Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 17 submissions in the queue.

Log In

Log In

Create Account  |  Retrieve Password


Site News

Join our Folding@Home team:
Main F@H site
Our team page


Funding Goal
For 6-month period:
2022-07-01 to 2022-12-31
(All amounts are estimated)
Base Goal:
$3500.00

Currently:
$438.92

12.5%

Covers transactions:
2022-07-02 10:17:28 ..
2022-10-05 12:33:58 UTC
(SPIDs: [1838..1866])
Last Update:
2022-10-05 14:04:11 UTC --fnord666

Support us: Subscribe Here
and buy SoylentNews Swag


We always have a place for talented people, visit the Get Involved section on the wiki to see how you can make SoylentNews better.

Idiosyncratic use of punctuation - which of these annoys you the most?

  • Declarations and assignments that end with }; (C, C++, Javascript, etc.)
  • (Parenthesis (pile-ups (at (the (end (of (Lisp (code))))))))
  • Syntactically-significant whitespace (Python, Ruby, Haskell...)
  • Perl sigils: @array, $array[index], %hash, $hash{key}
  • Unnecessary sigils, like $variable in PHP
  • macro!() in Rust
  • Do you have any idea how much I spent on this Space Cadet keyboard, you insensitive clod?!
  • Something even worse...

[ Results | Polls ]
Comments:61 | Votes:107

posted by requerdanos on Friday September 01 2023, @11:07PM   Printer-friendly
from the Synchronicity dept.

Research could pave the way to new anti-malarials that work by "jet-lagging" the parasites that cause the disease:

Health officials warn that drug resistance could wipe out recent progress against malaria, particularly in Africa and southeast Asia. Now, researchers looking for other ways to fight the mosquito-borne parasites that cause the disease have zeroed in on a potential new target: biological clocks.

Most living things have internal clocks that govern fluctuations in everything from hunger and hormone levels to when genes are active throughout the day.

In a study published June 6 in the journal Proceedings of the National Academy of Sciences, researchers analyzed gene activity in patients who showed up at medical facilities along the Thailand-Cambodia border, showing signs of a malaria infection in their blood.

The team found that malaria parasites somehow sync their molecular rhythms with the internal 24-hour clocks of their hosts, their respective genes rising and falling in perfect lockstep with each other over the course of a day, like two pendulum clocks with synchronized swings.

[...] When someone has malaria, a deadly loop repeats itself inside their body. The disease's recurring fever spikes are caused by microscopic Plasmodium parasites that invade the person's red blood cells, multiply, and then burst out in unison, spewing into the bloodstream by the millions to invade other cells and begin the cycle anew.

This cycle repeats itself every 24, 48 or 72 hours depending on the Plasmodium species. Which got scientists wondering: could the parasites be coordinating in some way with the 24-hour circadian rhythms of their hosts?

[...] The team found that not every patient's 24-hour internal clock ran on exactly the same schedule. Some had cycles that began earlier in the day; some later. But no matter how a person's biological rhythms were shifted, the cycling genes in their malaria parasites were aligned to match.

[...] Scientists still don't know what drives malaria parasites to coordinate their rhythms with those of their host. "The parasites are likely taking advantage of their host's internal rhythms to achieve their own ends," Haase said, but the nature of the advantage is unclear.

[...] If they can figure out how malaria parasites stay in step in humans, the researchers say it may be possible to develop new drugs that decouple the parasite's clock from that of its host, and thereby help the immune system better fight the invaders.

Journal Reference:
Francis C. Motta, Kevin McGoff, Robert C. Moseley, et al., The Parasite Intraerythrocytic Cycle and Human Circadian Cycle Are Coupled During Malaria Infection, PNAS, 2023. DOI: 10.1073/pnas.2216522120


Original Submission

posted by janrinok on Friday September 01 2023, @06:21PM   Printer-friendly
from the getting-down-and-dirty dept.

https://gist.github.com/kj800x/be3001c07c49fdb36970633b0bc6defb

I recently bought an LG ULTRAGEAR monitor secondhand off of a coworker. I really love it and it's been great so far, but I ran into some minor issues with it in Linux. It works great on both Mac and Windows, but on Linux it displays just a black panel until I use the second monitor to go in and reduce the refresh rate down to 60 Hz.

