Stories
Slash Boxes
Comments

SoylentNews is people

Log In

Log In

Create Account  |  Retrieve Password


Site News

Join our Folding@Home team:
Main F@H site
Our team page


Funding Goal
For 6-month period:
2022-07-01 to 2022-12-31
(All amounts are estimated)
Base Goal:
$3500.00

Currently:
$438.92

12.5%

Covers transactions:
2022-07-02 10:17:28 ..
2022-10-05 12:33:58 UTC
(SPIDs: [1838..1866])
Last Update:
2022-10-05 14:04:11 UTC --fnord666

Support us: Subscribe Here
and buy SoylentNews Swag


We always have a place for talented people, visit the Get Involved section on the wiki to see how you can make SoylentNews better.

The Best Star Trek

  • The Original Series (TOS) or The Animated Series (TAS)
  • The Next Generation (TNG) or Deep Space 9 (DS9)
  • Voyager (VOY) or Enterprise (ENT)
  • Discovery (DSC) or Picard (PIC)
  • Lower Decks or Prodigy
  • Strange New Worlds
  • Orville
  • Other (please specify in comments)

[ Results | Polls ]
Comments:84 | Votes:89

posted by martyb on Friday September 24 2021, @10:48PM   Printer-friendly
from the live-by-the-sword-and-die-by-the-sword dept.

Apple turns post-lawsuit tables on Epic, will block Fortnite on iOS:

Weeks after Epic's apparent "win" against Apple in the Epic Games v. Apple case, Apple issued a letter denying Epic's request to have its developer license agreement reinstated until all legal options are exhausted. This effectively bans Fortnite and any other software from the game maker from returning to Apple's App Store for years.

Epic was handed an initial victory when the US District Court for Northern California issued an injunction on September 10 ordering Apple to open up in-game payment options for all developers. At the time, the injunction was something of a moral victory for Epic—allowing the developer to keep its in-game payment systems in its free-to-play Fortnite intact while avoiding paying Apple a 30 percent fee that had previously covered all in-app transactions.

But now Epic has faced a significant reversal of fortune.

The better thing would be to ban all micro-transactions. Instead this is more like a couple thieves divvying up the loot from the candy they stole from children. Sure, they didn't "steal anything", but kids aren't allowed to play the slot machines in Casinos, either.

Previously:
Apple Can No Longer Force Developers to Use In-App Purchasing, Judge Rules
Valve Gets Dragged into Apple and Epic’s Legal Fight Over Fortnite
Judge Dismisses Apple’s “Theft” Claims in Epic Games Lawsuit
Microsoft Thumbs its Nose at Apple With New “App Fairness” Policy
Your iPhone Copy of Fortnite is About to Become Out of Date [Updated]
Judge Issues Restraining Order Protecting Unreal Engine Development on iOS
Microsoft Issues Statement in Support of Epic Games to Remain on Apple Ecosystem
Epic-Apple Feud Could Also Affect Third-Party Unreal Engine Games
Fortnite Maker Sues Apple after Removal of Game From App Store


Original Submission

posted by martyb on Friday September 24 2021, @08:02PM   Printer-friendly
from the laser-cooking dept.

Engineers Figured out how to Cook 3D-printed Chicken With Lasers :

Who hasn't dreamt of coming home after a long day and simply pressing a few buttons to get a hot, home-cooked 3D-printed meal, courtesy of one's digital personal chef? It might make microwaves and conventional frozen TV dinners obsolete. Engineers at Columbia University are trying to make that fantasy a reality, and they've now figured out how to simultaneously 3D-print and cook layers of pureed chicken, according to a recent paper published in the journal npj Science of Food. Sure, it's not on the same level as the Star Trek replicator, which could synthesize complete meals on demand, but it's a start.

[...] The scientists purchased raw chicken breast from a local convenience store and then pureed it in a food processor to get a smooth, uniform consistency. They removed any tendons and refrigerated the samples before repackaging them into 3D-printing syringe barrels to avoid clogging. The cooking apparatus used a high-powered diode laser, a set of mirror galvanometers (devices that detect electrical current by deflecting light beams), a fixture for custom 3D printing, laser shielding, and a removable tray on which to cook the 3D-printed chicken.

