Forgot your password?
Close
typodupeerror

Comment Re:Color me surprised (Score 1) 94

Though I'm not sure heavier fines or criminal charges is really going to fix this, it's too easy for executives to rationalize away any risks.

The real fix is more funding for researchers (university and government) so they have the resources to investigate these things on their own. We shouldn't have to rely on companies policing themselves.

Submission + - US Designates Helium As a Critical Material (apnews.com)

Submitted by Anonymous Coward
An anonymous reader writes: The U.S. designated helium as a critical material on Friday because it’s indispensable for making semiconductors that are essential to energy generation, and the global supply is at risk of disruption, according to the Energy Department. The designation by the Energy Department means that more federal financing will be available for helium producers and that the government will monitor it more closely. Helium is primarily produced as a byproduct of natural gas processing. The United States is the world’s largest producer of natural gas and of helium. Qatar and Russia are the other top helium producers.

[...] Helium makes balloons rise, but that’s not why the DOE is interested in it. Helium plays an important role in wind, solar and nuclear energy production, space exploration, medical imaging and research. Assistant Secretary of Energy Audrey Robertson said helium’s unique properties make it irreplaceable, such as the fact that it’s non-combustible and has the lowest boiling point of any gas. The nation needs an ample supply for semiconductors, quantum and super computing, and superconducting magnets, added Robertson, who oversees the Office of Critical Minerals and Energy Innovation.

[...] Despite environmental concerns with recovering helium from natural gas, there are also opportunities, said Greeshma Gadikota, director of the Lenfast Center for Sustainable Energy at Columbia University. “If we burn the natural gas, there are a lot of CO2 emissions associated with that,” Gadikota said. “But if you just extract the helium and use it, the uses of it don’t contribute necessarily to greenhouse gas emissions. “So from a climate standpoint, if we are going to continue down the line of extracting natural gas and recovering helium,” she added, “I would prefer to see natural gas being used in a form where we directly produce hydrogen and we produce solid carbon.” Hydrogen is a clean burning fuel, and solid carbon can provide permanent carbon sequestration and can be used widely in industrial applications, including rubber and pigments.

Submission + - Was the PHP RCE vulnerability as serious as the hype suggested? (eliastaylor.com)

Submitted by karmawarrior
karmawarrior writes: Last week's panic about bugs in PHP resulted in numerous website outages and a lot of stress for the development, system administration, and infosec people. But... to date, no real proof of concepts appear to have been released. As Elias Taylor reports, discussing the three most starred PHP RCE proofs of concept on Github:

One really amusing thing in common with most of these "PoC"s is that they lean on "LFI", or local-file-inclusion, to make the vulnerability. In non-php terms, their exploit chain requires the server to already have a severe code-level vulnerability. It's not rare for PHP apps to be (broken) in some sense, but requiring the server to have an existing vulnerability where users could cat /etc/password is an insane pre-requisite. If you need this, this does not make this a severe bug.

Taylor suggest the issue is people outsourcing their judgement to Claude et al, with Claude finding the problem, telling the users (correctly) that technically it's an RCE issue, and the users failing to recognize judge the context. It certainly wasn't helped that a PHP core team member appears to have been one of the people who took the reports at face value, stating "exploits will start appearing 15 minutes after the patch drops." And, of course, PHP has a poor reputation for security, albeit largely over design issues than interpreter quality.

Submission + - BETA Technologies ALIA VTOL Earns Landmark FAA Airworthiness Certification (generalaviationnews.com)

Submitted by schwit1
schwit1 writes: The FAA has awarded BETA Technologies a Special Airworthiness Certificate that authorizes the ALIA 250 to conduct flight operations with prospective customers — the first such authorization granted to an electric vertical takeoff and landing (VTOL) aircraft.

BETA’s A250 is an all-electric VTOL aircraft designed to operate from locations with or without runway access. The aircraft has dual pilot controls and is designed to carry up to five passengers and more than 1,200 pounds of cargo, supporting missions across cargo and logistics, medical transportation, defense, and passenger operations, company officials said.

https://x.com/SecDuffy/status/...

Submission + - Can AI Develop a Personality Without a Conscience? (linkedin.com)

Submitted by gethotelreviews
gethotelreviews writes: AI can imitate personalities, adopt different styles and respond as though it has human qualities. But displaying a personality is not the same as possessing a conscience. What separates intelligence, behaviour and genuine character?

Submission + - New Operating System Uses Hardware-Based Memory Protection Model (frute.net)

Submitted by alternative_right
alternative_right writes: FRUTE asks what an operating system looks like when the CPU, language runtime, garbage collector, compiler, and authority model are designed together instead of bolted together after the fact.

Conventional systems make language runtimes recover structure from untyped words, make security policy chase ambient names, and make garbage collectors infer which machine values are pointers. FRUTE moves those facts into the architecture: values are tagged, authority is explicit, and Scheme is treated as a first-class systems language.

Most CPUs treat memory as undifferentiated bits, then ask every compiler, runtime, kernel, and debugger to remember what those bits mean. FRUTE values carry architectural tags, so the machine can distinguish pointers, fixnums, characters, capabilities, bitmaps, and runtime objects directly.