This has worked decent so far but there's some issues:

It doesn't work while linux is booting up. The motherboards boot sequence is visible just fine, but as soon as control is handed over to Linux and I'd normally see a splash screen while I'm waiting for my login window, I see nothing.

It doesn't work on the login screen. This would be fine if login consistently worked on my second screen, but I need to manually switch the cables between my work computer and the desktop for the second screen and sometimes I don't feel like doing that. Even when I switch the cables, the second screen seems to be moody and doesn't always show the login screen either.

Once I've logged in and fixed the settings on my second screen it seems to go fine, unless I actually unplug the second screen. If I do, it looks like the graphics settings go reset back to default (settings that don't work) and I lose the main monitor too.

And down the rabbit hole we go.....


Original Submission

posted by janrinok on Friday September 01 2023, @01:41PM   Printer-friendly

Gentle cleansers are just as effective in killing viruses – including coronavirus – as harsh soaps:

Health care professionals often substitute harsh soaps or alcohol-based hand sanitisers with skin-friendly cleansers in order to treat or prevent irritant contact dermatitis - a common skin disease which causes red and swollen skin with a dry and damaged surface.

During the Covid-19 pandemic, incidence and severity of the disease amongst healthcare professionals increased from 20 per cent to 80 per cent.

Despite the widespread use of gentle cleansing products for handwashing, there has been limited evidence to show the antiviral efficacy of the products to prevent the spread of viruses such as human coronavirus, herpes simplex virus, norovirus and influenza.

[...] The findings, published in the journal Frontiers Virology, show gentle cleansers were effective in killing enveloped viruses, but non-enveloped viruses displayed resistance against skin-friendly cleansers, as well as harsh soaps.

Lead author of the study, Dr Munitta Muthana from the University of Sheffield's Department of Oncology and Metabolism, said: "Washing our hands with soap and warm water for 20 seconds was a fundamental message advocated in the UK to help stop the spread of Covid-19. But for healthcare professionals, who can wash their hands as many as 100 times during a 12 hour shift, this may cause unintended adverse effects.

[...] "For the first time, our study has shown substituting harsh soaps with milder wash products such as gentle cleansers is effective in fighting against enveloped viruses, including human coronavirus, which is very encouraging - especially for those in jobs in which irritant contact dermatitis is an occupational hazard. We also found that using additional agents such as moisturisers to help protect the skin didn't prevent the products' antiviral activity, which means we don't have to use very harsh products on our skin in order to kill viruses."

Importantly, the study also found non-enveloped viruses demonstrated greater resistance across all types of hand washing products tested, including harsh chemical substances and milder solutions. Norovirus - known as the winter vomiting bug - was the most resilient.

[...] "Measures such as isolation and disinfecting surfaces with bleach are more effective in preventing the spread of the norovirus infection and more research needs to be done to see whether heavily diluted bleach-based hand washes, which are safe to use on the skin, can be produced."

Journal Reference:
Natalie Winder, Zahra Ashraf, Sara Gohar, et al., Are mild cleansers appropriate for hand hygiene in the COVID era? An in vitro investigation of the antiviral efficacy of different hand hygiene products, Front. Virol., Volume 3 - 2023 | https://doi.org/10.3389/fviro.2023.1180815


Original Submission

posted by janrinok on Friday September 01 2023, @09:03AM   Printer-friendly

Comcast and other ISPs asked FCC to ditch listing-every-fee rule. FCC says "no":

The Federal Communications Commission yesterday rejected requests to eliminate an upcoming requirement that Internet service providers list all of their monthly fees.

Five major trade groups representing US broadband providers petitioned the FCC in January to scrap the requirement before it takes effect. In June, Comcast told the FCC that the listing-every-fee rule "impose[s] significant administrative burdens and unnecessary complexity in complying with the broadband label requirements."

The five trade groups kept up the pressure earlier this month in a meeting with FCC officials and in a filing that complained that listing every fee is too hard. The FCC refused to bend, announcing yesterday that the rules will take effect without major changes.

"Every consumer needs transparent information when making decisions about what Internet service offering makes the most sense for their family or household. No one wants to be hit with charges they didn't ask for or they did not expect," FCC Chairwoman Jessica Rosenworcel said.

