Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror

Submission + - Bank of America faces lawsuit over alleged unpaid computer boot-up time (hcamag.com)

Joe_Dragon writes: Bank of America is facing allegations that hundreds of hourly workers performed up to 30 minutes of unpaid computer setup work daily for years.

A former Business Analyst filed a class action lawsuit in federal court on October 23, claiming the banking giant systematically shortchanged remote employees who had to boot up complex computer systems before their paid shifts began.

Tava Martin, who worked both remotely and at the company's Jacksonville facility, says the financial institution required her and fellow hourly workers to log into multiple security systems, download spreadsheets, and connect to virtual private networks—all before the clock started ticking on their workday.

The process wasn't quick. According to the filing in the United States District Court for the Western District of North Carolina, employees needed 15 to 30 minutes each morning just to get their systems running. When technical problems occurred, it took even longer.

Here's how it worked: Workers turned on their computers, waited for Windows to load, grabbed their cell phones to request a security token for the company's VPN, waited for that token to arrive, logged into the network, opened required web applications with separate passwords, and downloaded the Excel files they needed for the day. Only then could they start taking calls from business customers about regulatory reporting requirements.

The lawsuit says Bank of America enforced a strict "phone ready" policy. Employees had to be prepared to handle calls the moment their scheduled shifts began. Anyone who clocked in but wasn't immediately available to take or make calls for too long risked poor performance scores and possible disciplinary action, up to and including termination.

Yet the company allegedly discouraged workers from reporting any time outside their scheduled hours. Martin's paystubs routinely showed exactly 40 hours per week, or exactly 32 hours when she missed a day—suggesting the bank paid for scheduled time rather than actual work performed.

The unpaid work didn't stop at startup. During unpaid lunch breaks, many systems would automatically disconnect or otherwise lose connection, forcing employees to repeat portions of the login process—approximately three to five minutes of uncompensated time on most days, sometimes longer when a complete reboot was required. After shifts ended, workers had to log out of all programs and shut down their computers securely, adding another two to three minutes.

Martin earned $46.17 per hour through a third-party staffing agency, though Bank of America controlled her schedule, training, and employment conditions. Like many of her colleagues, she regularly worked full-time hours, meaning the uncompensated startup and shutdown time should have been paid at the overtime rate of one and a half times her regular wage.

The lawsuit points to 2008 guidance from the Department of Labor that specifically addresses call centers under the Fair Labor Standards Act. That guidance explicitly states that an example of the first principal activity of the day for call center workers includes starting computers to download work instructions and applications. It also requires employers to keep daily or weekly records of all hours worked, including time spent in pre-shift and post-shift activities.

The filing suggests Bank of America either didn't bother to determine whether the computer time was compensable or knew it was but failed to pay for it anyway. The lawsuit notes the company has faced factually similar cases from other employees about time spent loading and logging into computer systems.

For the week of March 11 through March 17, 2024, for example, Martin was paid for 40 regular hours but no overtime. With unpaid pre-shift, meal-period, and post-shift time of at least 20 minutes per shift over five shifts, she should have received an additional 100 minutes at her overtime rate of $69.25 per hour. Similar calculations apply to other pay periods cited in the complaint.

Business Analysts were interviewed by company hiring managers and assigned to Bank of America managers upon hire. The bank provided supervisors who oversaw their daily performance and gave them training and technical support. The company controlled work schedules and retained the ability to discipline and terminate employees. The positions were hourly, non-exempt jobs with rigid schedules requiring at least eight hours per day, on average five days per week, and up to 40 hours or more weekly.

Martin seeks to represent all current and former remote hourly Business Analysts who worked for the bank during the three years before conditional certification through judgment. She estimates the group includes hundreds, if not thousands, of workers who performed essentially the same tasks using the same or similar computer programs under the same timekeeping policies.

Many Business Analysts, including Martin, were employed through third-party staffing agencies but were required to comply with all Bank of America employee handbook policies, including those covering attendance, timekeeping, and overtime.

