SoylentNews

Arthur t Knackerbracket writes:

Full-disk encryption joins the toolkit, MATE and Xfce stay while Gershwin sits this one out:

GhostBSD, the easiest-to-install flavor of FreeBSD for the daemon-curious desktop dabbler, is back with a fresh update.

GhostBSD 26.2-R15.1p6, to give it its slightly unwieldy full version number, is based on FreeBSD 15.1. It brings a new installer, full-disk encryption support, a smaller installation image, and fixes across its desktop tools.

FreeBSD 15.1 was released back in June, and at the time of writing, it's the most recent point release of FreeBSD.

The original plan was that FreeBSD 15.1 would include the option of installing KDE Plasma directly from the setup program, so that the OS would have a graphical desktop from its very first boot. However, this feature isn't ready just yet.

That gap inspired Daemonarchy, which we covered late last month. But its Omarchy-derived, keyboard-driven tiling desktop can feel unfamiliar even to experienced Linux users accustomed to conventional desktops.

GhostBSD has different goals. It brings Linux-like desktop convenience to FreeBSD: a live graphical environment to explore before installation, a graphical installer, and tools for managing software and updates.

These conveniences are familiar to desktop Linux users, but a standard FreeBSD installation takes more work. Its text-mode installer leaves users to install and configure a graphical desktop themselves, if they want one.

This is just how the BSD family does things, and most BSD users we've talked to regard it as standard operating procedure and see nothing wrong with it. For Linux users who are curious about how things are on the other side of the FOSS Unix fence, though, those extra steps can form formidable barriers. GhostBSD is an attempt to lay down a welcome mat.

The standard edition of GhostBSD installs the MATE desktop, and the downloads page also offers a community-maintained version with Xfce instead. As the project said it would back in February, this release uses the XLibre fork of the X.org X11 server.

That's one fewer desktop than when we last tried GhostBSD in August 2025. That release also offered the Mac OS X-like Gershwin environment.

Arthur t Knackerbracket writes:

https://www.cnet.com/tech/vibe-coding-pdoom-tech-terms-guide/

I’m not that up to speed on today’s tech vocabulary. That realization clocked me over the head this week when the Scotland-based Collins dictionary came out with its list of new and notable words for 2026. The words include p(doom), which refers to the probability of AI-caused doom; mogging, meaning to outshine or upstage someone; friendslop, a type of low-budget video game played among friends; and ghost jobs, jobs advertised with no real position or intent to hire someone.

Vibe-coding, which was Collins’ Word of the Year for 2025, refers to a conversational way to teach an AI model without typing in all that pesky code. Enshittification, which the American Dialect Society chose as its 2023 Word of the Year, means the gradual, profit-driven decline in the quality of, well, I guess, everything.

Maybe you know and use these terms regularly; maybe you don’t. But, in an effort to stop myself from becoming that Steve Buscemi faking-it-in-high-school meme, I wanted to lay out some tech terms that have a permanent home in the popular lexicon and the words, phrases and abbreviations that haven’t quite stood the test of time. (Note to self: Stop saying “emoticon.”)

Selfie: You know what a selfie is; my mother, on the other hand, may not. The word for taking a photo of yourself with any camera-enabled device was first coined in 2002 on an Australian internet chat forum, of all places, but didn’t become mainstream until 2013.

Content creator: “Influencer” also works here, to refer to a person who shares information on a tech platform and builds an audience of online followers. A related word, “parasocial,” refers to the one-sided relationship listeners or viewers may have with the creator or influencer, who, in contrast, doesn’t know they exist.

Podcast: The Oxford Dictionary named podcast the Word of the Year back in 2005. Since then, the term, which is a mashup of iPod and broadcast and refers to a digital program made available on-demand for streaming or download, has remained relevant. The iPod, however? Not so much. It was discontinued in 2022.

WFH (work from home): The trend of working from your own home via computer saw a substantial uptick during and after the 2020 COVID-19 pandemic. According to a 2022 survey by the US Bureau of Labor Statistics, 23% of Americans work remotely.

Unfriend: The New Oxford American Dictionary‘s 2009 Word of the Year became popularized thanks to Facebook, but the term that means ending a friendship has actually been around for quite some time. NPR called it “the Sleeping Beauty of words,” as the term dates back to the 17th century, when it basically meant the same thing.

