Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror

Submission + - Google Play To Ban Android VPN Apps From Interfering With Ads (theregister.com)

An anonymous reader writes: Google in November will prohibit Android VPN apps in its Play store from interfering with or blocking advertising, a change that may pose problems for some privacy applications. The updated Google Play policy, announced last month, will take effect on November 1. It states that only apps using the Android VPNService base class, and that function primarily as VPNs, can open a secure device-level tunnel to a remote service. Such VPNs, however, cannot "manipulate ads that can impact apps monetization."

The rules appear to be intended to deter data-grabbing VPN services, such as Facebook's discontinued Onavo, and to prevent ad fraud. The T&Cs spell out that developers must declare the use of VPNservice in their apps' Google Play listing, must encrypt data from the device to the VPN endpoint, and must comply with Developer Program Policies, particularly those related to ad fraud, permissions, and malware.

Submission + - Are Plants 'Intelligent'? 1

Dr_Ish writes: It is not too common for the world of academic philosophy to be changed by a new discovery, or innovation. Perhaps the last time this happened in a major way can be traced back to Turing’s famous (1950) “Computational Machinery and Intelligence” paper (*Mind*, 49, pp. 433-460), where Turing proposed that computational systems could exhibit mind-like properties. However, it appears to be in the process of happening again.

In a series of recent papers and a book that was published last week, philosopher Prof. Paco Calvo from the University of Murcia, has made a compelling case that plants exhibit cognitive properties, such as memory, planning, intelligence and perhaps even numerical abilities. The book received a positive review in *The Gruniad* (see https://www.theguardian.com/bo...). His book, Calvo, P. with Lawrence, N. (2022) *Planta Sapiens: The New Science of Plant Intelligence* was published in the UK last week. It will appear in North America in March next year. It can be ordered from the UK publisher, right now, from https://www.littlebrown.co.uk/... . If Calvo is correct, one wonders what this means for people who are vegans, for ethical reasons?

Submission + - More Than Half Of All Bitcoin Trades Are Fake (forbes.com)

rrconan writes: From the "we already knew" department, Forbes is reporting that ore than half of all reported trading volume is likely to be fake or non-economic. Forbes estimates the global daily bitcoin volume for the industry was $128 billion on June 14. That is 51% less than the $262 billion one would get by taking the sum of self-reported volume from multiple sources.

There is no universally accepted method of calculating bitcoin daily volume, even among the industry’s most reputable research firms. For instance, as of this writing, CoinMarketCap puts the latest 24-hour trading of bitcoin at $32 billion, CoinGecko at $27 billion, Nomics at $57 billion and Messari at $5 billion.

Submission + - Ask Slashdot: Why isn't Magic: the Gathering on Slashdot? 1

tezbobobo writes: For years I've seen Dungeons & Dragons, Sony Playstation and Nethack show up occassionally on the front page of Slashdot. So where are the rest of the nerd games? Magic the Gathering has one of the most loyal and active fanbases, and the creators have been churning out new and interesting cards for decades. Even as it tops of the trading card pile,it has made inroads into the digital sphere, with online version in Arena and Magic Online. It is available on PC, Mac, Ipad.

So where is it on Slashdot? Or more ot the point, why hasn't it show up before now?

Submission + - Hackers Are Stealing Session Cookies to Bypass Multi-factor Authentication (esecurityplanet.com) 1

storagedude writes: Hackers are stealing cookies from current or recent web sessions to bypass multi-factor authentication (MFA), according to an eSecurity Planet report.

The attack method, reported by Sophos researchers, is already growing in use. The "cookie-stealing cybercrime spectrum" is broad, the researchers wrote, ranging from "entry-level criminals" to advanced adversaries, using various techniques.

Cybercriminals collect cookies or buy stolen credentials "in bulk" on dark web forums. Ransomware groups also harvest cookies and "their activities may not be detected by simple anti-malware defenses because of their abuse of legitimate executables, both already present and brought along as tools," the researchers wrote.

Browsers allow users to maintain authentication, remember passwords and autofill forms. That might seem convenient, but attackers can exploit this functionality to steal credentials and skip the login challenge.

Behind the scenes, browsers use SQLite database files that contain cookies. These cookies are composed of key-value pairs, and the values often contain critical information such as tokens and expiration dates.