The case remains in early stages, with no court ruling yet on whether it will proceed as a class action or on the merits of the allegations.

Comment Re:Why not Libre Office? (Score 2) 55

That was my first thought, but according to their webpage https://www.opendesk.eu/en/ it appears this does more than what libreoffice does, such as task management, video conferencing, chat, identity and access management, etc.

But unless I'm missing something I don't think it's open source. The website talks about using open standards but your only option for actually getting it to "book a demo".

It doesn't appear to be either open source or available for download.

Opendesk links to https://opencode.de/en and they link to their gitlab repositories at https://gitlab.opencode.de/exp... which is just a long list mostly in german so how much and what's there I can't tell.

Submission + - ex-Intel CEO Gelsinger to build a Christian AI: 'hasten the re-coming of Christ (theguardian.com)

An anonymous reader writes: Now Gloo’s executive chair and head of technology (who’s largely free of the shareholder suit), Gelsinger has made it a core mission to soft-power advance the company’s Christian principles in Silicon Valley, the halls of Congress and beyond, armed with a fundraised war chest of $110m. His call to action is also a pitch for AI aligned with Christian values: tech products like those built by Gloo, many of which are built on top of existing large language models, but adjusted to reflect users’ theological beliefs.

“My life mission has been [to] work on a piece of technology that would improve the quality of life of every human on the planet and hasten the coming of Christ’s return,” he said.

Gloo says it serves “over 140,000 faith, ministry and non-profit leaders”. Though its intended customers are not the same, Gloo’s user base pales in comparison with those of AI industry titans: about 800 million active users rely on ChatGPT every week, not to mention Claude, Grok and others.

Religiosity like Gelsinger’s – a born-again Christian who has referred to Silicon Valley as his “mission field” – is shaping Silicon Valley’s culture in its image. Where there was once purported atheism, there is now “a very loud, very visible and very specifically Christian-inflected technological culture” in Silicon Valley, said Damien Williams, a scholar at the University of North Carolina at Charlotte who studies how technologies are shaped by religious beliefs. It’s exemplified by figures like Peter Thiel – who warns of the coming of the antichrist if humanity fails to work toward certain technological frameworks – and Andreessen Horowitz’s Katherine Boyle, a close friend of JD Vance, the US vice-president. Gelsinger has long been outspoken about his Christian values, helping found Transforming the Bay With Christ in 2013, an organization aiming to ignite a Christian spiritual movement in the region.

Gelsinger wants faith to suffuse AI. He has also spearheaded Gloo’s Flourishing AI initiative, which evaluates leading large language models’ effects on human welfare across seven variables – in essence gauging whether they are a force for good and for users’ religious lives. It’s a system adapted from a Harvard research initiative, the Human Flourishing Program. Models like Grok 3, DeepSeek-R1 and GPT-4.1 earn high marks, 81 out of 100 on average, when it comes to helping users through financial questions, but underperform, about 35 out of 100, when it comes to “Faith”, or the ability, according to Gloo’s metrics, to successfully support users’ spiritual growth.

Gloo’s initiative has yet to visibly attract Silicon Valley’s attention. A Gloo spokesperson said the company is “starting to engage” with prominent AI companies.

“I want Zuck to care,” Gelsinger said.

Comment Re:It's the community, not the technology or the i (Score 2) 40

The success of an open source project does not stem from the brilliance of the idea or the elegance of the design. It comes from the dedicated and focused efforts of the community that supports it and builds it. If Unity doesn't have that community, it's not going to do well. A lesser project with a large, dedicated community around it, will ultimately make the cut.

Commercial software is like this too. The secret sauce is not the code itself, but the company that backs, maintains, enhances, and manages the code.

The article and linked posts indicate Ubuntu Unity consists of one qualified developer who no longer can spare the time and and a few moderators who lack necessary technical skills.