Yesterday's order "largely affirms the rules... while making some revisions and clarifications such as modifying provider record-keeping requirements when directing consumers to a label on an alternative sales channel and confirming that providers may state 'taxes included' when their price already incorporates taxes," the FCC said.

[...] Rejecting the broadband industry's request, the FCC order yesterday said:

[W]e affirm our requirement that providers display all monthly fees with respect to broadband service on the label to provide consumers with clear and accurate information about the cost of their broadband service. We thus decline providers' request that they not disclose those fees or that they instead display an "up to" price for certain fees they choose to pass through to consumers.

Specifically, "providers must itemize the fees they add to base monthly prices, including fees related to government programs they choose to 'pass through' to consumers, such as fees related to universal service or regulatory fees," the FCC said.

Ha Ha!


Original Submission

posted by hubie on Friday September 01 2023, @04:16AM   Printer-friendly
from the practicing-ethical-management dept.

Arthur T Knackerbracket has processed the following story:

Samsung's compliance committee chair has told local media the massive conglomerate is now on the straight and narrow, after years spent dealing with the legal fallout of past ethical lapses.

Lee Chan-hee told South Korean newswire Yonhap the chaebol's culture has changed, and potentially sensitive issues are now investigated by the committee he chairs.

"I think management now believes abiding by the law is much more helpful in doing business. They paid a costly price for caving to short-sighted gain and political pressure," said Lee.

The compliance committee Lee heads was launched in 2020 following a 2019 court order requiring Samsung to adopt preventative measures against ethical breaches.

Lee's comments come a week after Samsung reportedly decided to rejoin industry group the Federation of Korean Industries (FKI).

Samsung left the group six years ago amidst scandal when South Korea's president, Park Geun-hye, was found to have used FKI as a means to secure payments from member companies – including Samsung. That finding diminished the Federation's reputation and saw Park impeached and jailed for nearly five years.

[...] FKI since then has sought to rehabilitate its image. Last week it even changed its name to Korea Economic Association and set up an ethics committee.

In his inaugural address, the lobby group's newly appointed chairman, Ryu Jin, pledged to "clean up the dark past and cut off the wrong links," adding that the reconstituted org will "practice ethical management and ensure that a transparent corporate culture takes root throughout the business world."


Original Submission

posted by hubie on Thursday August 31 2023, @11:49PM   Printer-friendly
from the astronomy dept.

https://arstechnica.com/science/2023/08/we-dont-understand-how-a-freakishly-heavy-exoplanet-could-have-formed/

Neptune-sized planet has a density similar to pure silver.

Scientists have been working on models of planet formation since before we knew exoplanets existed. Originally guided by the properties of the planets in our Solar System, these models turned out to be remarkably good at also accounting for exoplanets without an equivalent in our Solar System, like super Earths and hot Neptunes. Add in the ability of planets to move around thanks to gravitational interactions, and the properties of exoplanets could usually be accounted for.

Today, a large international team of researchers is announcing the discovery of something our models can't explain. It's roughly Neptune's size but four times more massive. Its density—well above that of iron—is compatible with either the entire planet being almost entirely solid or it having an ocean deep enough to drown entire planets. While the people who discovered it offer a couple of theories for its formation, neither is especially likely.

Journal Reference:
Naponiello, L., Mancini, L., Sozzetti, A. et al. A super-massive Neptune-sized planet. Nature (2023). https://doi.org/10.1038/s41586-023-06499-2


Original Submission

posted by requerdanos on Thursday August 31 2023, @10:30PM   Printer-friendly
from the your-governance-at-work dept.

Meeting Announcement: The next meeting of the SoylentNews governance committee will be Friday, September 1st, 2023 at 20:30 UTC (1:30pm PDT, 4:30pm EDT) in #governance on SoylentNews IRC. Logs of the meeting will be available afterwards for review, and minutes will be published when available.

The agenda for the upcoming meeting will also be published when available. Minutes and agenda, and other governance committee information are to be found on the SoylentNews Wiki at: https://wiki.staging.soylentnews.org/wiki/Governance

Our community is always encouraged to observe and participate, and is invited to the meeting. Hope to see you then!

posted by hubie on Thursday August 31 2023, @07:05PM   Printer-friendly
from the will-this-be-on-the-exam? dept.

