SoylentNews

upstart writes:

Ivanti rushes to patch zero-day used to breach Norway's government:

Hackers exploited a zero-day flaw in Ivanti's mobile endpoint management software to compromise a dozen Norwegian government agencies — and thousands of other organizations could also be at risk.

The Norwegian Security and Service Organization (DSS) said in a statement on Monday that a "data attack" had struck the IT platform used by 12 government ministries.

[...] The DSS said the attack was the result of a "previously unknown vulnerability in the software of one of our suppliers," but didn't share any further details. However, the Norwegian National Security Authority (NSM) later confirmed that hackers had leveraged the previously undiscovered flaw in Ivanti Endpoint Manager Mobile (EPMM; formerly MobileIron Core), to compromise Norwegian government agencies.

[...] Ivanti's EPMM allows authorized users and devices to access a corporate or government network. The vulnerability, tracked as CVE-2023-35078, is an authentication bypass flaw that affects all supported versions of Ivanti's EPMM software, along with older and unsupported releases. If exploited, the vulnerability allows anyone over the internet to remotely access the software — without needing credentials — to access users' personal information, such as names, phone numbers, and other mobile device details for users on a vulnerable system, as well as make changes to the impacted server.

[...] In a statement to TechCrunch, Ivanti chief security officer Daniel Spicer said that after the company became aware of the vulnerability, it "immediately developed and released a patch and are actively engaging with customers to help them apply the fix," adding that "we are upholding our commitment to deliver and maintain secure products, while practicing responsible disclosure protocols."

However, Ivanti initially kept details of the flaw — which has been given a maximum vulnerability severity rating out 10 out of 10 — behind a paywall, and reportedly asked potentially impacted customers to sign a non-disclosure agreement before sharing details. At the time of writing, Ivanti's Knowledge Base article about the vulnerability still requires users to login before viewing. [Note: Now viewable. -Ed.]

[...] As noted by cybersecurity researcher Kevin Beaumont, the vast majority of impacted organizations — a list which includes numerous U.S. and U.K. government departments — have not yet patched.

Original Submission

Greetings, Soylentils!

I am told by those who know, that 75% of the posters here are still from the original group of people that formed the community when we left Slashdot and created Soylent News. So some of you may remember me (Audioguy, #25) from that time.

Newer people may not know me, as I tend to be pretty quiet most of the time. Mostly I just read the news articles, and quietly do bits of sysadmin work in the background to keep the site up.

Only when I feel the core values of our community project are in danger, or its very existence is threatened, do I come out very publicly, and at such times I can be QUITE vocal.

Now is such a time.

I am about to do something which would not only have been uncontroversial, but normal here until the last six months. In the present climate it will probably piss a few people off.

I am going to update the community on exactly what has been going on behind the scenes here.

"Arthur T Knackerbracket" writes:

Arthur T Knackerbracket has processed the following story:

Ozempic and Wegovy are brand names for the drug semaglutide. Many countries have approved Wegovy for weight loss in people who are obese or overweight and Ozempic for people with type 2 diabetes.

Drugs such as semaglutide mimic the actions of a hormone called glucagon-like peptide-1, or GLP-1. These so-called GLP-1 analogues have several effects, including slowing stomach emptying, acting on the brain to reduce appetite and boosting the release of insulin, which helps to regulate blood sugar levels.

[...] Wegovy leads to about a 15 per cent reduction in body weight over a year, when combined with exercise and eating healthily.

In fact, some people seem to feel that the GLP-1 analogues have caused them to become too gaunt, as reflected in the rise of the search terms “Ozempic face” and “Ozempic butt”. “Ozempic doesn’t do anything specific to the skin,” says Alexander Miras at Ulster University, UK. It is the weight loss that causes these apparent side effects, with similar outcomes often also occurring after weight loss surgery, he says.

Side effects can be mild, such as nausea, constipation and diarrhoea, which tend to occur as people get used to the drug. More worrying side effects include inflammation of the pancreas, although this is relatively rare.

Hair loss has been reported by some semaglutide users. This is also sometimes seen after significant weight loss from other causes, such as stomach surgery, says Miras.

[...] GLP-1 analogues – such as Ozempic and Wegovy – are being investigated by the European Medicines Agency (EMA) after recent reports that they may cause thoughts of suicide or self-harm. This was after Iceland’s health regulator received three such reports regarding semaglutide and another drug called liraglutide, which is an earlier GLP-1 analogue.

The EMA says it is analysing about 150 reports of possible cases of self-injury and suicidal thoughts. This doesn’t mean the medicines caused these effects, however, only that people reported these experiences after starting to take them. “More work is needed to determine if a causal link exists,” says Michael Schwartz at the University of Washington in Seattle.