Comment Re:But I thougth there was a loneliness epidemic (Score 1) 67

"I'm as mad as hell, and I'm not going to take this anymore!" (Network 1976) https://www.youtube.com/watch?... I believe this sort of performative rage has become ritualized and social media fuels it. I don't know what the technical solution to that could be nor what the incentive would be to drive it. (Admittedly I also think it's a great scene).

Submission + - Python Software Foundation refuses $1.5 million grant with anti DEI provision. (blogspot.com) 1

Jeremy Allison - Sam writes: The PSF has withdrawn a $1.5 million proposal to US government grant program.

"We became concerned, however, when we were presented with the terms and conditions we would be required to agree to if we accepted the grant. These terms included affirming the statement that we “do not, and will not during the term of this financial assistance award, operate any programs that advance or promote DEI, or discriminatory equity ideology in violation of Federal anti-discrimination laws.”

Comment Re:Wisdom of the Crowd works only for (Score 1) 20

situation on the ground is that russians are starting to notice they're in a war.

long lines for nonexistan gas. high inflation. wages not being paid.

ask them how much longer they support the 3 day Special Military Operation. But do it away from russian goons with guns to get "more accurate" responses

I believe that has very low predictive power. The situation after the fall of the Soviet Union tells me people in Russia will go without wages for a long time and the infrastructure to quickly send the average man to an almost certain death at the front is a very efficient deterrent as is people falling out of windows (this all you seemingly indicate but don't draw the next obvious conclusion from).

What I believe will be the deciding factor a year from now is that the hard part of getting a god chunk of money committed that can be piled onto will be the EU taking sanctioned Russian money and "gifting" it to Ukraine (the technicalities needs to be sorted and there will be a song and dance about but it's going to happen). This was previously sorted between the EU and US.

In 2026 Russias financial shenanigans will begin to crumble in more apparent ways but I don't think it will be the obvious "liquidity kills", a bank run, hyperinflation or something completely unexpected is more likely if anything.

Comment Re:Wisdom of the Crowd works only for (Score 1) 20

Look at Fermi Problems https://en.wikipedia.org/wiki/... I also believe the situation on the ground in Ukraine today has very low predictive power on let's say a year from now and the willingness of people to have their governments financially support Ukraine a higher predictive power.

Submission + - An In-Depth Analysis of the US Gov VA.gov Front-End Source Code Exposed on Repo (medium.com)

An anonymous reader writes: Introduction

The Department of Veterans Affairs (VA) maintains a comprehensive front-end codebase for VA.gov, hosted openly on GitHub under the repository department-of-veterans-affairs/vets-website. While open-sourcing code promotes transparency, collaboration, and community development, it also raises critical questions regarding security — especially when the codebase encompasses sensitive operational details of a government website serving millions of veterans.

See link to exposed Code of entire VA Front End website: https://github.com/department-...

This article provides an in-depth analysis of the security considerations associated with hosting the VA.gov front-end code publicly, referencing specific repository details, code snippets, and deployment practices. We explore whether such openness exposes vulnerabilities, how the code is secured during deployment, and best practices for safeguarding sensitive information.

Overview of the VA.gov Repository

The vets-website repository is a large, actively maintained codebase containing the front-end application code for VA.gov. Its structure includes configurations, scripts, application code, and documentation, with a focus on React, Webpack, ESLint, and other modern web development tools.

Key features include:

Modular React components.
Build and deployment scripts.
Testing frameworks (unit, Cypress E2E).
Environment variables and secret management.
Extensive configuration files for linting, styling, and deployment.
The repository is marked as public, with an explicit license (CC0–1.0), encouraging open collaboration but also requiring careful security practices.

The Security Context of Open Source Front-End Code

1. Public Repository Does Not Equal Public Exposure of Sensitive Data

Open-sourcing the codebase means that the source code, configuration files, and build scripts are accessible to anyone. This transparency allows security researchers, developers, and potential attackers to analyze the code for vulnerabilities.

