneur has been sentenced to five and a half years in prison for selling VPN service, a government newspaper said, as Beijing tries to stamp out use of technology that evades its internet filters. From a report: Wu Xiangyang was also fined 500,000 yuan ($75,900), an amount equal to his profits since starting the service in 2013, according to a report in the newspaper of China's national prosecutor's office. The Great Firewall, as the censorship apparatus is commonly known, means people in China are banned from visiting thousands of websites, including Google, Facebook, YouTube and Instagram. Wu ran his VPN service from 2013 until June this year and claimed to serve 8,000 foreign clients and 5,000 businesses.

An anonymous reader shares a report: The number of births in Japan this year has fallen to is lowest since records began more than a century ago with about 941,000 new babies, the health ministry said on Friday, proof if any were needed that it faces an ageing and shrinking population. The number of births will be about 4 percent lower than last year and the lowest since the government started compiling data in 1899, the ministry said.

Travis Jeffery, writing for HackerNoon: There's a security best practice where sign ins aren't supposed to say "password is incorrect." Instead they're supposed to say the "username or password is incorrect." This "best practice" is bullshit. Stripe's and GitHub's sign ins for example follow this practice. The idea is if an attacker knows a username, he or she could concentrate on that account using SQL injection, brute forcing the password, phishing, and so on. Here's the problem. All a hacker has to do is sign up to know whether the username is valid or not. Why bother then with obfuscating the sign in? Only the dumbest, laziest hacker is stopped by the "username or password is incorrect" sign in. You gain no security, yet your customers lose clarity. Stripe has their form submission behind reCAPTCHA to prevent naive scripts attacking their sign up. However this has been broken multiple times and likely won't ever be perfect. Even if reCAPTCHA was perfect, a hacker could manually validate their usernames of interest by trying to sign up, then automate an attack on the sign in page.

Europe is already struggling to absorb an influx of refugees from war-torn Syria, Afghanistan, Iraq, and Africa. Germany alone has taken in more than a million people since 2015. This wave of immigration has led to political upheaval, with the rise of right-wing political parties in Germany, Poland, Austria, and Hungary, among others. Now a new study, published in the journal Science, shows that the current surge in refugees may just be a preview of what's to come due in large part to global warming. From a report: At an average growing season temperature of about 68 Fahrenheit, which is the optimum one for agriculture, the number of applications for asylum was lowest. As the average temperature rose, so did the number of people from Somalia, Bangladesh and other warmer climate countries seeking asylum. But when cooler countries -- such as Serbia and Peru -- got warmer, fewer applications were received. The acceptance rate for asylum application to the EU is less than 10%. But when there was a spike in applications tied to weather fluctuations, the admittance rate rose to about 30%, suggesting agencies who evaluate the applicants find their cause worthy.

An anonymous reader shares a report: Wind power prices fell to its lowest and below the cheapest solar tariffs in the fourth round of auctions, putting more pressure on turbine makers as developers are expected to negotiate already-falling equipment prices. State-run Gujarat Urja Vikas Nigam Ltd. auctioned 500-megawatt of grid-connected projects at as low as Rs 2.43 (3.8 cents) a unit. That was quoted by Actis-backed Sprng Energy that bid for 197.5-megawatt capacity and KP Energy that won 30 MW. That's lower than the lowest solar power tariffs of Rs 2.44 a unit discovered in May and 8 percent lower than wind power prices discovered in earlier national auctions in October, according to Bloomberg New Energy Finance. A decline in auction tariffs will put the manufacturers under even more pressure to innovate and meet the price expectations of developers, Bloomberg New Energy Finance said. Falling tariffs may lead to discovery of even lower bids in the national wind auctions scheduled for January, it added. India aims to auction 28-gigawatt wind projects by March 2020 to take it closer to the total targeted capacity of 60 GW by 2022. That's part of the plan to install 175 GW renewable energy capacity by 2022.