Original Submission

upstart writes:

A sailor and his dog found after months stranded in the Pacific:

A stranded sailor and his dog have been rescued in the South Pacific Ocean after months at sea, rescuers told Australian media over the weekend.

The sailor, Tim Shaddock, 51, and Bella, the dog, departed from La Paz, Mexico, three months ago. A month into his journey, a storm struck his white catamaran, wiping out all electronics, according to 9News. He says he and Bella survived three months at sea eating raw fish and drinking rainwater.

They were rescued by a Mexican tuna trawler over the weekend, 9News reported.

"I have been through a very difficult ordeal at sea," Shaddock told the channel, adding that he had fishing and other survival gear with him.

[...] Shaddock and Bella were spotted last week by a helicopter accompanying a tuna trawler, which was on its way back to Mexico, according to 9News. It was unclear when Shaddock first left Mexico, and where he and Bella were rescued.

[...] Shaddock said he avoided sunburn by sheltering under his boat's canopy, eating raw fish and drinking rainwater.

[...] Not only did Shaddock have to look after himself, but also his dog, which Tipton said, helped in the pair's survival.

"He had companionship. Once you've got enough food and water, then I think the dog has an advantage," Tipton said. "Your survival time is as long as you can keep collecting water, getting occasional food and doing things that help you stay positive," he added.

Finding Shaddock was like a "needle in a haystack" in the enormous Pacific Ocean, Tipton said, especially since the helicopter was not even actively looking for him.

"It was a combination of luck and the right behavior," he added.

Original Submission

Freeman writes:

https://arstechnica.com/tech-policy/2023/07/twitter-took-x-handle-from-longtime-user-and-only-offered-him-some-merch/

Elon Musk's decision to rebrand Twitter as "X" wouldn't be complete without a change to the company's official Twitter account. The @X handle was already taken by a user who registered it over 16 years ago, but that wasn't much of an obstacle—Twitter simply took over the username and offered its longtime owner some merchandise but no monetary compensation.

San Francisco-based photographer Gene X Hwang was @X on Twitter from March 2007 until yesterday. "They just took it essentially—kinda what I thought might happen," Hwang told The Telegraph. "They did send an email saying it is the property of 'x' essentially."

[...] Hwang was quoted as saying several years ago that he turned down offers as high as $40,000 because he didn't think they were legitimate. "I really didn't entertain any of them seriously," he said at the time.

[...] In January, a New York Times report said that "Twitter has considered selling user names to generate new revenue as its owner, Elon Musk, tries to resuscitate the company's business." Under Musk, Twitter has also gotten more aggressive about purging accounts that seem to be inactive.

Original Submission

upstart writes:

Ironically, despite America's Cold War fears of being nuked by the Soviet Union, the only government that ever nuked us (and nuked us quite a bit) was our own:

The Trinity test and the dozens of nuclear tests that followed were the result of the top secret Manhattan Project, the WWII era U.S. government program that focused on the development of the atomic bomb. [...] The newly published research focuses on "atmospheric tests," meaning tests that impacted the atmosphere, though the U.S. government has also extensively conducted underground nuclear weapons testing, blowing up an estimated 815 subterranean nukes between 1951 and 1998.

The new research on the Trinity and other above-ground nuclear tests uses a combination of data that wasn't previously available for other evaluations. [...] According to the findings of the new study, the Trinity test had a large impact on the total amount of nuclear fallout that has spread throughout the U.S. "Our results show the significant contribution of the Trinity fallout to the total deposition density across the contiguous U.S....and in New Mexico in particular." The report states that fallout from Trinity reached 46 states in just 10 days.

The report notes that of the 101 nuclear tests carried out during the time period studied, 94 of them created radioactive mushroom clouds that subsequently dispersed nuclear fallout across the country.

owl writes:

https://newart.press/p/photocopiers-terrified-the-publishing

"What Hath Xerox Wrought" asked a 1976 Time Magazine headline, the proceeding article prompted readers to imagine if: "some inventive and omnipotent god offered the nation a device that would greatly advance the spread of information."

There was a catch though: the promethean powers afforded by this "green-eyed deus ex machina" would also bring chaos: "In return, the deity required that the President resign, that stacks of sensitive Government and corporate secrets be made public."

The writer was of course referring to the Watergate scandal and Daniel Ellsberg's use of photocopiers to leak the Pentagon Papers to the press. The hypothetical was actually a reality. While the USSR kept strict control over the technology, highly regulating the machines until 1989, the free world was left to deal with the 'consequences' of freedom.

Downsides of this supposed double edge sword - cited in Time - would be encouraging waste and slothfulness, on top of stifling creativity and punching holes in copyright laws. This last issue was of particular concern to publishers and authors, one that had been growing for more than a decade because, as Malcolm McLaren would put it in 1993, "Gutenberg made everyone a reader, Xerox made everyone a publisher..."