Adversaries know the exact name and location of these files for all major browsers such as Chrome, Firefox, and even Brave, on various operating systems. That’s why the attack can be scripted. It’s not uncommon to find such scripts along with other modules in info-stealing and other malware.

For example, the latest version of the Emotet botnet targets cookies and credentials stored by browsers, which include saved credit cards. According to the Sophos researchers, “Google’s Chrome browser uses the same encryption method to store both multi-factor authentication cookies and credit card data.”

To gain initial access, attackers can also perform phishing and spear-phishing campaigns to implant droppers that can deploy cookie-stealer malware stealthily.

The cookies are then used for post-exploitation and lateral movements. Cybercriminals can use them to change passwords and emails associated with user accounts, or trick the victims into downloading additional malware, or even deploy other exploitation tools such as Cobalt Strike and Impacket kit.

Users should not use built-in features to save passwords unless the browser encrypts them with, at least, a master password. It’s recommended that users uncheck the setting called “remember passwords,” and users should probably not allow persistent sessions as well.

Developers can be part of the problem if they don’t secure authentication cookies properly. Such cookies must have a short expiration date. Otherwise, the persistent authentication could turn into a persistent threat. You can have great security processes and still get hacked because the cookies do not have the necessary flags (e.g., HttpOnly, Secure attribute). For example, authentication cookies must be sent using SSL/TLS channels. Otherwise the data could be sent in plain text and attackers would only have to sniff traffic to intercept credentials.

Submission + - Can the Visa-Mastercard duopoly be broken? (economist.com)

An anonymous reader writes: America is home to the heftiest interchange fees of any major economy—costs are an order of magnitude greater than in Europe and China. That largely benefits two firms: Visa and Mastercard, which facilitate more than three-quarters of the country’s credit-card transactions. Doing so has made them two of the most profitable companies in the world, with net margins last year of 51% and 46% respectively. Rank every firm (excluding real-estate-investment trusts) in the s&p 500 index by their average net-profit margins last year, five years ago and a decade ago, and only four appear in the top 20 every time. Two are financial-information firms, Intercontinental Exchange and the cme Group. The others are Mastercard and Visa. At first glance their position appears insurmountable. Already dominant, in recent years the firms have been boosted by a covid-induced rise in online shopping. American consumers used credit or debit cards for 45% of their transactions in 2016; by 2021, that had reached 57%. The migration from cash is “a significant and long-running tailwind,” says Craig Vosburg of Mastercard. Yet two threats loom. The first comes from Washington, where legislators https://www.economist.com/finance-and-economics/2022/08/17/can-the-visa-mastercard-duopoly-be-broken">hope to smash the duo’s grip on payments. The second is virtual. Payments have been transformed in Brazil, China and Indonesia by cheap, convenient app-based options from tech giants like Mercado Pago, Ant Group, Tencent and Grab. After a long wait, new entrants now look like they could shake up America’s market.

[...] On July 28th Richard Durbin, the same Democratic senator who regulated debit interchange a decade ago, introduced the Credit Card Competition Act (ccc). It does not propose a cap on interchange, as the debit rule does, since costs for credit cards are more variable than for debit cards, making it harder to find the right level. Instead, the ccc would attempt to spur competition by breaking the links between card networks and banks. At present, when a bank issues a credit card every transaction on it is processed by the card network the bank stipulates, meaning the bank is guaranteed the interchange fee the network sets. If the ccc becomes law it will force banks to offer merchants the choice of at least two different card networks. Crucially, these choices could not be the two biggest—at least one smaller network would have to be offered. They could compete for business by offering lower interchange rates, and merchants would presumably jump at the offer.
,br> Two factors help the bill’s chances. It is sponsored by Mr Durbin, the second-most senior Democrat in the Senate, and it is bipartisan, co-sponsored by Roger Marshall, a Republican from Kansas. The ccc’s best chance is probably as an amendment to another bigger piece of legislation, which is how debit-card regulation passed in 2010. Even if the effort fails, or fails to work as intended, a potentially bigger threat to the giants looms. So far new entrants to the payments market have benefited Visa and Mastercard, by making it easier for consumers to use their cards online. But as the new fintechs have gained clout, their decisions about the sorts of payments they offer could influence how much money travels along the card networks. Stripe, a large payments-infrastructure firm, says it is working to provide merchants with payment methods that will lower their costs. Current options include a box for customers to enter card details, but also Klarna, a “buy-now-pay-later” provider through which customers can pay for purchases using bank transfers, thus avoiding the card networks. It could soon include things like FedNow, a real-time bank-transfer system being built by the Fed, which is due to be launched next year. In time, it could even include central-bank digital currencies or cryptocurrencies.