[...] The results? The laser-cooked chicken retained twice as much moisture as conventionally cooked chicken, and it shrank half as much while still retaining similar flavors. But different types of lasers produced different results. The blue laser proved ideal for cooking the chicken internally, beneath the surface, while the infrared lasers were better at surface-level browning and broiling. As for the chicken in plastic packaging, the blue laser did achieve slight browning, but the near-infrared laser was more efficient at browning the chicken through the packaging. The team was even able to brown the surface of the packaged chicken in a pattern reminiscent of grill marks.

YouTube vidoes #1 and #2.

Journal Reference:
Jonathan David Blutinger, Alissa Tsai, Erika Storvick, et al. Precision cooking for printed foods via multiwavelength lasers [open], npj Science of Food (DOI: 10.1038/s41538-021-00107-1)

Paper Title: Precision cooking for printed foods via multiwavelength lasers
DOI: 10.1038/s41538-021-00107-1


Original Submission

posted by martyb on Friday September 24 2021, @05:17PM   Printer-friendly
from the mcdonalds-in-space dept.

Congress to NASA: What comes after the International Space Station?

Questions of how long the station — already over 20 years old — can last and how international and industry partnerships might drive activity in low Earth orbit (LEO) filled a two-hour hearing held by the House Science, Space and Technology's subcommittee on space and aeronautics on Tuesday (Sept. 21). The International Space Station partners are currently committed to operating the orbiting laboratory until 2024. NASA has long argued that the facility is safe to occupy until at least 2028 and the U.S. space agency's Administrator Bill Nelson has endorsed keeping the station operational until 2030.

But some worry that pushing the lab so far beyond its design lifetime is courting disaster, particularly as a string of incidents have shown the facility's wizened age. (Construction of the station began in 1998.)

[....] "We did experience a gap in our transportation system when we retired the shuttle that we do not wish to repeat with our U.S. human presence in low Earth orbit," Robyn Gatens, NASA's director for the International Space Station (ISS), said during the hearing.

[....] "The first and foremost indicator is that we have commercial LEO destinations to transition to," Gatens said. "That may sound pretty obvious, but that's a prerequisite so that we don't have a gap in low Earth orbit." Other indicators include the structural health of the International Space Station and the development of commercial markets, she said.

What should America do next in space after the ISS?


Original Submission

posted by martyb on Friday September 24 2021, @02:31PM   Printer-friendly

Facebook paid FTC $4.9B more than required to shield Zuckerberg, lawsuit alleges:

In a newly unsealed lawsuit, Facebook shareholders allege that the company intentionally overpaid a $5 billion Federal Trade Commission fine to protect CEO Mark Zuckerberg from further government scrutiny.

"Zuckerberg, Sandberg, and other Facebook directors agreed to authorize a multi-billion settlement with the FTC as an express quid pro quo to protect Zuckerberg from being named in the FTC's complaint, made subject to personal liability, or even required to sit for a deposition," the lawsuit says (emphasis in the original). An early draft of the order obtained by The Washington Post through the Freedom of Information Act shows that the commission was considering holding Zuckerberg responsible.

The FTC levied the fine in July 2019 in the wake of the Cambridge Analytica scandal, which saw political operatives harvesting the personal data of 50 million Facebook users without their consent. (The lawsuit says only 0.31 percent of the affected users consented.) The fine (which was a record for privacy-related penalties) was 50 times larger than the maximum prescribed by a previous FTC consent decree, the lawsuit alleges. It was also well in excess of the previous record fine of $168 million.

"Facebook's maximum monetary exposure was $104,751,390—about $4.9 billion less than it agreed to pay," shareholders said in the lawsuit. The overpayment, they said, is a breach of fiduciary duty.

The lawsuit also alleges that, by withholding information about the Cambridge Analytica leak, executives and board members, including Zuckerberg and COO Sheryl Sandberg, engaged in insider trading. "After Zuckerberg learned of Cambridge Analytica's massive extraction of Facebook user data, he and the entities controlled by him significantly accelerated his sales of Facebook shares," the lawsuit says.