Original Submission

upstart writes:

Adverts said Onavo Protect user data would be kept a secret – just didn't say from whom:

On Wednesday, Australia's Federal Court ordered two Meta subsidiaries to pay $14 million after an over two and a half year legal battle instigated by the country's competition regulator found the pair misled users on the data collection of a now defunct VPN app.

[...] Israel-based web analytics company Onavo, maker of free downloadable software application Onavo Protect, was acquired by Facebook in 2013. The narrative from Onavo at the time was that privacy was king. Meanwhile Facebook promised the company would be a separate brand.

But by 2018, researchers were onto the tall tale and found Onavo Protect sent user data to Facebook even when turned off – a situation that was outlined and permitted through its terms and conditions.

According to the ACCC [Australian Competition and Consumer Commission], information collected and aggregated included "users' internet and app activity, such as records of every app they accessed and the number of seconds each day they spent using those apps" for Facebook's commercial benefit.

[...] On Wednesday, the Australian court said that Onavo Inc. and Facebook Israel promoted the VPN during 2016 and 2017 without sufficiently disclosing that data would be used outside of the app.

"If an Australian user of Onavo Protect had a Facebook account, Meta was also able to combine that user's Onavo Protect Data with information that Meta maintained about the user's Facebook account, using an algorithm," wrote Judge Wendy Abraham.

She further noted that internal Meta documents referred to Onavo Protect as a "business intelligence tool," providing "a sample of users who we are able to know nearly everything they are doing on their mobile device." The data was then used for advertising, marketing and improvement of products, services and strategies.

According to the Australian court, the terms and conditions disclosing data use were not sufficient enough to counter advertisements to the contrary. Court documents state that both Facebook Israel and Onavo admit that ads and statements were likely to mislead or deceive.

[...] Abraham said in court documents the fine "carries with it a sufficient sting to ensure that the penalty amount is not such as to be regarded by the parties or others as simply an acceptable cost of doing business."

Original Submission

"Arthur T Knackerbracket" writes:

Arthur T Knackerbracket has processed the following story:

A recently disclosed bug in many of AMD's newer consumer, workstation, and server processors can cause the chips to leak data at a rate of up to 30 kilobytes per core per second, writes Tavis Ormandy, a member of Google's Project Zero security team. Executed properly, the so-called "Zenbleed" vulnerability (CVE-2023-20593) could give attackers access to encryption keys and root and user passwords, along with other sensitive data from any system using a CPU based on AMD's Zen 2 architecture.

[...] The bad news is that the exploit doesn't require physical hardware access and can be triggered by loading JavaScript on a malicious website (according to networking company Cloudflare). The good news is that, at least for now, there don't seem to be any cases of this bug being exploited in the wild yet, though this could change quickly now that the vulnerability has been disclosed, and the bug requires precise timing to exploit.

"AMD is not aware of any known exploit of the described vulnerability outside the research environment," the company told Tom's Hardware. Cloudflare also says there is "no evidence of the bug being exploited" on its servers.

Since the vulnerability is in the hardware, a firmware update from AMD is the best way to fully fix it; Ormandy says it is also fixable via a software update, but it "may have some performance cost." The bug affects all processors based on AMD's Zen 2 architecture, including several Ryzen desktop and laptop processors, EPYC 7002-series chips for servers, and Threadripper 3000- and 3000 Pro WX-series CPUs for workstations.

The article mentions that the firmware update for EPYC 7002 is already out, but updates for consumer-market chips may not be available until December.

Original Submission

owl writes:

https://vivaldi.com/blog/googles-new-dangerous-web-environment-integrity-spec/

Google seems to love creating specifications that are terrible for the open web and it feels like they find a way to create a new one every few months. This time, we have come across some controversy caused by a new Web Environment Integrity spec that Google seems to be working on.

​At this time, I could not find any official message from Google about this spec, so it is possible that it is just the work of some misguided engineer at the company that has no backing from higher up, but it seems to be work that has gone on for more than a year, and the resulting spec is so toxic to the open Web that at this point, Google needs to at least give some explanation as to how it could go so far.

Original Submission

ElizabethGreene writes:

From Hackaday:
The newest winner of the World's Largest wind turbine title is the Ming Yang MySE 16-260 that came online last week in the Taiwan Strait. Its 16-megawatt generator is driven by a 260-meter diameter rotor and is projected to pump 66 Gigawatt-hours of electricity annually. This surpasses the previous record holder, the Vesta V236-15.0MW that came online in January with a 231 meter rotor disc.