The Associated Press: Russian television anchor Pavel Lobkov was in the studio getting ready for his show when jarring news flashed across his phone: Some of his most intimate messages had just been published to the web. Days earlier, the veteran journalist had come out live on air as HIV-positive, a taboo-breaking revelation that drew responses from hundreds of Russians fighting their own lonely struggles with the virus. Now he'd been hacked. The Associated Press found that Lobkov was targeted by the hacking group known as Fancy Bear in March 2015, nine months before his messages were leaked. He was one of at least 200 journalists, publishers and bloggers targeted by the group as early as mid-2014 and as recently as a few months ago. The AP identified journalists as the third-largest group on a hacking hit list obtained from cybersecurity firm Secureworks, after diplomatic personnel and U.S. Democrats. About 50 of the journalists worked at The New York Times. Another 50 were either foreign correspondents based in Moscow or Russian reporters like Lobkov who worked for independent news outlets. Others were prominent media figures in Ukraine, Moldova, the Baltics or Washington.

An anonymous reader shares a report: The NSA whistleblower and a team of collaborators have been working on a new open source Android app called Haven that you install on a spare smartphone, turning the device into a sort of sentry to watch over your laptop. Haven uses the smartphone's many sensors -- microphone, motion detector, light detector, and cameras -- to monitor the room for changes, and it logs everything it notices. The first public beta version of Haven has officially been released; it's available in the Play Store and on F-Droid, an open source app store for Android.

An anonymous reader quotes a report from Apple Insider: A day after Apple acknowledged slowing down iPhones with degraded batteries, a Los Angeles man is pursuing a class action lawsuit in the matter. Owners didn't agree to the prospect, and it hurts the devices' value, according to a filing by plaintiff Stefan Bodganovich, cited by TMZ. The case is said to be particularly concerned with the impact on iPhone 7 users. The suit asks that Apple stop throttling older devices, and pay compensation to affected people. Over the course of December, a number of people on Reddit and elsewhere have speculated that iPhones perform faster after battery replacements, mostly citing anecdotal evidence. Apple effectively confirmed that situation on Wednesday, but with the provision that it only throttles phones to prevent sudden, potentially damaging shutdowns. UPDATE: A second lawsuit has been filed against the company. Chicago Sun-Times reports "five customers have filed a federal lawsuit in Chicago against the tech giant for what they're calling 'deceptive, immoral and unethical' practices that violate consumer protection laws."

Mozilla has announced that its Firefox web browser is now available on all Fire TV devices. While navigating web browsers on televisions isn't the most user-friendly experience, it could be the only way users can access YouTube. Earlier this month, Google pulled YouTube off the Fire TV and Echo Show since Amazon stopped selling several Google products. TechRadar reports: Though there's no explicit 'hey, this is a convenient workaround' section in Mozilla's announcement of the news, there is a section of the blog post which states that users can "go to YouTube and other sites directly from the Firefox for Fire TV home screen" and another which promises access to videos from "YouTube and other popular sites." While the companies are currently in talks to resolve their disagreements, Google's threat to pull YouTube access from the Fire TV line on January 1, 2018, is still hanging over Amazon. This threat is, however, now carries slightly less menace if Firefox browser access remains a workaround.

Eloking quotes a report from New Atlas: SpaceX's Falcon Heavy rocket has been a long time coming. The successor to its Falcon 9 and the vehicle hoped to carry humans to Mars, this booster will be one of the most powerful ever. And we've just gotten our best look at it yet, with CEO Elon Musk tweeting out photos of an almost complete Falcon 9 Heavy in the hangar ahead of a planned maiden launch next month. The Falcon Heavy is essentially three Falcon 9 first stages rolled into one, with a second stage sat atop the middle one. The nine engine cores in each first stage work together to provide thrust equal to eighteen 747 aircraft, making it the most powerful rocket currently in operation and the most powerful since the Saturn V rocket last lifted off in 1973. In a series of tweets, Musk revealed that when the Falcon Heavy does lift off for the first time, it will do so from the same pad used by the Saturn V rocket at NASA's Kennedy Space Center. Musk has said recently that the Falcon Heavy will carry his own cherry-red Tesla Roadster as its first payload, but as an earlier tweet professing his love for floors has shown, it's not always easy to tell how serious he is about such matters.