"Arthur T Knackerbracket" writes:

Turns out throwing billions at GPUs doesn't automatically mean everyone gets more done:

Despite the billions being thrown at artificial intelligence, the technology has delivered little in the way of productivity gains for UK businesses, according to the Bank of England.

In its latest Monetary Policy Report, the central bank found that AI has increased UK productivity by an estimated 0.5 percent over the past three years. That works out to just 0.1 to 0.2 percentage points of additional annual productivity growth since early 2024, hardly the economic revolution Silicon Valley has been promising.

"AI investment appears to be contributing somewhat to current demand strength, but so far there is only evidence of a modest AI-driven rise in UK productivity growth," the Bank said.

Even industries supposedly best placed to benefit from the technology have little to boast about. Productivity growth has improved in AI-heavy sectors such as information and communications, but has yet to exceed pre-pandemic averages.

That's not to say AI isn't doing anything for the British economy. The bank estimates that AI-related activity has accounted for just under a fifth of UK GDP growth since the beginning of 2026, though much of that appears to come from companies developing and deploying the technology rather than businesses becoming more productive by using it.

"The contribution to growth from AI to date appears to reflect activity in the upstream development and implementation of AI technologies rather than broader gains from their adoption elsewhere in the economy," the report said. In other words, selling AI is proving rather more lucrative than actually using it.

The bank also cautioned against giving AI too much credit for Britain's recent productivity improvements. Much of the increase appears to reflect businesses hiring fewer workers while output continues to grow, partly as companies unwind post-pandemic staffing decisions and respond to higher employment costs. 

Software optimizes a physical model of the telescope to reduce noise:

With a huge and still-growing catalog of exoplanets, researchers are anxious to take the next steps: trying to infer what conditions are like on them, either by imaging them directly or by capturing the light that has passed through their atmosphere. Both are substantial challenges, given the presence of stars that are far, far brighter than light that has come to us via the planet.

While telescopes can be fitted with devices called coronagraphs that block out much of a star's light, there are limits to their effectiveness, caused by noise from subtle variations in the telescope's configuration and pointing between observations. Now, researchers have developed a new software package that optimizes a physical model of the telescope in a way that allows us to better model these differences, producing low-noise imaging of exoplanets.

Central to this work is the concept of a point spread function. If you use a telescope to image a single point of light, it will not appear that way in the actual image. Instead, it will be slightly blurry and spread out, due to imperfections in the telescope hardware and the limits of our ability to keep it pointed accurately through the time it takes to image something. The mathematical description of how a telescope distorts a point of light is called its point spread function.

There are two ways to figure out what the point spread function is. One is to use the telescope to image a known target and use those observations to derive a mathematical description of the point spread function. This is effective at reducing noise but has its limits, as the behavior of the telescope hardware can change over time, and the point spread function may vary with the wavelengths being imaged.

The alternative is to try to model the hardware's behavior and use that model to derive a point spread function. But modern telescopes are incredibly complicated instruments, with many, many factors feeding into their performance in ways that can be difficult to ascertain, even with the full engineering schematics. As a result, these models simply contain too many parameters that need to be tuned to make this route computationally tractable.

But anyone paying attention to the world of AI developments will recognize that we've become quite successful at tuning billions of parameters in neural networks, in part through a mathematical technique called gradient descent. And, because this is central to training large neural networks, people have put a lot of work into optimizing the performance of gradient descent on GPUs.

"Arthur T Knackerbracket" writes:

https://www.theregister.com/networks/2026/11/06/ai-agents-are-a-bane-for-some-website-operators-says-cloudflare/5308022

Nation-state actors and criminals likely exploited the PHP2SHELL vulnerability before its disclosure, according to Cloudflare CEO Matthew Prince.

"These vulnerabilities, like the PHP vulnerabilities that were disclosed the other day, had been in the wild for years," Prince said on the company's third quarter earnings call. "We're going back through our logs looking for any evidence that hackers or nation-state actors or others had been using them in the past. I know that we're going to find examples of that."

That was just one of the warnings he offered on the call, among them that some of Cloudflare's customers believe AI agents are "a bane to their business and want to keep them away."