From a pool of 32 university-level courses from eight disciplines, from political science to computer science, the average university student is being surpassed by ChatGPT. Exceptions in Maths, which is odd since it's basically a giant calculator, and with tick questions, that it apparently can't identify and detect properly.

It is not made clear the level of the courses beyond that it mainly appears to be undergraduate courses, there should still be a difference between first and last year in level. Perhaps there is a difference from first year courses where it's mostly a matter of reciting known facts and data to the later half when the requirements of more critical thinking and interpretation and analysis is required.

Other findings include that AI plagiarism detecting is poor and mostly unable to tell which text was written by a human and which is regurgitated AI text blobs.

Alternatively it could also be that the average student have just gotten worse over the years. The bottom end of the spectrum has increased as more and more students are forced into academia.

https://www.nature.com/articles/s41598-023-38964-3
https://www.theregister.com/2023/08/25/chatgpt_outperforms_average_uni_students/


Original Submission

posted by hubie on Thursday August 31 2023, @02:23PM   Printer-friendly
from the STOP-in-the-name-of dept.

Gizmodo and Wired, among other sources, report that Polish railways were halted on Friday and Saturday due to unauthorized radio broadcasts. Polish railroads use the broadcasting of three tones on the 151.010 MHz frequency to instruct trains to stop. This occurred in three locations around Poland. Cheap radio equipment would be sufficient to issue the stop command, though it required that whoever broadcasted the signal would need to be in close proximity to the location affected. Despite the simplicity of the attack, there probably needed to be some coordination to broadcast the signals at different places in Poland.

There is no authentication or encryption to issue the emergency stop command, though discussions on various forums suggest that only the stop command is broadcast in this manner. A general design principle in railroad signaling systems is that the default should be to stop trains. For example, the multi-colored signaling lights commonly used in the United States and Canada that still mechanically switch between colors will default to a red stop signal. Trains require long distances to stop, and defaulting to a stop signal will prevent collisions. Authorities in Poland insist that there was there was no safety risk to rail passengers, and this seems reasonable if the unauthorized broadcasts were only able to issue an emergency stop command but not to instruct trains to move.

When this topic was discussed on Slashdot, it quickly turned to politics, but I find the technical aspects of this much more interesting. In North America, lights and semaphores are common and simple signaling mechanisms that have widespread use. For example, I know from experience that the same signaling system described in the video for use in Canada is also used on many BNSF main lines in the United States. However, other systems are also in use like the Advanced Train Control System (ATCS) and Positive Train Control (PTC). At some locations in the US, it was possible to use a software defined radio and software like ATCSMon to track the locations of trains in the area. However, railroads also generally also use unencrypted voice communications between trains and dispatchers, and these can still be monitored with a scanner.

My understanding is that ATCS was unencrypted and could be easily monitored in the locations where it was installed. Not all locations had ATCS installed, meaning that some subdivisions might have ATCS while others did not. More recently, companies like BNSF have been phasing out ATCS in favor of new systems, many of which are encrypted. I believe that ATCS was broadcast at frequencies around 900 MHz and was unencrypted, whereas PTC signals are broadcast at much lower frequencies around 200 MHz and are encrypted. Although the encryption provides a greater level of security, and presumably systems still are engineered to default to stopping trains if the signaling systems aren't functioning, these changes also make it much more difficult to track the movement of trains for anyone who doesn't have the encryption keys.

Perhaps I'm misunderstanding some aspect of the system, but is there anything that would prevent a radio-based signaling system from using public key encryption? For example, a company like BNSF would have a private key for signals from their dispatchers and trains. Any trains operating on one of BNSF's subdivisions, whether BNSF, UP, Amtrak, or any other trains could then use BNSF's public key to decrypt the signals, verify that they were actually sent by the dispatcher, and then act accordingly on the signal. Any trains operating on the subdivision could use their owner's private key to send their location, speed, and any other information. For example, an Amtrak train operating on a BNSF subdivision would use the Amtrak private key to encrypt their data, but anyone with Amtrak's public key, including the BNSF dispatcher, could verify that the data was actually sent by the Amtrak train. This seems like it would make interoperability easier because it wouldn't require sharing the private key with other train operators using BNSF's subdivisions.

