Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 19 submissions in the queue.

Log In

Log In

Create Account  |  Retrieve Password


Site News

Join our Folding@Home team:
Main F@H site
Our team page


Funding Goal
For 6-month period:
2022-07-01 to 2022-12-31
(All amounts are estimated)
Base Goal:
$3500.00

Currently:
$438.92

12.5%

Covers transactions:
2022-07-02 10:17:28 ..
2022-10-05 12:33:58 UTC
(SPIDs: [1838..1866])
Last Update:
2022-10-05 14:04:11 UTC --fnord666

Support us: Subscribe Here
and buy SoylentNews Swag


We always have a place for talented people, visit the Get Involved section on the wiki to see how you can make SoylentNews better.

Idiosyncratic use of punctuation - which of these annoys you the most?

  • Declarations and assignments that end with }; (C, C++, Javascript, etc.)
  • (Parenthesis (pile-ups (at (the (end (of (Lisp (code))))))))
  • Syntactically-significant whitespace (Python, Ruby, Haskell...)
  • Perl sigils: @array, $array[index], %hash, $hash{key}
  • Unnecessary sigils, like $variable in PHP
  • macro!() in Rust
  • Do you have any idea how much I spent on this Space Cadet keyboard, you insensitive clod?!
  • Something even worse...

[ Results | Polls ]
Comments:59 | Votes:103

posted by janrinok on Monday October 02 2023, @11:43PM   Printer-friendly

https://solarsystem.nasa.gov/eclipses/home/

Safety is the number one priority when viewing a solar eclipse. Be sure you're familiar with and follow these safety guidelines when viewing an eclipse.
[...]
Quick fact:
The U.S. will experience the next two solar eclipses: an annular in October 2023 and a total in April 2024. You can see the paths and download the map of these eclipses here. See Also: Annular Solar Eclipse: October 14, 2023
Total Solar Eclipse: April 8, 2024

from Annular solar eclipse 2023: Everything you need to know about North America's 'ring of fire' eclipse

Roughly 11 years after the same type of solar eclipse crossed the U.S. Southwest on May 20, 2012, this one will be visible from a similar region, crossing eight U.S. states from Oregon to Texas, according to NASA.

During an annular solar eclipse, the moon appears slightly smaller than the sun, so it can't block the entire disk. The result is a beautiful "ring of fire." Here's everything you need to know about this rare event.

The Total Solar Eclipse event on April 8, 2024 will be a Partial Solar Eclipse in the UK. Solar and Lunar Eclipses in Europe – Next 10 Years


Original Submission

posted by janrinok on Monday October 02 2023, @07:02PM   Printer-friendly

Arthur T Knackerbracket has processed the following story:

Like the US Navy has long protected sea lanes during conflict, the military could be called upon to defend commercial satellites from attack, particularly as the Pentagon relies more on commercial networks for communication and surveillance, the Space Force's top general said last week.

In comments at a conference in Hawaii on September 20, Gen. Chance Saltzman echoed many statements made by military leaders over the last few years: US military space capabilities are under threat from China and Russia, military leaders need more information about what other countries are doing in space, and commercial satellites are playing an ever-larger role in the military's space programs.

But Saltzman went a little further in his comments when asked about the military's role in protecting commercial satellites from an attack. The questioner specifically asked how the US military might respond if Russia attacked SpaceX's Starlink broadband network, which Ukraine widely uses for Internet connectivity in its war with Russia, despite Elon Musk's refusal to allow Ukraine to employ Starlink services on certain military operations.

Saltzman didn't directly address the scenario posed in the question, but he clearly suggested the US military has a responsibility to defend commercial assets in space.

In a modern war, "there are going to be commercial entities, commercial organizations, commercial capabilities and assets that get caught up in the conflicts," Saltzman said. "Space is no different than sea lanes. It’s no different than civilian airliner traffic in Europe right now. The US has a long history of saying we’re going to protect the things that we need to be successful. So it would stand to reason that that same philosophy would extend into space, and I have no reason to believe that that will be different.”

A hypothetical military operation to defend a commercial satellite from an adversary's attack would likely go through US Space Command, a separate entity from the Space Force, which is charged with equipping and outfitting the military's combatant commands with the people and technology to carry out their missions.

Space Command is currently led by US Army Gen. James Dickinson. In July, Dickinson basically punted on a similar question about defending commercial satellites from a foreign attack.