The shareholders filed the lawsuit in Delaware's Court of Chancery. Among the plaintiffs are a handful of pension and retirement funds, including the massive California State Teachers' Retirement System, which manages over $250 billion. The defendants include Mark Zuckerberg, Facebook COO Sheryl Sandberg, several other executives, and members of the board at the time of the settlement, including Peter Thiel, Mark Andreessen, and Jan Koum, among others.

A second lawsuit, which has been consolidated with the first, also names Palantir Technologies, Thiel's big data analytics firm. That lawsuit alleges tight ties between Palantir and Cambridge Analytica, citing a 2019 book by whistleblower Christopher Wylie. Wylie reported that several Palantir employees, including one of the company's lead data scientists, routinely worked at Cambridge Analytica's offices "in person, during normal business hours," the lawsuit says. "The two companies were so intertwined that, as the Stanford Daily reported in April 2018, Palantir earned itself the moniker 'Stanford Analytica.'" Palantir reportedly took steps to obscure the relationship.

Thiel was one of former President Donald Trump's biggest supporters in the run-up to the 2016 election. The Trump campaign and Trump-aligned PACs both hired Cambridge Analytica to help run digital operations.


Original Submission

posted by martyb on Friday September 24 2021, @11:47AM   Printer-friendly
from the malware-personalized-just-for-you dept.

The NSA and CIA Use Ad Blockers Because Online Advertising Is So Dangerous:

The Intelligence Community has deployed ad-blocking technology, according to a letter sent by Congress and shared with Motherboard.

Lots of people who use ad blockers say they do it to block malicious ads that can sometimes hack their devices or harvest sensitive information on them. It turns out, the NSA, CIA, and other agencies in the U.S. Intelligence Community (IC) are also blocking ads potentially for the same sorts of reasons.

The IC, which also includes the parts of the FBI, DEA, and DHS, and various DoD elements, has deployed ad-blocking technology on a wide scale, according to a copy of a letter sent by Congress and shared with Motherboard.

[...] In addition, Motherboard has reported on how data brokers may obtain information via a process called real-time bidding. Before an advertisement is placed into a person's app or browsing session, companies bid on whether their own advert will win the ad spot. As part of that process, participating companies can gather data on people, known as bidstream data, even if they don't win the ad placement.

[...] "This information would be a goldmine for foreign intelligence services that could exploit it to inform and supercharge hacking, blackmail, and influence campaigns," the letter read.

If the preceding weren't bad enough, digital advertisers make bad tap dancers because they expect to be paid per click.


Original Submission

posted by martyb on Friday September 24 2021, @09:03AM   Printer-friendly
from the how-much-are-you-willing-to-pay-for-those-repairs? dept.

https://spectrum.ieee.org/we-need-software-updates-forever

I recently did some Marie Kondo–inspired housecleaning: Anything that didn't bring me joy got binned. In the process, I unearthed some old gadgets that made me smile. One was my venerable Nokia N95, a proto-smartphone, the first to sport GPS. Another was a craptastic Android tablet—a relic of an era when each year I would purchase the best tablet I could for less than $100 (Australian!), just to see how much you could get for that little. And there was my beloved Sony PlayStation Portable. While I rarely used it, I loved what the PSP represented: a high-powered handheld device, another forerunner of today's smartphone, though one designed for gaming rather than talking.

These nifty antiques shared a common problem: Although each booted up successfully, none of them really work anymore. In 2014, Nokia sold off its smartphone division to Microsoft in a fire sale; then Microsoft spiked the whole effort. These moves make my N95 an orphan product from a defunct division of a massive company. Without new firmware, it's essentially useless. My craptastic tablet and PSP similarly need a software refresh. Yet neither of them can log into or even locate the appropriate update servers.


Original Submission

posted by martyb on Friday September 24 2021, @06:18AM   Printer-friendly

Leaked Apple Training Videos Show How It Undermines Third-Party Repair:

Leaked training videos Apple made for its authorized repair partners show how the company trains repair technicians to undermine third party companies and talk customers into buying more expensive first party repairs.