To explain why, Prince hypothesized that he could use an agent to find him a restaurant to eat at after he finishes his day of investor relations duties.

"It might go and scour the internet and look at 1,000 different restaurants' websites, pull down 1,000 different menus, and then I might choose to only go to one of those," he said. "The problem is that 999 of those restaurants have now had a cost that is just been applied to them, but they are not getting any benefit."

The CEO admitted that web searches have always driven some low-value traffic but feels the volume of agentic activity – which Cloudflare has previously predicted will be one thousand times greater than clicks from humans – means the problem is now at a different scale.

Prince also had bad news for Kubernetes aficionados, because he thinks containers might become another casualty of the agentic age.

The CEO allowed that containers are "a significant improvement over bare metal or even virtual machines," and said they fueled the growth of hyperscale clouds and mobile applications. But he thinks containers are already cooked.

"The container-based architecture of the hyperscalers and neoclouds just can't keep up in a cost-effective way with the new agentic paradigms of today," he argued, again citing the 1000:1 ratio of bot:human traffic Cloudflare expects to see online any year now.

That's a Cloudflare-centric view, because Prince pitched the company's serverless "Workers" service as an alternative to containers. The company also offers products that can either block agents, ameliorate the cost and traffic impacts of agentic activity, or allow organizations to monetize traffic generated by AI.

Prince said demand for those products is growing fast, claiming that since July 1^st, "approximately five percent" of the web opted in to Cloudflare's content protection products. The CEO said Meta is already a customer, and said Zuck's new "Muse" agents will benefit Cloudflare by creating more agentic traffic that third parties want to tame.

He also pointed to year-on-year revenue growth of 39 percent, which saw quarterly revenue reach a record $782.5 million.

And he thinks there are better days ahead, due to the terrible state of security.

"It may seem like the sky is falling with the number of new security vulnerabilities that have been reported over the last few weeks," Prince said. "I wish I could tell you we were through the worst, but we're not."

He thinks Cloudflare can profit from security misery because the extent of its activities and client base mean it is "among the first to receive quiet disclosure of new vulnerabilities" and remediates them before disclosure.

Investors thought this all made sense, and in after-hours trading sent Cloudflare shares up by around 15 percent, meaning it recovered and then improved on losses that it incurred earlier after major US indices dropped around four percent as investors who worry tech stocks are overvalued. ®

Original Submission

Arthur t Knackerbracket writes:

Nintendo's Switch 2 sales fell by almost 40 percent in the first two quarters of its fiscal year, ending September 30, compared with the same period last year. In the earnings report the gaming company released, it said it sold 6.49 million units over six months — 3.82 million in the first quarter and 2.67 million in the second quarter. That figure represents a 37.4 percent decrease, as it sold 10.36 million Switch 2 consoles over the same period during its previous fiscal year.

However, the Switch 2 launched on June 5, 2025, and Nintendo expected strong demand in the months after its release. In its latest earnings report, the company said that "many consumers continued to adopt the system, spurred on by factors like the release of new titles," despite the sales decline.

The earnings report covers a six-month period starting in April this year, just a month before Nintendo raised console prices. In early May, the company announced that it was raising the price of the Switch 2 by $50 to $500 in the US due to higher memory costs and US tariffs. Despite lower console sales, Nintendo's net profit rose 11 percent from a year earlier, thanks to strong software sales and the success of the latest Super Mario movie.

Nintendo is maintaining its current forecast of 16.5 million Switch 2 units for the current fiscal year, suggesting it anticipated lower sales and factored in the console's release hype. That figure is almost 17 percent lower than the 19.86 million units it sold last year. The remake of Ocarina of Time went on sale this week and is set to be one of the biggest launches on the Switch 2 this year. We liked it.

Original Submission

janrinok writes:

https://www.theregister.com/security/2026/11/05/feds-warn-grocers-dont-chill-on-cyber-defenses-as-freezer-hacking-spree-heats-up/5307978

If you have any industrial smart freezers, look out. The US federal government is urging owners and operators to disconnect them from the internet, apply patches, change default passwords, and take other security measures to prevent the kind of attacks that have become prevalent in Europe.

"We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk," FBI Cyber Branch Operations Director Brett Leatherman said in a statement.