"I do have a mission area protecting and defending, and that's widely known, assets on orbit," he replied. "But to be honest with you, those have to be directed to me by, you know, my boss, and my boss's boss, eventually if that were to happen."

Saltzman said last week that it would be up to Dickinson's command, and ultimately civilian leadership, to set the priorities on what commercial capabilities to defend from attack.

“The key will be how much capacity do you have to defend, and what are the things that you choose to defend at the highest prioritization," Saltzman said.


Original Submission

posted by janrinok on Monday October 02 2023, @03:37PM   Printer-friendly

It seems that a couple of recent stories have suddenly disappeared off our screens. We are looking into the cause but I apologize for those who were having a discussion which has now been cut short.

We will keep you informed.

janrinok

posted by martyb on Monday October 02 2023, @02:30PM   Printer-friendly
from the my.lucy.liu.bot dept.

https://thehill.com/opinion/technology/4218666-ai-girlfriends-are-ruining-an-entire-generation-of-men/

The rise of virtual artificial intelligence (AI) girlfriends is enabling the silent epidemic of loneliness in an entire generation of young men. It is also having severe consequences for America's future.

Are they really lonely if they have their AI girlfriend?

Interesting how this becomes a man problem, and not a woman problem. The blame here is entirely shifted towards the male of the species. While women are somehow innocent victims, as per usual. Are there no AI boyfriends, there are. They just don't seem to be problematic. Which is odd.

https://www.youtube.com/embed/IrrADTN-dvg


Original Submission

posted by janrinok on Monday October 02 2023, @06:59AM   Printer-friendly

Arthur T Knackerbracket has processed the following story:

The hollowing out of U.S. cities' office and commercial cores is a national trend with serious consequences for millions of Americans. As more people have stayed home following the COVID-19 pandemic, foot traffic has fallen. Major retail chains are closing stores, and even prestigious properties are having a hard time retaining tenants.

The shuttering of a Whole Foods market after only a year in downtown San Francisco in May 2023 received widespread coverage. Even more telling was the high-end department store Nordstrom's decision to close its flagship store there in August after a 35-year run.

In New York City, office vacancy rates have risen by over 70% since 2019. Chicago's Magnificent Mile, a stretch of high-end shops and restaurants, had a 26% vacancy rate in spring 2023.

A recent study from the University of Toronto found that across North America, downtowns are recovering from the pandemic more slowly than other urban areas and that "older, denser downtowns reliant on professional or tech workers and located within large metros" are struggling the hardest.

Over more than 50 years of researching urban policy, I have watched U.S. cities go through many booms and busts. Now, however, I see a more fundamental shift taking place. In my view, traditional downtowns are dead, dying or on life support across the U.S. and elsewhere. Local governments and urban residents urgently need to consider what the post-pandemic city will look like.

U.S. downtowns were in trouble before the COVID-19 pandemic. Today's overhang of excess commercial space was years in the making.

Urban property markets are speculative enterprises. When the economy is booming, individual developers decide to build more—and the collective result of these rational individual decisions is excess buildings.

In the 1980s, the Reagan administration allowed a quicker depreciation of commercial real estate that effectively lowered tax rates for developers. With financial globalization, foreign money flowed into the U.S. property sector, especially to very big development projects that could absorb large pools of liquid capital looking for relatively safe long-term investments.

Years of low interest rates meant cheap money for developers to finance their projects. City governments were eager to greenlight projects that would generate tax revenues. In many downtowns, office space now takes up between 70% and 80% of all real estate.

COVID-19 finally burst this 40-year bubble. During pandemic lockdowns, many people worked from home and became comfortable with virtual meetings. Telecommuting grew as conventional commuting declined. Workers with the resources and job flexibility moved from cities to so-called "zoom towns" where housing was more affordable and parks and outdoor activities were close at hand.

Now, many employers want their staffs to return to the office. However, workers are pushing back, especially against spending full five-day weeks in the office. New technologies have made it easier to work from home, and a tight labor market has strengthened employees' bargaining power.

Like many U.S. cities, Portland, Oregon, is losing downtown businesses. This is cutting into urban revenues and creating a perception of decline.

There are significant knock-on effects. A range of businesses, including restaurants, retail stores and services, rely on downtown office workers. At least 17% of all leisure and hospitality sector jobs are in the downtowns of the 100 largest U.S. cities.