Public keys could be freely shared with everyone, meaning that the public could also monitor train locations and signals but would not easily be able to spoof the signals. It would be necessary to ensure that the signaling system wouldn't be vulnerable to recording and repeating an earlier encrypted command, but it's not clear that a public key system would be inherently more vulnerable to a repetition attack. I am curious if anyone knows why a system like this isn't implemented on US railroads, which should prevent attacks like what happened in Poland, but without locking out the public from monitoring train signals.


Original Submission

posted by hubie on Thursday August 31 2023, @09:38AM   Printer-friendly
from the like-a-canary-in-a-honey-pot dept.

Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders.

In large metropolitan areas, tourists are often easy to spot because they're far more inclined than locals to gaze upward at the surrounding skyscrapers. Security experts say this same tourist dynamic is a dead giveaway in virtually all computer intrusions that lead to devastating attacks like data theft and ransomware, and that more organizations should set simple virtual tripwires that sound the alarm when authorized users and devices are spotted exhibiting this behavior.

In a blog post published last month, Cisco Talos said it was seeing a worrisome "increase in the rate of high-sophistication attacks on network infrastructure." Cisco's warning comes amid a flurry of successful data ransom and state-sponsored cyber espionage attacks targeting some of the most well-defended networks on the planet.

But despite their increasing complexity, a great many initial intrusions that lead to data theft could be nipped in the bud if more organizations started looking for the telltale signs of newly-arrived cybercriminals behaving like network tourists, Cisco says.

"One of the most important things to talk about here is that in each of the cases we've seen, the threat actors are taking the type of 'first steps' that someone who wants to understand (and control) your environment would take," Cisco's Hazel Burton wrote. "Examples we have observed include threat actors performing a 'show config,' 'show interface,' 'show route,' 'show arp table' and a 'show CDP neighbor.' All these actions give the attackers a picture of a router's perspective of the network, and an understanding of what foothold they have."

"Many people have pointed out that there are a handful of commands that are overwhelmingly run by attackers on compromised hosts (and seldom ever by regular users/usage)," the Thinkst website explains. "Reliably alerting when a user on your code-sign server runs whoami.exe can mean the difference between catching a compromise in week-1 (before the attackers dig in) and learning about the attack on CNN."

These canaries — or "canary tokens" — are meant to be embedded inside regular files, acting much like a web beacon or web bug that tracks when someone opens an email.

"Imagine doing that, but for file reads, database queries, process executions or patterns in log files," the Canary Tokens documentation explains. "Canarytokens does all this and more, letting you implant traps in your production systems rather than setting up separate honeypots."

[...] Meer says canary tokens are as likely to trip up attackers as they are "red teams," security experts hired or employed by companies seeking to continuously probe their own computer systems and networks for security weaknesses.

"The concept and use of canary tokens has made me very hesitant to use credentials gained during an engagement, versus finding alternative means to an end goal," wrote Shubham Shah, a penetration tester and co-founder of the security firm Assetnote. "If the aim is to increase the time taken for attackers, canary tokens work well."


Original Submission

posted by hubie on Thursday August 31 2023, @04:57AM   Printer-friendly

Arthur T Knackerbracket has processed the following story:

Babies' and toddlers' access to more screen time could lead to developmental risks, according to a new study published in The Journal of the American Medical Association of Pediatrics (JAMA) on Monday. The study, conducted by researchers in Japan looked at the amount of time 7,097 children spent on tablets, phones, watching TV, or using other technology and how it related to their corresponding mental and physical abilities as they got older.

[...] The study found that by two years old, babies who spent up to four hours per day in front of a screen were three times more likely to experience communication and problem-solving delays, while those who spent four or more hours on their devices were 5.78 times more likely to experience the same delays. They were also 1.74 times more likely to have underdeveloped fine motor skills and two times more likely to have not properly developed their personal and social skills.

The study reported that four-year-old children who had more screen time had developmental delays in communication, gross motor and fine motor skills, problem-solving skills, and personal and social skills.