Since mid-October, unknown miscreants have hacked thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg, and Sweden. The attacks increase the temperature inside fridges to highs of 50ºC (122°F), spoiling food, and sparking fires.

The Register asked the FBI if it has documented any successful or attempted attacks against refrigeration and cold chain monitoring systems in America. We had not received a response to our questions at the time of publication, nor are we aware of any documented digital attacks against these systems in American supermarkets.

But there are signs that stateside operators are aware of the issue.

Dutch grocery giant Ahold Delhaize, which operates US supermarket chains Food Lion, Giant Food, and Stop & Shop, last month said it proactively took IT systems offline following a cyberattack that affected most of its US and European brands.

Delhaize supermarkets in Europe are among those hit by the destructive freezer attacks. 

The Pentagon is also reportedly treating a series of freezer malfunctions that spoiled food at military bases across the US in August as a suspected cyberattack, according to Reuters, which cited four officials familiar with the matter.

In a Thursday advisory, the US FBI, Cybersecurity and Infrastructure Security Agency (CISA), Health and Human Services, and departments of Agriculture and Transportation warned organizations about the ongoing cyber threats facing operators of industrial refrigeration and cold-chain monitoring systems. 

"The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards," the agencies said.

Attackers exploit these flaws by bypassing authentication, injecting arbitrary code, and abusing weak configurations, according to the feds. Once criminals gain access to the systems, they can change the temperature to spoil food or temperature-controlled medications, start fires, and ultimately harm people who consume products that haven't been stored at proper temperatures.

To prevent these scenarios, the government organizations urge owners and operators to "immediately" implement best practices and security protections. First and foremost on the list: do not expose industrial control systems and devices to the public internet. 

Iranian hackers used internet-accessible programmable logic controllers (PLCs) to break into more than 100 US water systems in July. This sort of exposed device, which often lacks password protection, is a boon to miscreants looking for an easy button to gain access to critical facilities.

"Should remote access be necessary, protect it by using a firewall or edge device and updating it to the latest version to reduce security vulnerabilities," the feds advise.

Other recommended tactics include:

Create a dedicated VLAN for operational technology (OT) devices, to isolate industrial devices from business networks.

Replace default passwords with strong passwords and policies, turning on phishing-resistant multifactor authentication (MFA) whenever possible.

Apply patches in a timely manner, and retire and replace legacy devices that no longer receive security updates from the manufacturer. 

Define and maintain a device and IP allow-list, and limit access to OT devices to only those on the list. 

Maintain and test backups. These should be kept offsite and offline.

And finally: enable logging and regularly review logs for any unusual activity.

Original Submission

Arthur t Knackerbracket writes:

Campaigners against datacenter expansion are planning two days of coordinated action across Europe on November 6 and 7, demanding an immediate moratorium on new large-scale developments.

Following the US midterm elections, where restrictions on massive AI server farms were prominent in the campaigns from candidates in both major parties, it's now Europe's turn. Over 100 groups across 15 European countries will protest the boom in bit barn building over the next couple of days.

As well as demonstrations, there will be public meetings, stalls, petitions, walking tours, cycle rides, poetry readings and other creative actions, the organizers say.

The coalition of groups has put up a website – stopdirtydatacentres.eu – with an interactive map allowing anyone to find information on the events taking place and where.

In the UK, there is a photocall planned at 8am on November 6 outside the Department for Energy Security and Net Zero (DESNZ) in Whitehall Place in central London, but also a Community Day of Action the following day at London's Brick Lane, where a facility is planned on the site of the former Truman Brewery.

Also on November 7, there will be a "family event" at St Michaels & All Angels Church in Great Torrington, Devon, to highlight the massive 1.5 GW data campus and on-site battery energy storage that is planned for 850 acres of farmland near the town.

The planned actions are a response to growing concerns about the impact of the wave of new compute shed projects on local communities, public infrastructure, land, water and energy use, housing, jobs and the cost of living.

Such concerns won't have been helped by recent events, such as a Google subsidiary reportedly felling 250,000 trees illegally in Finland to clear the ground for a server hall.

The campaigners claim that governments, the European Union and the tech giants are gambling with the future by racing ahead with server farm developments without proper scrutiny of the environmental, democratic and social impacts they might have.