An anonymous reader quotes a report from CleanTechnica: Every year, the California Energy Commission releases its Renewable Portfolio Standard (RPS) report, which gives details about the mix of energy experienced by all utilities within the state during the preceding 12 months. The report for this year, released in November, shows that all three of the state's investor-owned utilities -- Pacific Gas & Electric, Southern California Edison, and San Diego Gas & Electric -- are projected to derive 50% of their electricity from renewable sources by 2020. That is a full decade ahead of schedule. PG&E reports it used 32.9% renewable energy in the past year. The figure for SoCal Edison was 28.2%. San Diego Gas & Electric led the pack with 43.2% renewable energy. Now that the 50% goal is within reach, California is looking ahead to its next milestone -- 80% renewables by 2050. "Once we get to about 50 percent, we're going to start to run into new challenges -- the second 50 percent will be trickier than the first 50 percent," Brown notes. Part of the challenge will be balancing the grid using new technologies to avoid the need for fossil fueled "peaker plants" to provide additional electricity when demand is high.

The controversial ripping tool AnyDVD has released a new beta version that allows users to decrypt and copy UHD Blu-Ray discs. The software makes use of the leaked keys that came out recently and appears to work well. Meanwhile, disc drive manufacturers are patching security holes. TorrentFreak reports: This year there have been some major developments on this front. First, full copies of UHD discs started to leak online, later followed by dozens of AACS 2.0 keys. Technically speaking AACS 2.0 is not confirmed to be defeated yet, but many discs can now be ripped. This week a popular name jumped onto the UHD Blu-Ray bandwagon. In its latest beta release, AnyDVD now supports the format, relying on the leaked keys. "New (UHD Blu-ray): Fetch AACS keys from external file for use with 'UHD-friendly' drives," the release notes read. The involvement of AnyDVD is significant because it previously came under legal pressure from decryption licensing outfit AACS LA. This caused former parent company Slysoft to shut down last year, but the software later reappeared under new management. Based on reports from several AnyDVD users, the UHD ripping works well for most people. Some even claim that it's faster than the free alternative, MakeMKV.

David Crow, reporting for the Financial Times: A US drugmaker is charging almost $300 for a bottle of prescription vitamins that can be bought online for less than $5, in the latest attempt at price gouging in the world's largest healthcare market. Avondale Pharmaceuticals raised the price of Niacor, a prescription-only version of niacin, by 809 per cent last month, taking a bottle of 100 tablets from $32.46 to $295 (Editor's note: the link may be paywalled; alternative source), according to figures seen by the Financial Times. Although niacin, a type of vitamin B3, is available in over-the-counter forms for less than $5 per 100 tablets, some doctors still prefer to use the version approved by the US Food and Drug Administration to treat high cholesterol. Avondale, a secretive Alabama-based company, put the price of Niacor up shortly after acquiring the rights to the medicine in a so-called "buy-and-raise" deal -- a strategy made famous by Martin Shkreli, the disgraced biotech entrepreneur.

Apple has revised the guidelines for its App Store, including a provision that loot boxes must be transparent about their odds. "Apps offering 'loot boxes' or other mechanisms that provide randomized virtual items for purchase must disclose the odds of receiving each type of item to customers prior to purchase," reads the new rule, which will affect the most popular games on iOS, including Hearthstone, The Simpsons Tapped Out, and Clash Royale. Kotaku reports: Loot boxes, which have always been common in the world of iOS gaming, are virtual grab bags that can give players a host of items ranging from common to rare. Most of the time, you can buy these loot boxes not just for in-game currency but for real money, which has led some players to classify them as gambling -- a label that the Entertainment Software Rating Board doesn't acknowledge. As rage over these practices gets louder and louder, Apple's move is the first of what may be many steps that game publishers and distributors voluntarily take in an attempt to avoid regulation from outside bodies.