“Kids learn how to talk if they’re encouraged to talk, and very often, if they’re just watching a screen, they’re not having an opportunity to practice talking,” Dr. John Hutton, associate professor of general and community pediatrics at Cincinnati Children’s Hospital Medical Center, who wasn’t involved in the study told CNN. “They may hear a lot of words, but they’re not practicing saying a lot of words or having a lot of that back-and-forth interaction.”

[...] Increased screen time can also affect the child’s ability to be bored, Hutton told CNN, adding that boredom breeds creativity and allows the child to pacify themselves, rather than becoming reliant on a screen.

“Longer term, one of the real goals is for kids just to be able to sit quietly in their own thoughts,” Hutton told the outlet. “When they’re allowed to be a little bit bored for a second, they get a little uncomfortable, but then they’re like, ‘OK, I want to make myself more comfortable.’ And that’s how creativity happens.”

A Unicef report said more screen time can also reduce a child’s ability to build empathy, saying: “For a brain to develop and grow, it needs essential stimuli from the outside world. More importantly, they need time to process those stimuli.” It added: “Exposure to screens reduces babies’ ability to read human emotion and control their frustration. … It also detracts from activities that help boost their brain power, like playing and interacting with other children.”

Journal Reference:
Takahashi I, Obara T, Ishikuro M, et al. Screen Time at Age 1 Year and Communication and Problem-Solving Developmental Delay at 2 and 4 Years. JAMA Pediatr. Published online August 21, 2023. doi:10.1001/jamapediatrics.2023.3057


Original Submission

posted by hubie on Thursday August 31 2023, @12:10AM   Printer-friendly
from the Oceanology dept.

https://www.theguardian.com/environment/2023/aug/23/discovered-in-the-deep-octopus-garden-davidson-seamount-california-like-hot-tub-hatchery

Scientists have solved the mystery of why tens of thousands of octopuses cluster on the foothills of a giant underwater mountain, two miles down off the coast of California. The pearl octopuses, so named because from a distance they look like scattered gems, seek out warm water seeping through the seabed and use it to speed up the hatching of their eggs
...
The mauve, grapefruit-sized female octopuses each lay about 60 eggs and cement them to the bare rock, then guard them until they hatch. Temperature probes showed the water bathing the eggs ranged from 5C to 10C (40-50F), while less than a metre away it dropped to a frigid 1.6C.

Revisiting individual nests, the team saw that rather than taking a decade or longer to hatch, as would happen in the very cold deep sea, baby octopuses emerge from their cosy nests after less than two years, dramatically boosting their chances of survival.


Original Submission

posted by hubie on Wednesday August 30 2023, @07:24PM   Printer-friendly
from the we-all-need-more-Excel-formulas-in-our-lives dept.

Excel gets containerized, cloud-based Python analytics and visualization powers:

If you're decent in Python (or aspire to be) but don't have the chops for advanced data work in Excel, Microsoft now offers the kind of peanut butter-and-chocolate combination that you may consider a gift. At least until it goes behind the paywall.

Microsoft's Stefan Kinnestrand, writing about "the best of both worlds for data analysis and visualization," writes that this public preview of Python in Excel will allow spreadsheet tinkerers to "manipulate and explore data in Excel using Python plots and libraries and then use Excel's formulas, charts, and PivotTables to further refine your insights."

Microsoft partnered with Python analytics repository Anaconda to bring libraries like Pandas, Statsmodels, and Matplotlib into Excel. Python in Excel runs on Microsoft's cloud servers, and the company is touting the security that should offer. Python runs in isolated containers, with no access to devices, your network, or user tokens, Microsoft states. Python and Excel can only really talk to each other through limited functions—xl() and =PY()—that can only return code results, not macros, VBA code, or other data, Microsoft claims.

[...] It will be interesting to see how Python's integration into Excel works out. It's a very specialized, cloud-hosted, and seemingly containerized and secured code offering. But Office apps' history with Visual Basic for Applications (VBA) scripts and macros has a long history of exploits, patches, and more exploits. Early last year, Microsoft all but banned downloaded macros in Office unless someone goes out of their way to get infected. Barring that, it's an intriguing expansion of a code environment that is already Turing complete.