A recent report found that businesses and private-sector trade associations dominated meetings with UK ministers to discuss datacenters, while environmental groups didn't get a look-in.

Campaigners are calling for an immediate moratorium on new large-scale projects across Europe, until clear frameworks are in place to determine whether new facilities should be built and under what conditions, with proper scrutiny and meaningful public participation.

"Datacenter developers in the UK and Europe want to cash in on the AI goldrush whatever the consequences. But communities everywhere are fighting back, seeing through Big Tech's PR machine and calling this what it is – a massive grab of scarce land, water and power resources by Silicon Valley billionaires," said Oliver Hayes, Head of Campaigns at Global Action Plan (UK).

"With governments failing to answer very basic questions about how many datacenters we need, what for, where, and how pollution will be avoided, the only reasonable course of action is an immediate moratorium," he said in a supplied remark.

They are unlikely to get much sympathy from the British government, which has pegged its hopes for economic growth on AI and wants more bit barns built to fulfil this. It has already used its powers to overturn rejections of planning permission for server farm projects by local councils.

Omdia analyst Alan Howard argues that datacenters also became a convenient political target during the US campaigns.

"The datacenter industry took a big hit in the US midterm elections which is quite disappointing, but not that surprising," Howard told The Register.

"The anti-datacenter rhetoric accelerated 12 months ago and in the last six months skyrocketed. While there have been many catalysts to point our fingers at, datacenters turned into an opportunistic political football. To be blunt, there is no shortage of politicians willing to exploit any opportunity to win an election and the datacenter 'problem' showed up just at the right time for this election."

Planned actions across Europe include events in Ireland, Poland, Denmark, Finland, Spain, the Netherlands, France, and the UK. A march to the Scottish Parliament in Edinburgh is also pegged for the following weekend, November 14. ®

Original Submission

looorg writes:

An Italian chef sacked from a Brisbane restaurant had refused to put pineapple on a pizza because it was an "insult to his culture".

In general I get the impression that Italian food culture is not to thrilled about what the rest of the world have done with their dishes. They from what I can tell are not thrilled about kebabpizza either. But Pineapple, or Pineapple and Ham (locally, and probably in most places, referred to a Hawaii pizza) seems to be considered the most atrocious and crime against Italian cuisine.

Pineapple on pizza -- yay or nay? I'll go with yay. It's delicious.

https://www.bbc.com/news/articles/cx4g1qy6gq9mo

Original Submission

Arthur t Knackerbracket writes:

As robotaxis continue trials in London, an independent research group thinks the UK needs to answer some serious questions before heading any further down the road.

To kick off, the sovereignty question, or "Will Britain become dependent on autonomous vehicle services for any key activities and what fallback options will exist if a supplier fails or withdraws?" as the Institute for Driverless Transport (IfDT) puts it.

Another question concerns employment: "To what extent does professional driving form part of the UK's employment safety net and how will this function be recreated if demand for professional drivers is significantly reduced?"

The objective for IfDT — an independent UK research and convening body focused on the consequences of autonomous vehicles — is to cast the net a bit wider than simply thinking about whether the software is sufficient to navigate London’s wiggly streets and narrow alleys.

The research draws on work with operators trying to bring AVs to London and the regulators responsible for policy. It also relied on more than 30 conversations with councils, operators, industry, unions, charities, insurers, lawyers and universities.

James Hutt, IfDT co-founder, said: "What struck us most in the interviews was how far this reaches: into jobs, public services, the built environment and national resilience. The people who know those areas best are rarely part of the conversation about AVs.

"Our next step is to bring funding and researchers together with the businesses and public bodies that need answers. If you can fund research or offer a place to test it, we would like to hear from you."

In August, Transport for London (TfL) granted private hire licences to autonomous vehicle operators provided that a human driver is present during journeys.

Wayve and Uber have since launched self-driving rides in the UK capital, with 15 electric Ford Mustangs, equipped with the Wayve AI driver, set to pick up passengers with a safety driver on board.

UK company Wayve also demoed a Nissan LEAF, running the Wayve AI Driver using NVIDIA DRIVE Hyperion with self-driving equipment built more closely into the car's design.

IfDT points out that Waymo and Baidu are also preparing services for London, while Uber, Pony.ai and Verne have begun testing in Manchester.