[...] The training videos are meant to help Apple’s certified repair stores navigate a world where customers can get replacement parts far cheaper than what Apple charges for basic repairs. For years, Apple has made it harder for independent repair stores to fix phones, nudging customers to go to Apple stores instead. In response, there's been a rising right-to-repair movement that wants to make it easier for people to repair their own stuff. 

Andrey Shumeyko, a member of a community of Apple enthusiasts that seek, publicize, and trade any kind of information that Apple would like to keep under wraps, sent the eight videos with Motherboard. The videos are not public, as they are only intended for Apple store employees and authorized independent repair technicians (these are called Apple Authorized Service Providers (AASP). Shumeyko said the videos were stored on an Apple platform, where a bug allowed him to access them without having to provide a login.    

AASP launched in 2016 as a way for some independent stores to make basic repairs to Apple devices. AASP stores must open their stores to unannounced audits by Apple, and face a mountain of restrictions on what they can and can’t fix.

[...] Fixing your own stuff or having an independent store do it can be much cheaper than going directly to Apple. Contrary to what Apple said in the training videos, the parts are often exactly the same. Factories will often overproduce Apple parts like screens then sell the excess to independent vendors. If color calibration is off or the light doesn’t get quite as bright as it did before, it’s often because Apple has software locks and calibration profiles it could release to make repairs easier but refuses to.

Every video in the training series is aimed at boosting the morale of Apple’s AASPs and training them to convince customers to spend more when they could spend less.

"As someone who works as an Apple Authorized repair technician, I see on a daily basis how many devices the manufacturer claims are unrepairable but that third party repair shops have shown time and again that they can solve, letting people recover precious documents and memories that, because of manufacturer restrictions, I am not allowed to help with,” an AASP told Motherboard on the condition we keep them anonymous because they fear retaliation from Apple.


Original Submission

posted by martyb on Friday September 24 2021, @03:31AM   Printer-friendly
from the more-than-just-a-passing-interest dept.

Elon Musk says Inspiration4 crew had 'challenges' with the toilet, promises upgrade:

SpaceX's Inspiration4 orbital mission with four non-professional astronauts was by all accounts quite a triumph for space history, space tourism and fundraising for St. Jude Children's Research Hospital. However, there may have been some tense moments when it came to using the toilet on board the Crew Dragon spacecraft.

SpaceX founder Elon Musk tweeted Monday night that the Inspiration4 crew had some "challenges" with the loo. He promised upgrades for future missions.

[...] SpaceX hasn't revealed much about how the toilet works, but Isaacman told Insider in July that the facilities were located near the spacecraft's large cupola window with a curtain to allow for a wee bit of privacy. He described the toilet as having "one hell of a view."

[...] Inspiration4 spent three days in orbit before returning to Earth with a splashdown on Saturday. That's three days of using the bathroom in microgravity while in very close quarters with others. Upon hearing of the mission's potty problems, bidet company Tushy said its product engineers were standing at the ready to develop the first ever space bidet, the Tushy Ass Blast 9000.


Original Submission

posted by martyb on Friday September 24 2021, @12:39AM   Printer-friendly
from the we-think-that-we-beat-nature dept.

Smallest-Ever Human-Made Flying Structure Is A Winged Microchip, Scientists Say

It's neither a bird nor a plane, but a winged microchip as small as a grain of sand that can be carried by the wind as it monitors such things as pollution levels or the spread of airborne diseases.

The tiny microfliers, whose development by engineers at Northwestern University was detailed in an article published by Nature this week, are being billed as the smallest-ever human-made flying structures.

The devices don't have a motor; engineers were instead inspired by the maple tree's free-falling propeller seeds — technically known as samara fruit. The engineers optimized the aerodynamics of the microfliers so that "as these structures fall through the air, the interaction between the air and those wings cause a rotational motion that creates a very stable, slow-falling velocity," said John A. Rogers, who led the development of the devices.

[...] The wind would scatter the tiny microchips, which could sense their surrounding environments and collect information. The scientists say they could potentially be used to monitor for contamination, surveil populations or even track diseases.

Three-dimensional electronic microfliers inspired by wind-dispersed seeds

Journal Reference:
Bong Hoon Kim, Kan Li, Jin-Tae Kim, et al. Three-dimensional electronic microfliers inspired by wind-dispersed seeds, Nature (DOI: 10.1038/s41586-021-03847-y)


Original Submission

posted by chromas on Thursday September 23 2021, @09:50PM   Printer-friendly
from the get-the-lead-out dept.

