Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Submission + - SPAM: DC Sues Grubhub, Claiming App Is Full of Hidden Fees and High Prices

An anonymous reader writes: District of Columbia Attorney General Karl Racine is suing Grubhub for deceptive business practices, saying its food delivery app covertly inflates prices for diners who order through it. The suit demands an end to a laundry list of allegedly illegal practices as well as financial restitution and civil penalties. The newly filed lawsuit (PDF) argues that Grubhub’s promises of “free” online orders — and “unlimited free delivery” for Grubhub Plus — are misleading. While customers can make pickup orders for free, the company charges delivery and service fees for standard orders and service fees for Grubhub Plus orders, displaying the service fee until recently as part of a single line with sales taxes. “Grubhub misled District residents and took advantage of local restaurants to boost its own profits, even as District consumers and small businesses struggled during the COVID-19 pandemic,” said Racine in a statement. “Grubhub charged hidden fees and used bait-and-switch advertising tactics — which are illegal.”

The complaint says Grubhub orders often cost more than ordering the same item at a restaurant and argues that the company fails to reasonably disclose this to consumers. “Because Grubhub already charges consumers several different types of fees for its services ... consumers expect that the menu prices listed on Grubhub are the same prices offered at the restaurant or on the restaurant’s website,” it says. Grubhub has also listed many restaurants without their permission to expand its service, routing orders through its services and taking a commission. The complaint says it listed “over a thousand” restaurants in DC that had no connection with the company, asserting that the unapproved listings often contained menu errors and resulted in orders that would “take longer to fill, would be filled incorrectly, would be delivered cold, or would eventually be cancelled altogether.”

Grubhub — which also operates Seamless and several other food delivery apps — has made more elaborate attempts to insert itself into restaurant transactions as well. The lawsuit notes its launch of unsanctioned microsites that appear to be official restaurant sites, as well as custom phone numbers that let it charge fees when customers call restaurants, even when the calls didn’t result in orders. The company also offered a “Supper for Support” promotion that required restaurants to foot the bill for a special discount; it offered restaurants $250 in compensation after a backlash.

Link to Original Source

Feed Google News Sci Tech: Justice Clarence Thomas Hospitalized With Flulike Symptoms, Court Says - The New York Times (google.com)

Comment sabbatical (Score 1) 122

Before COVID I was part-time remote, while some co-workers were fully remote. The company has offices in multiple US timezones and in Europe, and my team was split between west and east coast, so we were already doing a lot of virtual meetings. They sent everyone remote in March of 2020 and I stayed on working fully remote for about a year. I decided I was burnt out and needed a break, so I left at the end of April 2021 and have been on a self-imposed 1-year sabbatical since. I am starting to think a bit about the job hunt but I don't really expect to get it going fully until May.

Submission + - Linux Random Number Generator Sees Major Improvements (zx2c4.com)

An anonymous reader writes: The Linux kernel's random number generator has seen its first set of major improvements in over a decade, improving everything from the cryptography to the interface used. Not only does it finally retire SHA-1 (in favor of BLAKE2s), but it also at long last unites `/dev/random` and `/dev/urandom`, finally ending years of Slashdot banter and debate:

The most significant outward-facing change is that /dev/random and /dev/urandom are now exactly the same thing, with no differences between them at all, thanks to their unification in random: block in /dev/urandom. This removes a significant age-old crypto footgun, already accomplished by other operating systems eons ago. [...] The upshot is that every Internet message board disagreement on /dev/random versus /dev/urandom has now been resolved by making everybody simultaneously right! Now, for the first time, these are both the right choice to make, in addition to getrandom(0); they all return the same bytes with the same semantics. There are only right choices.


Submission + - SPAM: False Advertising To Call Software Open Source When It's Not, Says Court

An anonymous reader writes: Last year, the Graph Foundation had to rethink how it develops and distributes its Open Native Graph Database (ONgDB) after it settled a trademark and copyright claim by database biz Neo4j. The Graph Foundation agreed [PDF] it would no longer claim specific versions of ONgDB, its Neo4j Enterprise Edition fork, are a "100 percent free and open source version" of Neo4J EE. And last month, two other companies challenged by Neo4j – PureThink and iGov – were also required by a court ruling to make similar concessions.

ONgDB is forked from Neo4j EE, which in May 2018 dropped the GNU Affero General Public License (AGPL) and adopted a new license that incorporates the AGPLv3 alongside additional limitations spelled out in the Commons Clause license. This new Neo4j EE license forbade non-paying users of the software from reselling the code or offering some support services, and thus is not open source as defined by the Open Source Initiative. The Graph Foundation, PureThink, and iGov offered ONgDB as a "free and open source" version of Neo4j in the hope of winning customers who preferred an open-source license. That made it more challenging for Neo4j to compete.