Original Submission

posted by hubie on Wednesday August 30 2023, @02:40PM   Printer-friendly
from the necro-web dept.

Secure your domain name for the next 100 years with Wordpress, a company that has only been around for about 20 years.
For only $38k including hosting fees and domain name. It's not exactly cheap, but I guess they had to include the cost of inflation and other increases for the next 100 years.

Still unsure what is the weirdest part of it -- that they in general believe the system with domain names will be around in a century or that Wordpress will still be around. Also do you have to pay the century fee in advance or is it an installment plan per year or decade or? Not sure I would care to plonk down $38k at once for a domain name.

Is this the future of the web? A necropolis of dead sites that never update. Who is there to secure that you actually remain online after death? Beyond trust and that you are hoping that Wordpress remains online.

https://wordpress.com/blog/2023/08/25/introducing-the-100-year-plan/
https://www.searchenginejournal.com/wordpress-100-year-domain-name-registrations/


Original Submission

posted by hubie on Wednesday August 30 2023, @09:58AM   Printer-friendly

What's the point of locks when hackers can easily get the keys to unlock them?

In July, security researchers revealed a sobering discovery: hundreds of pieces of malware used by multiple hacker groups to infect Windows devices had been digitally signed and validated as safe by Microsoft itself. On Tuesday, a different set of researchers made a similarly solemn announcement: Microsoft's digital keys had been hijacked to sign yet more malware for use by a previously unknown threat actor in a supply-chain attack that infected roughly 100 carefully selected victims.

The malware, researchers from Symantec's Threat Hunter Team reported, was digitally signed with a certificate for use in what is alternatively known as the Microsoft Windows Hardware Developer Program and the Microsoft Windows Hardware Compatibility Program. The program is used to certify that device drivers—the software that runs deep inside the Windows kernel—come from a known source and that they can be trusted to securely access the deepest and most sensitive recesses of the operating system. Without the certification, drivers are ineligible to run on Windows.

Somehow, members of this hacking team—which Symantec is calling Carderbee—managed to get Microsoft to digitally sign a type of malware known as a rootkit. Once installed, rootkits become what's essentially an extension of the OS itself. To gain that level of access without tipping off end-point security systems and other defenses, the Carderbee hackers first needed its rootkit to receive the Microsoft seal of approval, which it got after Microsoft signed it.

With the rootkit signed, Carderbee went on to pull another audacious feat. Through means that aren't yet clear, the group attacked the infrastructure of Esafenet, a China-based developer of software, known as the Cobra DocGuard Client, for encrypting and decrypting software so it can't be tampered with. Then, Carderbee used its newfound control to push malicious updates to roughly 2,000 organizations that are Cobra DocGuard customers. Hacking group members then pushed the Microsoft-signed rootkit to roughly 100 of those organizations. Representatives with Esafenet and its parent company, NSFOCUS, didn't respond to an email asking for verification.

[...] In recent months, Microsoft has come under blistering criticism for security practices that led to the breach of dozens of accounts belonging to customers using the company's Azure and Exchange cloud offerings. What's arguably worse has been the company's opaque notifications of those events and the role Microsoft played in their origins. The CEO and chairman of security firm Tenable, Amit Yoran, recently said the company's security was mired in "grossly irresponsible" practices and a "culture of toxic obfuscation."

Those same dynamics are at play in Microsoft's recent failures in policing the processes it put in place for digitally certifying trustworthy Windows drivers. The near-verbatim advisories mentioned earlier—one from last December and the other from last month—illustrate that whatever the company has been doing to lock down the program isn't working. They also show how the company relies on vague and ambiguous notifications that aim to conceal as much as inform.

Microsoft's driver-signing requirement is founded on a concept known as security in depth. The idea is to have multiple layers of security so that if one fails, another will prevent a breach or at least contain the damage. In this case, certificates are a hedge designed to lessen the harm that comes when an adversary gains administrative system rights to a compromised device.

Virtually all of the key-hijacking incidents reported in recent years have been attributed to Chinese hackers, usually for espionage purposes. Microsoft's string of failures in locking down its certification program, and its reticence when disclosing them, are undermining the entire concept of security, much to the delight of these adversaries.


Original Submission