A new method for removing lead from drinking water: Engineers have designed a relatively low-cost, energy-efficient approach to treating water contaminated with heavy metals:

The new system is the latest in a series of applications based on initial findings six years ago by members of the same research team, initially developed for desalination of seawater or brackish water, and later adapted for removing radioactive compounds from the cooling water of nuclear power plants. The new version is the first such method that might be applicable for treating household water supplies, as well as industrial uses.

[...] The biggest challenge in trying to remove lead is that it is generally present in such tiny concentrations, vastly exceeded by other elements or compounds. For example, sodium is typically present in drinking water at a concentration of tens of parts per million, whereas lead can be highly toxic at just a few parts per billion. Most existing processes, such as reverse osmosis or distillation, remove everything at once, Alkhadra explains. This not only takes much more energy than would be needed for a selective removal, but it's counterproductive since small amounts of elements such as sodium and magnesium are actually essential for healthy drinking water.

The new approach uses a process called shock electrodialysis, in which an electric field is used to produce a shockwave inside an electrically charged porous material carrying the contaminated water. The shock wave propagates from one side to the other as the voltage increases, leaving behind a zone where the metal ions are depleted, and separating the feed stream into a brine and a fresh stream. The process results in a 95 percent reduction of lead from the outgoing fresh stream.

[...] The process still has its limitations, as it has only been demonstrated at small laboratory scale and at quite slow flow rates. Scaling up the process to make it practical for in-home use will require further research, and larger-scale industrial uses will take even longer.

Journal Reference:
Huanhuan Tian, Mohammad A. Alkhadra, Kameron M. Conforti, et al. Continuous and Selective Removal of Lead from Drinking Water by Shock Electrodialysis, ACS ES&T Water (DOI: 10.1021/acsestwater.1c00234)


Original Submission

posted by martyb on Thursday September 23 2021, @06:59PM   Printer-friendly
from the any-port-in-a-storm dept.

EU Proposes New Legislation That Would Force Apple to Bring USB-C to iPhones, iPads, and AirPods

Apple has shifted nearly every portable device to tout a USB-C port, except for its iPhone lineup, its AirPods family, and low-cost iPad. Why the company does not shift to an all-USB-C affair might have to do with receiving royalty payments from partners that manufacture third-party accessories of the proprietary port, but that arrangement might come to an end, thanks to a legislation from the EU.

The proposed legislation would force all consumer electronics, not just Apple, which sell devices in Europe, to incorporate USB-C ports in a variety of products, ranging from smartphones, tablets, headphones, cameras, portable speakers, handheld consoles, and others. Calling it the 'common port,' the European Union claims that switching all products to USB-C would not just have benefits to the environment, but annual monetary savings for consumers that mount to $293 million.

Pulling the plug on consumer frustration and e-waste: Commission proposes a common charger for electronic devices

Impact assessment study on common chargers of portable devices

Also at Reuters, NYT, BBC, AppleInsider, and Politico.

Previously: The Dream Of A Common Charger Is Alive, Despite Apple's Complaining


Original Submission

posted by martyb on Thursday September 23 2021, @04:13PM   Printer-friendly
from the how-did-we-get-so-large-and-complicated? dept.

Single Cells Evolve Large Multicellular Forms in Just Two Years:

[William C.] Ratcliff wondered what would happen to snowflake yeast grown that long — would they eventually achieve large size? Would that lead to differentiation?

The snowflake yeast achieved multicellularity readily, but their clumps remained microscopic, no matter what Ratcliff tried. For years he failed to make progress, and he credits Ozan Bozdağ, a research scientist at Georgia Tech who was a postdoc in Ratcliff’s lab, with breaking through the wall.

[...] Oxygen can be very helpful for living things, because cells can use it to break down sugars for massive energy payouts. When oxygen isn’t present, cells must ferment sugars instead, for a smaller usable yield. All along, Ratcliff had been growing yeast with oxygen. Bozdağ suggested growing some cultures without it.