Submission + - One Shared Key Lets Phones Unlock or Immobilize 2 Million Cars (youtube.com)

Submitted by cortex
cortex writes: A WIRED Investigations video (YouTube) shows UC San Diego researchers discovering that dealer-installed KARR (and SWDS) aftermarket car alarms—estimated in more than 2 million U.S. vehicles, mostly from Southern California dealerships since around 2017—share a single Bluetooth authentication key. Anyone within Bluetooth range can use a simple reverse-engineered app to silently unlock doors, disable the alarm, honk the horn, flash lights, or immobilize a parked car so it won’t start, often without the owner even knowing the hidden under-dash module is present or active (it can still respond even if the paid service was declined). The vendor (Acrisure Protection Group) has released a manual firmware patch via the KARR smartphone app; owners can check for a KARR/SWDS window sticker or a blinking light under the dash. Full details in the accompanying WIRED story.

Submission + - Musk behind Starlink speed restriction after service in Ukraine is restored (apnews.com) 2

Submitted by fjo3
fjo3 writes: After Ukraine said the services had been restored, Elon Musk spoke out on the speed restrictions that began last week. In a post Saturday on X, Musk acknowledged that his company SpaceX throttled the Starlink satellite internet service.

“Using Starlink, a civilian commercial service, for offensive drone strikes to kill people has never been allowed, nor should it be,” Musk wrote. “Ukraine military violated Starlink terms of service and used it for offensive drone strikes to kill people. That loophole was closed last week.”

But he maintained that the U.S. government controlled whatever changes happened with Starshield, the military-grade version of Starlink that is the backbone of Ukraine’s drone operations and communication. He also defended the role of SpaceX in bolstering Ukraine’s defenses since Russia’s full-scale invasion of Ukraine in February 2022.

Submission + - Will AI expose the rickety infrastructure of the internet? (techcrunch.com)

Submitted by sziring
sziring writes: A startling announcement went out earlier this week: Due to recently discovered vulnerabilities in the open source programming language PHP, website owners had to immediately patch their sites â" or if they couldnâ(TM)t update right away, they should take the sites down to be safe.
On this weekâ(TM)s episode of TechCrunchâ(TM)s Equity podcast, Kirsten Korosec, Sean Oâ(TM)Kane, and I discussed the significance of the PHP-ocalypse and whether weâ(TM)ll see more incidents like this in the future.
Sean called this âoea real reckoning momentâ that highlights how âoewhen you get down to the bone level of the internet,â everything seems to be âoeheld together by glue and dreams.â And with widespread access to large language models and AI agents, itâ(TM)s only going to become easier to find these vulnerabilities. (That said, these specific vulnerabilities were found by human researchers, not AI models.)
Kirsten, meanwhile, wondered if weâ(TM)re about to see the âoenext level of prepper doom [â¦] because you could see how banks could get exploited, and [with] data and privacy concerns, it just feels a lot bigger than we can fix right now.â
Keep reading for a preview of our conversation, edited for length and clarity.
Sean Oâ(TM)Kane: The internet is breaking in lots of ways this week, it seems.
I think the best way to think about this, if people are coming into this kind of cold: How many times over the last 10 years have we had these moments where something breaks or something nearly breaks, where one person maintaining one tiny repro repository as a hobby or whatever happens to catch that something nefarious is going on and and saves us from the infrastructure of the internet completely crumbling?
Now multiply that by a billion, when people have access to not only extremely advanced software in the form of these LLMs that everybody uses, but also the ability to task them to go out and do it themselves, with creating AI agents that are single-minded at accomplishing those things.
Weâ(TM)re seeing a balance of two things happening this week. One is a bunch of the labs and companies like Google and OpenAI actually had people go out and find a bunch of vulnerabilities, including the one with PHP. And then we also have a bunch of people seeming to rush to take advantage of those vulnerabilities to try and hack into websites. So we have governments taking down websites, we have really popular websites that are going down briefly to be able to fix this vulnerability.
This is a real reckoning moment, where weâ(TM)re going to find out the downside risk of building so much of the internet on open source technology like PHP. When you really get down to the bone level of the internet, it is held together with glue and dreams.

Submission + - More suspect Post Office systems to be investigated

Submitted by Anonymous Coward
An anonymous reader writes: Suspect Post Office systems that came before Horizon to be investigated by the government

“The Department for Business and Trade has announced its investigation of faulty software used in Post Office branches before the controversial Horizon system”

‘“We are yet to finalise the scope of the investigation as a supplier has not yet been selected. We will be looking at a range of software and systems in place that pre-date Horizon,” said the government.’

Submission + - An AI Disconnect

Submitted by theodp
theodp writes: Jordyn Holman of the NY Times writes: When it comes to artificial intelligence, chief executives and their work forces aren’t seeing eye to eye. Corporate leaders, increasingly in earnings calls and interviews, tout productivity gains and say they are doing right by their workers as they roll out the technology. But workers are much more concerned about being supplanted, and they don’t trust their company’s executives.

A survey from the Milken Institute-Harris Poll Listening Project recently found that more than two-thirds of business leaders expect they will be better off financially in five years because of A.I., while just 27 percent of the U.S. work force felt the same way — a whopping 41 point gap. Workers also see less A.I. transformation than leadership does. Nearly three-fourths of leaders say A.I. has significantly changed the way work is done, compared with 58 percent of entry and midlevel employees, according to a report released this month from the Wharton School.

“We have corner offices and cubicles, driving the same economy, but living in completely different realities,” John Gerzema, C.E.O. of the Harris Poll, said in an email. “There is a gulf in hope between what leaders think A.I. could bring to companies and what employees feel it is taking away from them.” What might be worse is that C.E.O.s don’t seem to recognize the disconnect, or that they’re losing the trust of their workers.

Slashdot Top Deals

The reason why worry kills more people than work is that more people worry than work.

Close