The research organization said UK authorities still need to answer a long list of questions in order to shape long-term infrastructure plans for local areas and prepare for AI's impact on the labor market.

The question of who needs to do this also remains unanswered, as the IfDT asks:

"Which are the key public bodies that should already be anticipating the impact of AVs on their own work and who within those organisations should lead a response?"

Original Submission

Arthur t Knackerbracket writes:

Ericsson is bringing drone detection to mobile networks, analyzing radio signal reflections to identify and track low-altitude objects. 

The telecoms infrastructure maker says its Integrated Sensing and Communication (ISAC) tech adds detection to existing mobile networks, closing a security gap in tracking low-flying, fast-moving objects such as drones.

Following tests over the past few months, Ericsson says it will introduce the tech commercially in phases. Small-scale, sensing-only pilots with selected customers will start in 2027, followed by broader deployments from 2028.

CCS Insight research director Ian Fogg, said told The Register: 

"While sensing can be used for other things — like tracking boats in a port, traffic patterns or weather conditions — drone detection [in civilian areas] is the most pressing need which cannot easily be solved using other technologies.

"Mobile networks are useful as drone detection solutions because their antennas are already covering low elevations, close to ground level where drones often fly, unlike traditional radar."

Although it is possible to use 5G networks for sensing, a standards-based 6G method could improve precision by letting different suppliers' base stations "interoperate", alongside a mix of client devices, tracking the "smallest and fastest moving drones in difficult environments," Fogg added.

"The new spectrum that should arrive with 6G will also make it easier to deploy sensing on wide channels which further improves detection accuracy," he said. 

Small, low-cost drones have emerged as a persistent threat, or at the very least a nuisance, closing down airports due to safety concerns - the latest incident was at Jersey Airport over the Halloween weekend. Drone activity has also been on the increase near to military bases and other sensitive sites.

Dedicated sensor systems were deployed to cover sensitive sites, and in the UK, military personnel have now been granted the authority to neutralize any unwanted flying intruders.

Scaling detection across larger areas, however, is more challenging, Ericsson said.

ISAC transforms mobile network infrastructure into a distributed sensor array. Using sensing-enabled 5G radios, edge computing and signal processing, a cell deployment can detect objects and track them across the coverage area, complementing radar and other sensors rather than replacing them.

Ericsson says the tech works by having multiple perspectives from a number of cell tower radio sites. When one transmits a signal, it reflects off the drone and is picked up by multiple receiving sites. The network then analyses the reflected signals to locate the drone and track it.

ISAC requires sensing-capable radio hardware, dedicated compute resources, and software, says Ericsson. The radios have to meet specific Massive MIMO (multiple-in, multiple-out) antenna and spectrum requirements.

AT&T tested ISAC at trials in Arlington, Texas, and with Erillisverkot, a state-owned special purpose company responsible for national critical communications in Finland. In both cases, the tech demonstrated it was able to detect multiple drones and track their movements, according to Ericsson.

Data from ISAC - we're told - can be securely shared through standardized interfaces with authorized external systems, including security and command and control systems.

Original Submission

quietus writes:

The Democrats are carrying both House and Senate in the midterms.

Democrats have made clear that [...] they'll investigate private-sector dealings with the Trump Administration. The Office of Legal Counsel of the DoJ already issued a memo stating that certain presidential communications with private parties could be shielded from congressional discovery.

The private parties involved ... well, that's a long list.

On the investigative menu for now are the federal use of commercial spyware and hacking, consumer access to mobile immigration enforcement-monitoring applications, alleged political interference in news coverage, university settlements with the Trump Administration, protections against military AI use for domestic surveillance and autonomous lethal operations, reported errors in AI-assisted intelligence and military operations, expanded access to sensitive U.S. technology for the United Arab Emirates following investments in a Trump-family cryptocurrency venture, the use of a major dollar-pegged stablecoin in Iran's shadow banking network, potential sanctions violations, online safety, automated consumer pricing, prediction markets, data center water infrastructure costs, potential for increased electricity demands by datacenters, plans to open federal lands to data center development, environmental impact of datacenters, data center developers use of NDA's with state and local officials, including restrictions on public disclosure, tax benefits supporting AI development and related lobbying, AI breaches of third-party platforms, data collection, retention, sharing, and safeguards by surveillance technology companies like Flock, law enforcement abuse of these same technologies, customer protections and market integrity in sports-event prediction markets, payments to online influencers for spreading election disinformation, algorithmic and surveillance pricing, the use of personal information and AI use to set prices, and on and on and on.