Bozdağ began the selection experiments with three different groups of snowflake yeasts, two that could use oxygen and one that, because of a mutation, could not. Each group consisted of five genetically identical tubes, and Bozdağ mounted them in a shaking machine. Around the clock, the yeast were shaken at 225 revolutions per minute. Once a day, he let them settle on the counter for three minutes, then used the contents of the bottom of the tube to start fresh cultures. Then, back in the shaker they went. Every day in 2020 and early 2021, even during the lab closures of the COVID-19 pandemic, Bozdağ was there, with a special exemption granted by the university, exerting selection on the yeast.

[...] Around day 350, Bozdağ noticed something in one of those tubes. There were clusters he could see with the naked eye. “As an evolutionary biologist … you think it’s a chance event. Somehow they got big, but they are going to lose out against the small ones in the long run — that is my thinking,” he said. “I didn’t really talk about this with Will at the time.”

But then clusters showed up in the second tube. And around day 400, the three other tubes of mutants that couldn’t use oxygen kicked into gear, and soon all five tubes had massive structures in them, topping out at about 20,000 times their initial size. Bozdağ started taking pictures of the clusters with his phone camera. There was no longer a need for a microscope.

Journal References:

1.) William C. Ratcliff, R. Ford Denison, Mark Borrello, et al. Experimental evolution of multicellularity [open], Proceedings of the National Academy of Sciences (DOI: 10.1073/pnas.1115323109)
2.) Ratcliff, William C., Fankhauser, Johnathon D., Rogers, David W., et al. Origins of multicellular evolvability in snowflake yeast [open], Nature Communications (DOI: 10.1038/ncomms7102)
3.) Dryad Data -- Multicellular group formation in response to predators in the alga Chlorella vulgaris, (DOI: 10.5061/dryad.c5902)
4.) Stefania E. Kapsetaki, Stuart A. West. The costs and benefits of multicellular group formation in algae*, Evolution (DOI: 10.1111/evo.13712)
5.) Light-regulated collective contractility in a multicellular choanoflagellate, Science (DOI: 10.1126/science.aay2346)
6.) J. T. Bonner. PERSPECTIVE: THE SIZE‐COMPLEXITY RULE, Evolution (DOI: 10.1111/j.0014-3820.2004.tb00476.x)
7.) Hammerschmidt, Katrin, Rose, Caroline J., Kerr, Benjamin, et al. Life cycles, fitness decoupling and the evolution of multicellularity, Nature (DOI: 10.1038/nature13884)

Original Submission

posted by martyb on Thursday September 23 2021, @01:36PM   Printer-friendly
from the e-waste-recycling dept.

You might be sitting on a mountain of e-waste that Dell wants to recycle for you:

If you're anything like me, you struggle to let go of your old electronics. Be that a mobile phone, laptop, or even an old graphics card plagued by electromigration and capable of a frame a minute—there's something about the act of disposing of it that feels inherently wasteful. Yet it's no less wasteful of me to keep my long redundant technology stored in a cardboard box at the back of my closet.

Hence when I spotted a tweet from Dell promising to recycle my old electronics— whether manufactured by Dell or not—it caught my attention. Will the company actually take my old tech from me and do something productive with it?

To gather some more information, I reached out to the company. Because it's one thing to recycle your own product, it's a whole other to deal with somebody else's trash, for lack of a better word.

And as I would find out from Page Motes, Dell's head of sustainability, the company doesn't see it that way.

[...] Dell sees that e-waste instead as an opportunity to create closed-loop supply for certain materials.

Plastics are something the company has been recycling for some time now, using 100 million pounds of the stuff to make new parts for Dell systems, but more recently it's also begun leveraging rare earth magnets from old, disused hard drives alongside manufacturer Seagate.

Furthermore, I'm told Dell is now reusing aluminium from the old drives, and this closed-loop aluminium has since found its way into the Optiplex lineup, a range of commercial PCs that probably aren't all that familiar to PC gamers but relies on recycled materials for a large part of its construction. Something it'd be great to see make its way into more discrete PC gaming components, that's for sure.