Competitors might make little headway if the perks for sticking with credit cards are sufficiently juicy. But merchants can offer their own incentives. When your correspondent recently went to purchase a pair of linen trousers from Everlane, an online retailer, she was encouraged to pay using Catch, a fintech app. The app linked to her bank account via another payment startup called Plaid. As a thank you for avoiding the card networks, Everlane offered a shop credit worth 5% of the transaction value. Catch has signed up a handful of fashionable, millennial brands including Pacsun, another clothing retailer, and Farmacy, a skincare firm. For evidence that this poses a threat, look no further than Visa’s attempted purchase of Plaid. In 2020 the firm tried to buy the upstart for $5.3bn, only for the deal to be scuppered by antitrust regulators on the grounds that the transaction would have allowed Visa to eliminate a competitive threat. Ultimately, Visa gave up, but the attempt was nonetheless telling. The house of cards carefully constructed by the two payment giants is formidable and long-standing. But it is not indestructible.

Submission + - Forever Chemicals No More? PFAS Are Destroyed With New Technique (nytimes.com)

An anonymous reader writes: A team of scientists has found a cheap, effective way to destroy so-called forever chemicals, a group of compounds that pose a global threat to human health. The chemicals — known as PFAS, or per- and polyfluoroalkyl substances — are found in a spectrum of products and contaminate water and soil around the world. Left on their own, they are remarkably durable, remaining dangerous for generations. Scientists have been searching for ways to destroy them for years. In a study, published Thursday in the journal Science, a team of researchers rendered PFAS molecules harmless by mixing them with two inexpensive compounds at a low boil. In a matter of hours, the PFAS molecules fell apart. The new technique might provide a way to destroy PFAS chemicals once they’ve been pulled out of contaminated water or soil. But William Dichtel, a chemist at Northwestern University and a co-author of the study, said that a lot of effort lay ahead to make it work outside the confines of a lab. “Then we’d be in a real position to talk practicality,” he said.

At the end of a PFAS molecule’s carbon-fluorine chain, it is capped by a cluster of other atoms. Many types of PFAS molecules have heads made of a carbon atom connected to a pair of oxygen atoms, for example. Dr. Dichtel came across a study in which chemists at the University of Alberta found an easy way to pry carbon-oxygen heads off other chains. He suggested to his graduate student, Brittany Trang, that she give it a try on PFAS molecules. Dr. Trang was skeptical. She had tried to pry off carbon-oxygen heads from PFAS molecules for months without any luck. According to the Alberta recipe, all she’d need to do was mix PFAS with a common solvent called dimethyl sulfoxide, or DMSO, and bring it to a boil. “I didn’t want to try it initially because I thought it was too simple,” Dr. Trang said. “If this happens, people would have known this already.” An older grad student advised her to give it a shot. To her surprise, the carbon-oxygen head fell off.

It appears that DMSO makes the head fragile by altering the electric field around the PFAS molecule, and without the head, the bonds between the carbon atoms and the fluorine atoms become weak as well. “This oddly simple method worked,” said Dr. Trang, who finished her Ph.D. last month and is now a journalist. Unfortunately, Dr. Trang discovered how well DMSO worked in March 2020 and was promptly shut out of the lab by the pandemic. She spent the next two and a half months dreaming of other ingredients which she could add to the DMSO soup to hasten the destruction of PFAS chemicals. On Dr. Trang’s return, she started testing a number of chemicals until she found one that worked. It was sodium hydroxide, the chemical in lye. When she heated the mixture to temperatures between about 175 degrees to 250 degrees Fahrenheit, most of the PFAS molecules broke down in a matter of hours. Within days, the remaining fluorine-bearing byproducts broke down into harmless molecules as well. Dr. Trang and Dr. Dichtel teamed up with other chemists at U.C.L.A. and in China to figure out what was happening. The sodium hydroxide hastens the destruction of the PFAS molecules by eagerly bonding with the fragments as they fall apart. The fluorine atoms lose their link to the carbon atoms, becoming harmless. [...] Dr. Dichtel and his colleagues are now investigating how to scale up their method to handle large amounts of PFAS chemicals. They’re also looking at other types of PFAS molecules with different heads to see if they can pry those off as well.