So in 2018 and 2019 Neo4j and its Swedish subsidiary pursued legal claims against the respective firms and their principals for trademark and copyright infringement, among other things. The Graph Foundation settled [PDF] in February 2021 as the company explained in a blog post. The organization discontinued support for ONgDB versions 3.4, 3.5 and 3.6. And it released ONgDB 1.0 in their place as a fork of AGPLv3 licensed Neo4j EE version 3.4.0.rc02. Last May, the judge hearing the claims against PureThink, and iGov granted Neo4j's motion for partial summary judgment [PDF] and forbade the defendants from infringing on the company's Neo4j trademark and from advertising ONgDB "as a free and open source drop-in replacement of Neo4j Enterprise Edition" The defendants appealed, and in February the US Court of Appeals for the Ninth Circuit affirmed a lower court decision that the company's "statements regarding ONgDB as 'free and open source' versions of Neo4j EE are false."

Link to Original Source

Submission + - SPAM: Proposed Law In Minnesota Would Ban Algorithms To Protect the Children

An anonymous reader writes: Minnesota state lawmakers are trying to prohibit social media platforms from using algorithms to recommend content to anyone under age 18. The bill was approved Tuesday by the House Commerce Finance and Policy Committee in a 15-1 vote. The potential state law goes next to the House Judiciary Finance and Civil Law Committee, which has put it on the docket for a hearing on March 22. The algorithm ban applies to platforms with at least 1 million account holders and says those companies would be "prohibited from using a social media algorithm to target user-created content at an account holder under the age of 18." There are exemptions for content created by federal, state, or local governments and by public or private schools.

"This bill prohibits a social media platform like Facebook, Instagram, YouTube, WhatsApp, TikTok, and others, from using algorithms to target children with specific types of content," the bill summary says (PDF). "The bill would require anyone operating a social media platform with more than one million users to require that algorithm functions be turned off for accounts owned by anyone under the age of 18." Social media companies would be "liable for damages and a civil penalty of $1,000 for each violation." Tech-industry lobbyists say the bill would violate the First Amendment, prevent companies from recommending useful content, and require them to collect more data on the ages and locations of users.

Link to Original Source

Comment Re:sub-CA hell (Score 1) 39

No, I'm fully aware we don't trust the CAs with our personal data. We're trusting the CAs to vouch for the organizations to whom they issue certificates. But now there are hordes of CAs, some of whom may not be particularly trustworthy, but the browser makers don't descriminate (much).

As a result, we have CAs that we're supposed to trust because our browsers accept them, but those CAs are passing out SSL certs like candy to anyone with a few bucks.

While we're not directly giving our personal data to the CAs, we're trusting the organizations they vouch for on the basis of the supposed trustworthiness of the CAs, when in fact most of them are utterly opaque and unknown to us, thus indirectly trusting them to protect our personal data.

Again I say, anyone on the internet should look at the diagram, look at the list of signing authorities their browsers trust, and ask themselves, "who the hell are all these people and why do I trust them?"

Comment Re:sub-CA hell (Score 1) 39

OH I definitely agree that the system is broken. Just looking at the site should make anyone on the internet ask themselves, "who the hell all these CAs are and do we really trust them with our most personal data"?

Yes, I think that encrypting your traffic securely is the right thing to do, and using public-private key pairs with cryptographically strong algorithms is the right way to do it, the trust model was broken the first day that money started to change hands as a surrogate for "trust"

Comment Re:This is ridiculous (Score 1) 217

completely unnecessary if you use a good password.

That's a dangerously incorrect assertion to make. People's battle.net accounts don't get compromised because a malicious party cracked a password. Keyloggers, phishing, social engineering, and just plain fraud are all far more common avenues for password leakage, both in battle.net and overall.

The days when a hacker could bang on the front door of a service trying username/password combinations until finding one that worked are long gone. The reason Blizzard introduced authenticators was because their own experience indicated that no matter how tightly locked the servers, or how strong the password requirements, with the client software and hardware out of their control, passwords were still getting out. So they went with the next best convenient security practice: something you know, and something you have.

Comment Re:A lot of apps use SSL (Score 1) 141

Good answer. To be fair to the parent post, the certificate authorities *do* have some work to do in cleaning their own houses. Stolen or compromised certificates do exist, and while we can revoke the ones we know about, there's the ones we don't know about, and there's the clients that don't handle revocation properly. It's not clear that the CA houses are doing their jobs well enough.

Slashdot Top Deals

After the last of 16 mounting screws has been removed from an access cover, it will be discovered that the wrong access cover has been removed.

Working...