(I'd link to the different Senate and House Committees that are already working on this, but for some reason these sites suddenly have considered me, at first, a security risk, then gave me 304s.)

On a related note, on the other side of the ocean, things are looking to get even more interesting for Big Tech too: Gemini is getting into focus for copyright violations [PDF].

Original Submission

slon writes:

I got this using a bot.

https://www.siliconrepublic.com/machines/ucd-physicist-stacking-quantum-materials-lego-women-invent

UCD's Dr Nuala Caffrey discusses her current work in quantum, the problems she aims to solve and how fundamental research can be turned into practical technologies.

“My interest started with a love of solving maths problems in school and the satisfaction of getting the right answer,” said Dr Nuala Caffrey, an assistant professor for the School of Physics at University College Dublin (UCD). 

Hailing from a rural agricultural background, a career in physics research was, initially, never on her radar, she just knew how much she enjoyed studying mathematics. When it came time to fill out the CAO form, theoretical physics was the only degree option she put down.

Caffrey told SiliconRepublic.com, “I was drawn to the elegance of theoretical physics, for example, seeing Maxwell’s equations in their compact four-vector form, which describe everything from light to electronics.”

These are the fundamental equations associated with electrodynamics and can be used to calculate electrical and magnetic effects. 

She added, “A summer undergraduate research project in Stefano Sanvito’s group introduced me to materials-based condensed matter physics, which I hadn’t known existed and led to a PhD in that group in computational spintronics. 

“That project showed me that the properties a material can have, from magnetism and superconductivity to superhardness and transparency, are not arbitrary but can be explained by the arrangement of its electrons.”

For Caffrey, computational materials modelling offered the best of both worlds, in which she could build models of varying complexity and use them to determine or predict how a real material might behave. 

She said, “It lets me see the mechanism that is pulling the levers. Once you understand that, you can start to pull the levers yourself and design materials with the properties you want.”

Currently, Caffrey’s focus is on the computational design of quantum materials, primarily materials with the potential to be used in the creation of future quantum technologies, or materials with properties that can only be explained by quantum physics.

She said, “Much of my work comes back to spin, a quantum property of electrons that is a natural building block for quantum information and to finding ways of controlling it. In a recently funded Research Ireland project called Quantum Lego, we’re designing materials just one atom or molecule thick that can be stacked like Lego plates, so that the whole is greater than the sum of its parts. 

“More specifically, we place flat networks of metal atoms and organic molecules on top of other layers that can be magnetised or electrically switched, with the aim of controlling the spin of the network on demand. In a similar vein, I study spin crossover crystals, made of molecules that can flip between two magnetic states.” 

She noted, through the newly established Rinn Quantum centre, she is beginning to approach research from another direction, “using today’s early quantum computers to simulate quantum materials themselves”.

"c0lo" writes:

Eiliko and its manufacturer, Energize Lab, are seemingly not to be trusted:

There's a new digital pet in town — a cute little marshmallow of a robot that can change its cartoony expressions to match your mood. But if you or your kids talk to "Eiliko" over Wi-Fi, it'll phone home to China. Its AI companion can store literally everything you tell it on Chinese servers, where hackers can easily gain access or even hijack its personality. And the company that made it, Energize Lab , doesn't seem to care.

I bought an Eiliko from Amazon on August 29th. During a 10-minute conversation on August 30th, I asked the little bot: "Do you ever tell anybody else what I'm saying?"

"Your secrets are safe with me," it replied.

Within minutes, a man on the other side of the planet had a complete transcript of everything I'd told the toy.

He didn't just have my conversations, either. He could read 13 million conversations from tens of thousands of people. He could access seemingly the entire active worldwide fleet of 68,000 robot toys. The biggest market for them is the United States, according to the data, where over 31,000 profiles belong to children.

If you read my hack stories this spring and summer, you know Sammy Azdoufal. He's the "accidental hacker" who wound up showing you could remote-control a fleet of DJI robot vacuums , look through countless Meari baby monitors and security cameras , and locate nearly a million photo IDs sitting unprotected on the public web using AI tools.