Submission + - Buttons Beat Touchscreens In Cars, and Now There's Data To Prove It (arstechnica.com)

An anonymous reader writes: [Swedish car publication Vi Bilägare] tested 11 new cars alongside a 2005 Volvo C70, timing how long it took to perform a list of tasks in each car. These included turning on the seat heater, increasing the cabin temperature, turning on the defroster, adjusting the radio, resetting the trip computer, turning off the screen, and dimming the instruments. The old Volvo was the clear winner. "The four tasks is handled within ten seconds flat, during which the car is driven 306 meters at 110 km/h [1,004 feet at 68 mph]," VB found. Most of the other cars required twice as long, or more, to complete the same tasks. VB says that "one important aspect of this test is that the drivers had time to get to know the cars and their infotainment systems before the test started." VB lays the blame for the shift from bottons to screens with designers who "want a 'clean' interior with minimal switchgear."

Even with touchscreens, though, we can see in the spread of scores VB gave to different all-touch cars that design matters. You'll find almost no buttons in a Tesla Model 3, and we called out the lack of buttons in the Subaru Outback in our review, but both performed quite well in VB's tests. And VW's use of capacitive touch (versus physical) for the controls on the center stack appears to be exactly the wrong decision in terms of usability, with the ID.3 right at the bottom of the pack in VB's scores. I'm not surprised that the BMW iX scored well; although it has a touchscreen, you're not obligated to use it. BMW's rotary iDrive controller falls naturally to hand, and there are permanent controls arrayed around it under a sliver of wood that both looks and feels interesting. It's an early implementation of what the company calls shy tech, and it's a design trend I am very much looking forward to seeing evolve in the future.

Submission + - Oracle insiders describe the 'complete chaos' from layoffs and restructuring (businessinsider.com)

SpzToid writes: Earlier this week, database giant Oracle began a sizable layoff, potentially impacting thousands of employees globally, sources told Insider.

The hardest-hit units, current and former employees said, were in the marketing and customer experience (CX) divisions, where insiders say the mood is bleak — and those who haven't yet been laid off are scrambling to figure out whether they'll be cut next.

"The people who have left are breathing a sigh of relief," a marketing employee who was laid off on Monday told Insider. "And the people who are still here are definitely running for the hills."

Some marketing teams have seen their headcount slashed by anywhere from 30% to 50%, sources said. In some cases, they said, managers were given the choice of who would get cut, while others had no say in how the layoffs would affect their teams.

"There's no marketing anymore," a senior marketing leader who was laid off on Monday told Insider. "We're not even supposed to say we're in marketing because there is no marketing division."

Oracle's advertising unit also laid off about 60 employees in July, Insider previously reported, and The Information reported that the company was seeking to cut as much as $1 billion in costs via layoffs and other means.

Now, there's a sense among many at Oracle of impending doom, with more cuts and reorganizations expected through the end of the year, including soon after its CloudWorld conference in October.

"It's just a horrible environment left," a former marketing employee who worked with Kelman said. "It's complete chaos."

Oracle's cuts affected some of its most seasoned employees

Some marketing employees have also been sharing their layoff notifications in external Slack channels and texts to warn others they may be next.

"We started the Slack messages before the notifications started," a former employee said. "So you could see when the calls were coming in and you could tell that you were going to get the next calls."

While the company is known for cutting workers every year, some employees said they were shocked by how many senior, experienced, and high-performing staffers were let go on Monday.

For example, Oracle's code base is so complicated that it can take years before engineers are fully up to speed with how everything works, and workers with over a decade of experience were cut, some employees said.

The decision to cut some of its over 130,000-strong workforce comes at a critical moment for the Austin-based tech giant. Oracle last month won regulatory approval for its $28 billion purchase of the medical-records company Cerner and is absorbing its roughly 20,000 employees. It also recently won a contract to store the US user data for the ByteDance-owned video app TikTok — a deal that may boost its cloud ambitions as it seeks to overtake cloud giants like Amazon Web Services.