Dell is first to admit it benefits from the program, and it also hopes that might tempt other companies to follow in its footsteps. Motes explains that it's well-aware this is not something that can be done alone, and that it'll need wider support for recycling programs to really deal with the e-waste generated every year that is, for the most part, not recycled or reused.


Original Submission

posted by Fnord666 on Thursday September 23 2021, @10:47AM   Printer-friendly

Netgear SOHO Security Bug Allows RCE, Corporate Attacks:

A high-severity security bug affecting several Netgear small office/home office (SOHO) routers could allow remote code execution (RCE) via a man-in-the-middle (MiTM) attack.

The bug (CVE-2021-40847) exists in a third-party component that Netgear includes in its firmware, called Circle – it handles the parental controls for the devices, according to researchers at Grimm who discovered the flaw. It rates 8.1 out of 10 on the CVSS 3.0 vulnerability-severity scale.

“Since this code is run as root on the affected routers, exploiting it to obtain RCE is just as damaging as a RCE vulnerability found in the core Netgear firmware,” they said in an advisory released Tuesday.

Specifically, the issue lives in the Circle update daemon. Researchers explained that the updating process is insecure, making it possible for attackers to spoof the update server and inject their own bits and bytes into the process.

It should be noted that a prerequisite for exploitation is having the ability to sniff and send network traffic to and from a target router, the advisory said – meaning that adversaries would need to be attached to the same network as the appliance. That can be achieved by compromising a connected device such as a mobile phone or computer prior to initiating the RCE effort.

[...] “This daemon connects to Circle and Netgear to obtain version information and updates to the daemon and its filtering database,” researchers explained. “However, database updates from Netgear are unsigned and downloaded via HTTP. As such, an attacker with the ability to perform a MitM attack on the device can respond to Circle update requests with a specially crafted, compressed database file, the extraction of which gives the attacker the ability to overwrite executable files with attacker-controlled code.”

[...] Affected Netgear Devices and Versions

The below devices and versions are vulnerable; Grimm noted that older versions of all of these likely are as well:

  • R6400v2 – 1.0.4.106
  • R6700 – 1.0.2.16
  • R6700v3 – 1.0.4.106
  • R6900 – 1.0.2.16
  • R6900P – 1.3.2.134
  • R7000 – 1.0.11.123
  • R7000P – 1.3.2.134
  • R7850 – 1.0.5.68
  • R7900 – 1.0.4.38
  • R8000 – 1.0.4.68
  • RS400 – 1.5.0.68

To mitigate the risks to corporate environments posed by vulnerable SOHO routers, users should update their router firmware to the latest versions, which contain patches for CVE-2021-40847. Details can be found here.

So we have a process that

  • Runs as root
  • Can update things like firmware, checksums, etc.
  • Retrieves updates via HTTP
  • Doesn't use any sort of code signing

I'm dumbfounded. You can't make this stuff up.

Details about CVE-2021-40847.


Original Submission

posted by Fnord666 on Thursday September 23 2021, @08:01AM   Printer-friendly

European Processor Initiative Receives First EPAC RISC-V Sample Chips for Testing

European Processor Initiative (EPI) has been working on providing independence for the European Union in the high-performance computing (HPC) field, by developing custom RISC-V-based accelerators. Called the European Processor Accelerator (EPAC) chip, designed for high efficiency and high throughput computation, it has been successfully taped out and is being tested at EPI's labs.

[...] [Today], the project has delivered its promises as the very first batch of chips are being tested in EPI's labs. The RISC-V processors are designs containing multiple special-purpose accelerators, all centered around the RISC-V ISA and its design principles. The processor contains four tiles of Vector Processing Units (VPUs) made up from Avispado RISC-V core designed by SemiDynamics, and vector processing elements design by Barcelona Supercomputing Center and the University of Zagreb. In each tile, there are home nodes and L2 cache for cache systems, which are the contributions of Chalmers and FORTH. For additional acceleration, there are Stencil and Tensor accelerators (STX) engineered by Fraunhofer IIS, ITWM, and ETH Zürich, and the variable precision processor (VRP) deigned by CEA LIST.

Also at The Register.

Related: U.S.-Based Chip-Tech Group Moving to Switzerland Over Trade Curb Fears


Original Submission