In San Francisco, for example, a typical office worker used to spend $168 near their office per week. Now, with nearly 150,000 fewer office workers commuting downtown, about 33,000 people in the service and retail sectors have lost their jobs.

Today, many cities are confronting the prospect of an urban doom loop, with a massive oversupply of office and retail space, fewer commuters and a looming urban fiscal crisis. Washington, D.C., is an illustration.

In December 2022, the city had approximately 27,000 fewer jobs than in February 2020, and it faced a growing financial shortfall from declining property taxes due to downtown business closures and fewer property purchases. The District of Columbia government projects that city revenues will decline by US$81 million in fiscal year 2024, $183 million in 2025 and $200 million in 2026. Washington's Metropolitan Transit Authority faces a $750 million shortfall because of a sharp decline in ridership.

In the Communist Manifesto, Karl Marx and Friedrich Engels famously wrote that under the pressures of dynamic capitalism, "all that is solid melts into air." They could have been describing the ever-changing built form of the United States, with people and money flowing to Main Street stores through the 1960s, then to suburban malls in the 1970s and 80s, then abandoning malls for revived downtowns and online shopping. Now, traditional downtowns may be in similar terminal decline.

What can cities do with their surplus office spaces? In some cities, such as Columbus, Ohio, investors are purchasing deeply discounted buildings, demolishing them and finding more profitable uses for the land, such as residential and mixed-use buildings. Other options include converting commercial space into residences or more specialized applications such as biotech labs.


Original Submission

posted by martyb on Sunday October 01 2023, @02:38PM   Printer-friendly

Not all yeasts are created equally. Unlike the yeast used by bakers and beer brewers for converting sugars to carbon dioxide and fermentation, oleaginous yeasts convert sugars from inedible biomass into fats and oils.

A research group jointly led by Kyoto University and Ryukoku University has discovered two new species of oil-forming yeast in the soil of Shiga Prefecture. Published in the International Journal of Systematic and Evolutionary Microbiology, their study also examines the relationship between the prefecture's diverse climate and microbial ecology.

"We are gauging the potential benefits of applying oleaginous yeast to sustainable oil and fat production through isolation technology, particularly in reducing carbon dioxide emissions," says team leader and first author Ayumi Tanimura of KyotoU's Society Academia Collaboration for Innovation.

The discovery of two species—Hannaella oleicumulans, named after its oil-accumulating properties, and Hannaella higashiohmiensis from Higashiomi City—suggest the high potential of microbial resources in this region. They join the roughly 160 species of known oil yeast, including the previously known Lipomyces starkeyi, Rhodotorula toruloides, and Yarrowia lipolytica.

The diversity of yeast species in Japan reflects the latitudinal range of the Japanese archipelago. Shiga prefecture's diverse biomes—hydrosphere, forests, and arable land—and highly variable climate encourage this diversity. Tanimura promotes continuing efforts to search for new microbial resources in unexplored areas.

[...] At publication, approximately 160 species were reported as oleaginous yeast, producing more than 20% of their dry cell weight as lipids.

"However, since lipid content easily changes with changing conditions in culture, we may need to redefine the term oleaginous yeast," notes Tanimura.

Journal Reference:
Ayumi Tanimura, Hikaru Adachi​, Koichi Tanabe, et al. Hannaella oleicumulans sp. nov. and Hannaella higashiohmiensis sp. nov.,two novel oleaginous basidiomycetous yeast species [Open Access] (DOI https://dx.doi.org/10.1099/ijsem.0.006027)


Original Submission

posted by martyb on Sunday October 01 2023, @09:45AM   Printer-friendly
from the food dept.

We finally know for sure what a trilobite ate

Trilobites first appear early in the Cambrian and are one of the earliest examples of arthropods, the group that includes all insects. They flourished for over 100 million years, leaving fossils that are seemingly ubiquitous—we've described over 20,000 different trilobite species. That's over three times the number of mammalian species we're aware of.

Despite all those fossils, however, we've never found one with a meal inside it. We've been able to infer what some of them were likely to have been dining on based on their appearance and the ecosystems they were found in, but we haven't been able to establish what they ate with certainty. But today, researchers are describing an exquisitely preserved sample that includes several of the animal's last meals, which suggests that this particular animal was a bit like an aquatic vacuum cleaner.