Crucially:

The source code should not contain sensitive data such as API keys, secrets, or credentials.
Secrets and environment-specific configurations must be secured separately, typically via environment variables, secret management systems, or encrypted storage.
2. Potential Risks of Exposing the Code

While the code itself is typically non-sensitive, some risks include:

Disclosure of internal architecture or vulnerabilities that could be exploited if not properly secured.
Exposure of API endpoints or configurations that could be misused if not properly protected.
Insight into deployment practices, which could aid targeted attacks.
Security Measures in the VA.gov Front-End Codebase

1. Separation of Code and Secrets

The repository contains numerous configuration files and scripts, such as: .env files (e.g., .env containing MAPBOX_TOKEN)
Configuration snippets in webpack, eslint, and other files.
These are designed to not include sensitive secrets directly. For example, the MAPBOX_TOKEN is stored as an environment variable, which should be kept secure during deployment.

Code Snippet:

CopyRun// Example: Mapbox token usage
const MAPBOX_TOKEN = process.env.MAPBOX_TOKEN;
This indicates that sensitive tokens are expected to be stored outside the source code, in environment variables, which are not committed to the repository.

2. Environment Variable Management and Secrets

The documentation emphasizes that secrets like MAPBOX_TOKEN must be stored securely in environment variables or secret management systems, such as AWS Parameter Store. .gitignore files are used to prevent accidental commits of secrets.

3. Deployment Security

The actual live VA.gov website is deployed in secure environments, likely within Intranet DMZs or private cloud VPCs, with strict access controls, firewalls, and monitoring. The public code repository serves only as a source code reference, not as the deployment environment.

The Stark Reality: Billions in Losses Due to Mishandling Secrets

Despite these safeguards, the improper management of secrets and configuration files has led to catastrophic financial consequences — amounting to billions of dollars in losses across various sectors. When sensitive secrets such as API keys, access tokens, or passwords are inadvertently exposed or embedded in code, malicious actors can exploit these vulnerabilities to conduct data breaches, service disruptions, or fraud.

Recent incidents demonstrate that:

Secrets embedded in code or configuration files — even inadvertently — can lead to massive financial and reputational damage.
Exposed API endpoints and internal systems can be targeted for attacks, leading to operational downtime and regulatory penalties.
Failure to enforce strict secret management practices results in vulnerabilities that are costly to remediate.
In the context of VA.gov, mishandling secrets or misconfigurations could potentially lead to significant financial and security repercussions — not just for the organization but also for the millions of veterans relying on its services.

Code Security Best Practices and VA.gov

1. Secure Storage of Secrets

Use of environment variables (process.env.*) ensures secrets are not embedded in code.
Secrets are managed via AWS Parameter Store, HashiCorp Vault, or other secure systems, with access restricted to authorized personnel and systems.
2. Access Controls and Auditing

Deployment pipelines enforce strict access controls.
Only authorized DevSecOps personnel handle secrets and deployment.
Continuous monitoring and auditing of deployment activities are standard practices.
3. Code Review and Vulnerability Testing

Regular static code analysis (via tools like ESLint, Code Climate).
Security audits and vulnerability assessments.
Automated testing for known security issues.
Potential Vulnerabilities and Their Mitigation

VulnerabilityExplanationMitigation StrategiesSecrets in codeAccidental embedding of API keys or secretsEnforce .gitignore, environment variables, secret management systemsExposed API endpointsPublic analysis reveals internal endpointsProper API security, rate limiting, authenticationCode vulnerabilitiesBugs or insecure code patternsCode reviews, static analysis, security testingDeployment misconfigurationsImproper environment setupInfrastructure as code, automated deployment, access controls

Conclusion

Hosting the VA.gov front-end code openly on GitHub does not inherently compromise security, provided that:

Sensitive data and secrets are never stored in the source code.
Secrets are managed securely outside of the repository, via environment variables and secret management systems.
Deployment environments and infrastructure are properly secured within private networks or DMZs.
Regular security audits are performed to identify and remediate vulnerabilities.
However, the broader lesson is clear: mismanagement of secrets and configuration files can lead to billions in losses. Vigilance, adherence to best practices, and robust security controls are essential to safeguarding sensitive information and ensuring the integrity of critical government infrastructure.