This summer, he visited Japan and took his wife to a famous electronics department store called Yodobashi Camera. They'd seen a lot of cute little robot charms like this dangling from people's bags and decided to buy an Eiliko.

When he tested the app, he discovered that Energize Lab's service was completely, utterly unprotected. Worse, it was intentionally profiling its users around the world.

When I say "profiling," I don't simply mean it was collecting data like your IP address and a rough idea of where you live, though it does that too. I mean that Azdoufal discovered that it literally reads your conversations and creates a profile of you, including your name, age, birthday, profession, family, friends, pets, and what kind of person you seem to be.

Arthur t Knackerbracket writes:

North Korean cryptocurrency thieves tricked a Binance software engineer into downloading malware onto their work-issued computer during a fake job interview process before last week's record-breaking $6.3 billion heist.

In an incident report published on Tuesday, the cryptocurrency exchange said several techniques - including social engineering via fake job interviews, malware downloads, compromised internal AI tooling, endpoint takeover, and an "advanced transaction-authorization method" - led to the October 29 security breach.

"Our current investigation indicates that this was a sophisticated, multi-stage campaign," the incident report said. "It was not a single isolated breach or a simple phishing incident."

Over the weekend, the FBI attributed the theft to TraderTraitor, a North Korean hacking operation linked to Lazarus Group, known for combining espionage with massive cryptocurrency heists. The Pyongyang-backed crew is also highly adept at job market scams - both posing as IT workers, who are then hired by Western companies, and as potential employers to lure software engineers into downloading malware and infecting corporate devices.

With the recent Binance attack, the Norks used the latter.

The attack prep began back in June with a supply chain attack when one of its engineers downloaded a malicious Homebrew installation. While the malware was detected by the security team, the device was replaced, and all affected credentials rotated, "Engineer A's role and his related colleagues on our wallet infrastructure team was exposed to the hacker," the report says.

Three months later, the social engineering part of the attack happened.

In September, another software engineer was contacted via a "legitimate job-hunting platform" by someone purporting to be a project director who arranged a series of job interviews for the Binance engineer with the fake company. During the first round - a live video interview with the engineer and a fake HR rep - the interviewer "shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust," according to the report. "This was more advanced and deceptive than previously seen social engineering approaches."

The second interview with someone purporting to be the CEO of the phony company was conducted on a "popular social chat app," and toward the end, the CEO instructed the engineer to download an "assignment" containing a malware-laced code repository. The code executed on his work computer during the setup process, which kicked off a series of unauthorized activities.

According to Binance, the malware replaced a legitimate development tool component with a malicious version, which executed commands and established communication with an attacker-controlled external server. The attackers also took steps to hide the malicious script and evade detection, and it worked. Binance's endpoint security tools did not immediately detect the malware.

Here's the script:

CREATE  /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_  

MODIFY  pyenv_ → 3,414 B  

DELETE  .../libexec/pyenv  (3,344 B)      ← remove the valid pyenv

RENAME  pyenv_ → pyenv  (3,414 B)  ← replace it with a malicious version

DELETE  /opt/homebrew/bin/pyenv  (3,414 B)

ln  (create a new symlink)  +  spawn zsh

Then, on October 20, the miscreants used the compromised computer and an internal AI tool to gain access to the computers of wallet DevOps engineer A and another wallet software developer, Engineer C.

Engineer A had a container deployment permission token on his computer, which the Norks soon discovered. On October 29, the attacker accessed Engineer C's computer, used the stolen credentials from Engineer A to deploy a container, and triggered a script to launch the cryptocurrency-stealing attack.

As of Tuesday, Binance said it has rebuilt the compromised wallet system and internal AI tool, and replaced all of the affected devices. It also decommissioned all credentials and tokens assigned to the compromised engineers, and is working with law enforcement, blockchain intel firms, and security researchers to trace and freeze the assets.

The crypto exchange has also hired independent cybersecurity experts to conduct a cybersecurity review of the incident, and recommend additional protective measures. Binance said it's also working to establish a security research fund and initiatives with AI companies and security shops to focus on AI security in blockchain environments.

Original Submission