Submission + - The Founder of GeoCities on What Killed the 'Old Internet' (gizmodo.com)

An anonymous reader writes: In the early aughts, my wheezing dialup connection often operated as if it were perpetually out of breath. Thus, unlike my childhood friends, it was near to impossible for me to watch videos, TV shows, or listen to music. Far from feeling limited, I felt like I was lucky, for I had access to an encyclopedia of lovingly curated pages about anything I wanted to know—which in those days was anime—the majority of which was conveniently located on GeoCities. For all the zoomers scrunching up their brows, here’s a primer. Back in the 1990s, before the birth of modern web hosting household names like GoDaddy and WP Engine, it wasn’t exactly easy or cheap to publish a personal website. This all changed when GeoCities came on the scene in 1994.

The company gave anyone their own little space of the web if they wanted it, providing users with roughly 2 MB of space for free to create a website on any topic they wished. Millions took GeoCities up on its offer, creating their own homemade websites with web counters, flashing text, floating banners, auto-playing sound files, and Comic Sans. Unlike today’s Wild Wild Internet, websites on GeoCities were organized into virtual neighborhoods, or communities, built around themes. “HotSprings” was dedicated to health and fitness, while “Area 51” was for sci-fi and fantasy nerds. There was a bottom-up focus on users and the content they created, a mirror of what the public internet was like in its infancy. Overall, at least 38 million webpages were built on GeoCities. At one point, it was the third most-visited domain online. Yahoo acquired GeoCities in 1999 for $3.6 billion. The company lived on for a decade more until Yahoo shut it down in 2009, deleting millions of sites.

Nearly two decades have passed since GeoCities, founded by David Bohnett, made its debut, and there is no doubt that the internet is a very different place than it was then. No longer filled with webpages on random subjects made by passionate folks, it now feels like we live in a cyberspace dominated by skyscrapers—named Facebook, Google, Amazon, Twitter, and so on—instead of neighborhoods. Proponents of Web3, like Andreessen Horowitz general partner Chris Dixon, argue that we need to get back to what we had in the days of GeoCities—while also not giving up the advances of the Web2 years—and allow creators and businesses to form a relationship with their audiences that is not governed by algorithms and advertising. It’s yet to be seen if the version of Web3 backed by Dixon will ever materialize but it’s not looking good.

We can, however, ask GeoCities’ founder what he thinks of the internet of today, subsumed by social media networks, hate speech, and more corporate than ever. Bohnett now focuses on funding entrepreneurs through Baroda Ventures, an early-stage tech fund he founded, and on philanthropy with the David Bohnett Foundation, a nonprofit dedicated to social justice and social activism that he chairs. Right off the bat, Bohnett says something that strikes me. It may, in fact, be the sentence that summarizes the key distinction between the internet of the ‘90s-early 2000s and the internet we have today. “GeoCities was not about self-promotion,” Bohnett told Gizmodo in an interview. “It was about sharing your interest and your knowledge.”

Submission + - Too Many Servers Could Mean No New Homes in Parts of the UK (gizmodo.com)

An anonymous reader writes: Data centers have caused skyrocketing power demand in parts of London. Now, new housing construction could be banned for more than a decade in some neighborhoods of the UK’s biggest city because the electricity grid is reaching capacity, as first reported on by the Financial Times. The reason: too many data centers are taking up too much electricity and hogging available fiber optic cables. The Financial Times obtained multiple letters sent from the city’s government, the Greater London Authority (GLA), to developers. “Major new applicants to the distribution network... including housing developments, commercial premises and industrial activities will have to wait several years to receive new electricity connections,” said one note, according to the news outlet.

The GLA also confirmed the grid issue to Gizmodo in an email, and sent along text from one of the letters, which noted that for some areas utilities are saying “electricity connections will not be available for their sites until 2027 to 2030.” Though the Financial Times reported that at least one letter indicated making the necessary electric grid updates in London could take up until 2035. [...] “Data centres use large quantities of electricity, the equivalent of towns or small cities, to power servers and ensure resilience in service,” one of the GLA letters seen by the Financial Times reportedly said. [...] Developers are “still getting their heads round this, but our basic understanding is that developments of 25 units or more will be affected. Our understanding is that you just can’t build them,” said David O’Leary, policy director at the Home Builders Federation, a trade body. Combined, those sections of London contain about 5,000 homes and make up about 11% of the city’s housing supply, according the Financial Times.

Slashdot Top Deals

"The eleventh commandment was `Thou Shalt Compute' or `Thou Shalt Not Compute' -- I forget which." -- Epigrams in Programming, ACM SIGPLAN Sept. 1982

Working...