[...] The one caution the researchers raise about this find is that the feeding behavior of the trilobite may not be entirely normal. There's a discontinuity in the animal's shell between two of its segments, which can be an indication that it's getting ready to molt. If that's the case, the animal may have been overeating to generate additional pressure to help it break out of its old shell.

So, after tens of thousands of trilobite fossils, we finally have one with food inside of it. Yet it seems to be from a species that had a bizarre feeding pattern, and this particular individual may have been sucking down more food than usual. So, we'll probably need to find a few more of these to get a better picture of what trilobites ate.

Journal Reference:
Petr Kraft, Valéria Vaškaninová, Michal Mergl, et al. Uniquely preserved gut contents illuminate trilobite palaeophysiology Nature (2023). (DOI: http://dx.doi.org/10.1038/s41586-023-06567-7)


Original Submission

posted by martyb on Sunday October 01 2023, @05:00AM   Printer-friendly
from the Steve-Majors-need-not-apply dept.

This robotic exoskeleton can help runners sprint faster:

The exosuit could prove a useful tool for athletes looking to speed up during training. "Although this is a preliminary study, we can say the exosuit can augment the human ability to run," says Giuk Lee, an associate professor at Chung-Ang University in Seoul, South Korea, who led the research.

Lee and his team built a lightweight exosuit with steel cables powered by electrical motors attached to the runner's thighs. The motors pull the cables, mimicking the contraction of muscles. The exosuit helps people run faster by assisting their hip extension—the powerful motion that propels a runner forward.

The exosuit tracks the wearer's lower-body movements in real time through sensors on both thighs. This data feeds into an algorithm designed to monitor gait, which works in tandem with other algorithms to track each runner's individual running style and speed.

Journal Reference:
Junyoung Moon, Kimoon Nam, Jaewook Ryu, et al. Reducing sprint time with exosuit assistance in the real world (DOI: 10.1126/scirobotics.adf5611)


Original Submission

posted by janrinok on Sunday October 01 2023, @12:19AM   Printer-friendly

Backdoored firmware lets China state hackers control routers with "magic packets"

https://arstechnica.com/security/2023/09/china-state-hackers-are-camping-out-in-cisco-routers-us-and-japan-warn/

Hackers backed by the Chinese government are planting malware into routers that provides long-lasting and undetectable backdoor access to the networks of multinational companies in the US and Japan, governments in both countries said Wednesday.

The hacking group, tracked under names including BlackTech, Palmerworm, Temp.Overboard, Circuit Panda, and Radio Panda, has been operating since at least 2010, a joint advisory published by government entities in the US and Japan reported. The group has a history of targeting public organizations and private companies in the US and East Asia. The threat actor is somehow gaining administrator credentials to network devices used by subsidiaries and using that control to install malicious firmware that can be triggered with "magic packets" to perform specific tasks.

The hackers then use control of those devices to infiltrate networks of companies that have trusted relationships with the breached subsidiaries.

"Specifically, upon gaining an initial foothold into a target network and gaining administrator access to network edge devices, BlackTech cyber actors often modify the firmware to hide their activity across the edge devices to further maintain persistence in the network," officials wrote in Wednesday's advisory. "To extend their foothold across an organization, BlackTech actors target branch routers—typically smaller appliances used at remote branch offices to connect to a corporate headquarters—and then abuse the trusted relationship of the branch routers within the corporate network being targeted. BlackTech actors then use the compromised public-facing branch routers as part of their infrastructure for proxying traffic, blending in with corporate network traffic, and pivoting to other victims on the same corporate network."

[...] To install their modified bootloader, the US and Japanese advisory said, the threat actors install an older version of the legitimate firmware and then modify it as it runs in memory. The technique overrides signature checks in the Cisco ROM monitor signature validation functions, specifically functions of Cisco's IOS Image Load test and the Field Upgradeable ROMMON Integrity test. The modified firmware, which consists of a Cisco IOS loader that installs an embedded IOS image, allows the compromised routers to make connections over SSH without being recorded in event logs.


Original Submission

posted by janrinok on Saturday September 30 2023, @07:27PM   Printer-friendly
from the serial-hydrater dept.

https://arstechnica.com/health/2023/09/big-dairy-still-sour-over-plant-based-milk-labels-tries-to-outlaw-them/

In an utterly firm effort to undercut plant-based rivals, big players in the dairy industry are again putting the squeeze on lawmakers to outlaw the use of the term "milk" for non-dairy beverages—or, in Food and Drug Administration lingo, beverages that are not the "lacteal secretion of cows."