(Local seabird populations could not be reached for comment on this story.)

Original Submission

upstart writes:

The Overture Maps Foundation took info from Microsoft, Meta, and more to help more developers create a new wave of map apps:

If you're not Google (or, to a much lesser extent, Apple), map apps are damned hard to make. Last year, several major heavy hitters in tech, including the likes of Meta, Microsoft, TomTom, and Amazon, decided to lay down their arms and meet under a flag of parlay held aloft by the Linux Foundation to make mapping just a little easier, cheaper, and less dominated by two companies. Alone, none could establish a big enough data pool to rival the likes of Google Maps, but with their individual hoards of business location data, satellite mapping tech, and more support from smaller tech firms, they could perhaps gather enough data together to help create a whole new series of up-to-date map apps.

On Wednesday, this pooled initiative, called the Overture Maps Foundation, shared its first alpha release for its mapping data. It contains millions of examples for buildings, roads, and geographic boundaries. It's only the first large release for the planned massive dataset, but the hope is there will be much more to come as companies sign on.

[...] "The hardest thing in mapping is knowing what's changed in the world," Prioleau told Gizmodo in a video chat. Essentially, map apps are some of the hardest to design simply because of the massive amount of data required to build the systems. Not only do they need to be accurate, but they need to be constantly updated when businesses close and new ones open.

The first Overture release contains about 59 million points of interest that the group claims has not yet been released as open data before. A POI could be anything—a public landmark, a specific building, or a local business. Otherwise, the data contains about 750 million building footprints alongside road data that's mostly collated from the crowdsourced OpenStreetMap project.

The date, time, and place for the upcoming SoylentNews PBC meeting mentioned in a previous meta post from Tuesday, July 25th were announced today:

• Date and Time: Monday, July 31 at 1:30pm PDT (4:30pm EDT / 8:30pm UTC)
• Place: #meeting on irc.soylentnews.org (SoylentNews IRC)

More details:

The upcoming meeting will be to nominate one or more qualified candidates to serve on the Board. The PBC exists to define what and how SoylentNews will be and to enforce that vision. Ultimately the Board is responsible for the high-level oversight that ensures the bylaws are fulfilled. The purpose of the expansion is to include more voices from the community so they will be directly represented in the decision making [affecting] the community. The next meeting will be held over IRC and will be answering and addressing your questions and concerns from any of the comments posted in this article.

For further information, see the previous meta post.

Community participation is essential, so I hope we'll see as many of you there as possible.

upstart writes:

NASA briefly lost contact with International Space Station after power outage:

A brief power outage at NASA's Mission Control in Houston meant that the space agency lost contact with the International Space Station on Tuesday. During the outage, flight controllers were able to talk to the crew through Russian Space Agency Roscosmos's channels.

"A power issue in Mission Control Houston resulted in the loss of command, telemetry, and voice from the ground to the International Space Station," said the American space agency in a blog post. The outage was short-lived as the mission control team transitioned to back-up hardware for telemetry, commanding and audio.

NASA power outage temporarily halts contact with space station:

Space station program manager Joel Montalbano said neither the astronauts nor station were ever in any danger and that backup control systems took over within 90 minutes. The crew was notified of the problem through Russian communication systems, within 20 minutes of the outage.

It's the first time NASA has had to fire up these backup systems to take control, according to Montalbano.

[...] NASA maintains a backup control center miles from Houston in the event a hurricane or other disaster requiring evacuations. But in Tuesday's case, the flight controllers stayed at Mission Control since the lights and air-conditioning still worked.

Original Submission

upstart writes:

Teen Wins Scholarship for His Glaucoma-Detection Device:

After one of teenager Rohan Kalia's family members was diagnosed with glaucoma, he began researching an affordable technology that could be used for early detection. Kalia is a sophomore at Wheeler High School in Marietta, Ga. He built a portable, inexpensive device that can accurately diagnose the condition.

Kalia's EyePal was showcased at the Regeneron International Science and Engineering Fair (ISEF) held in May in Dallas.

Eyepal, described as a novel multimodal diagnosis and prevention system to enable accessible and individualized glaucoma detection, won this year's IEEE Presidents' Scholarship of US $10,000. The IEEE Foundation established the award to acknowledge a deserving student whose project demonstrates an understanding of electrical or electronics engineering, computer science, or other IEEE field of interest.

[...] EyePal also came in third place in the ISEF's systems software category, earning Kalia a $1,000 award.

[...] The EyePal uses a quality camera, a Raspberry Pi minicomputer, machine-learning technology, and a mobile app. The camera takes photos of the fundus and sends them to a mobile device that can be examined by a specialist. EyePal showed a 95 percent accuracy when tested on sets of fundus images, Kalia says.

Original Submission