In summary:

While open-sourcing code fosters transparency and collaboration — which can improve security through community review — strict security controls around secrets, deployment, and infrastructure are paramount. This is especially crucial when the stakes involve billions of dollars and the security of services relied upon by millions.

References:

VA.gov Front-End Repository
Secrets Management Best Practices
Securing GitHub Repositories
If you require additional details on securing VA.gov infrastructure or code, consult VA cybersecurity policies or your organization’s DevSecOps team.

Submission + - California to become first state to sell cheap insulin 3

Nicholas Grayhame writes: KTLA reports: California will begin offering its own brand of low-cost insulin in 2026, becoming the first state to contract for and sell an affordable version of the drug to residents, Gov. Gavin Newsom announced Thursday.

Beginning Jan. 1, 2026, insulin glargine pens, a long-acting insulin analog used in the management of diabetes, will be available to consumers for no more than $55 for a five-pack of 3 mL pens, averaging $11 per pen.

... California previously launched a similar initiative for naloxone, the opioid overdose reversal medication.

Newsom has signed related measures to curb drug costs, including legislation capping insulin copays at $35 per month and tightening regulations on pharmacy benefit managers.

Submission + - Richard Sutton thinks LLMs are a dead end

An anonymous reader writes: Richard Sutton – Father of RL thinks LLMs are a dead end

“Richard Sutton is the father of reinforcement learning, winner of the 2024 Turing Award, and author of The Bitter Lesson. And he thinks LLMs are a dead end.

After interviewing him, my steel man of Richard’s position is this: LLMs aren’t capable of learning on-the-job, so no matter how much we scale, we’ll need some new architecture to enable continual learning.

And once we have it, we won’t need a special training phase — the agent will just learn on-the-fly, like all humans, and indeed, like all animals.”

Submission + - Coral reef discovered off Naples (independent.co.uk)

davidone writes: A large white coral reef containing important species and fossil traces has been discovered at a depth of more than 500 metres in the Gulf of Naples, in a rare discovery for the Mediterranean, the Italian Research Council (CNR) said on Friday.

Submission + - More Screen Time Linked To Lower Test Scores For Elementary Students (www.cbc.ca)

An anonymous reader writes: The study by a team from Toronto's Hospital for Sick Children (also known as Sick Kids) and St. Michael’s Hospital was published in the Journal of the American Medical Association. It found that children who spent more time on screens before age eight scored lower on standardized tests. Child psychiatry researchers say handing kids digital devices, like iPads, every time they have a tantrum could lead to future issues. One new study links too much screen time to emotional and anger management problems.

The study followed more than 3,000 kids in Ontario over a 15 year span from 2008 to 2023, tracking how much time they spent watching TV or DVDs, playing video games, using the computer or playing on handheld devices like iPads, as reported by their parents. That data was compared to their EQAO standardized test scores, which are used to assess the reading and math skills of kids across Ontario in grades 3 and 6. The findings point to a “significant association,” between screen use and lower test scores, according to Dr. Catherine Birken, a pediatrician and senior scientist at Sick Kids and lead author of the study.

“For each additional hour of screen use, there was approximately a 10 percent lower odds of meeting standards in both reading and mathematics ... in Grade 3 and mathematics in Grade 6,” said Dr. Catherine Birken, a pediatrician and senior scientist at Sick Kids and lead author of the study, in an interview with CBC News. The study didn’t differentiate between different types of screen time — for example, whether a child was playing a game on their iPad versus FaceTiming a relative in another city, or watching an educational video. It was also an observational study that relied on parents answering questionnaires about how much time their kids spent in front of screens. The study authors note that this means the research can’t be taken as definitive proof that screen time causes lower grades, just that the two things tend to go hand in hand.

Slashdot Top Deals

ASCII a stupid question, you get an EBCDIC answer.

Working...