Earlier this year, the dairy industry's blood curdled when the regulatory agency released a draft guidance stating that plant-based milk alternatives can keep using the term. It was a move that followed years of sour resentment over the labeling.

The FDA did humbly admit that almonds and other sources of plant-based milk don't, in fact, lactate;

[...] Following the FDA's milk ruling, dairy industry groups rounded up support from lawmakers to try to reverse it. Specifically, they got members of the House and Senate to push a bill called the DAIRY PRIDE Act.

[...] Dairy-state lawmakers are now trying to get the bill signed into law in the coming months as part of the 2023 farm bill reauthorization, according to a report by Stat News.

People that drink milk alternatives, don't want to drink milk. People that want to drink milk, don't confuse Almond/Coconut "milk" for milk.

What about goats' milk? Cleansing milk for removing makeup, milk of magnesia (medication), the milksnake (a reptile)?


Original Submission

posted by martyb on Saturday September 30 2023, @02:44PM   Printer-friendly
from the petty-level-disputes dept.

If Congress does not pass a measure to fund the government by Sunday, October 1, a partial shutdown of the United States government will begin. Much of the federal government is funded each fiscal year by 12 appropriations bills. None of the appropriations bills for the 2024 fiscal year have been signed into law, which is not especially uncommon at the start of a new fiscal year. Instead, Congress authorizes funding at the levels from the previous fiscal year through a continuing resolution (CR), and then the appropriations bills are signed into law when they are ready. The Senate is scheduled to vote on such a CR on Saturday, though any Senator can refuse the expedited process for debating the bill, and delay the vote until Monday. Although the CR is expected to pass the Senate with bipartisan support, the House is highly unlikely to pass any funding bills before the government shutdown begins.

The impending government shutdown is likely to have significant effects on scientific research, as noted in a Nature article:

Fuelled by infighting among Republicans in the House of Representatives over spending cuts, the United States is barreling towards a government shutdown. Lawmakers in the US Congress have until 30 September (the end of the fiscal year) to reach an agreement over how to keep money flowing to federal agencies, or the government will have to close many of its doors and furlough staff — including tens of thousands of scientists — without pay. Depending on how long the shutdown lasts, work at science agencies will stop, interrupting experiments, delaying the approval of research grants and halting travel to scientific conferences.

A lot of academic research is funded from government grants from agencies like NSF. For grants that have already been approved, universities can continue to conduct research. However, the shutdown will halt the review and approval of new grants. The same article from Nature reports:

The US National Science Foundation (NSF), expects to halt work for 1,487 out of its 1,946 employees, once short-term funding runs out, for example. Scientists can continue to submit applications for funding to the agency, which pays for about one-quarter of the taxpayer-supported basic research in the United States, but no new projects will be approved. The Department of Health and Human Services, which houses the US National Institutes of Health, a significant funder of biomedical research, plans to furlough some 37,325 people — 42% of its staff — by the second day of a shutdown. 'Essential' staff working at its clinical centre or on public-safety missions such as monitoring for viral outbreaks will continue to report to work.

An article in Science states that many clinical trials supported by the National Institutes of Health (NIH) will be affected:

NIH was mostly spared in the last shutdown because its budget had already been approved by Congress, but this time it will feel the impact. A subset of its nearly 19,800 employees—just 4427, or 22%—will remain on duty to care for patients at the NIH Clinical Center and maintain research animals and cell lines for labs in the agency's intramural research program. No new patients will be enrolled in trials unless their illness is life threatening. The agency also expects to keep open PubMed, which holds biomedical research abstracts needed for health care, and the ClinicalTrials.gov registry, where reporting of clinical studies is a legal requirement.

However, the Science article notes that some astronomy research will continue to be conducted during the shutdown due to leftover funds from the current fiscal year or other external funding:

As for research infrastructure that NSF supports, a small number of employees deemed essential will continue to provide support for research programs in the Arctic and Antarctic. And many NSF-funded telescopes should be able to remain open for an extended period thanks to extra funding the agency provided this year to tide them over in case of a shutdown. Most of the optical telescopes are managed for NSF by a nongovernmental organization, the Association of Universities for Research in Astronomy (AURA). It has "sufficient financial resources to maintain our functional and research activities for a reasonable length of time," an AURA spokesperson told ScienceInsider.

At the National Radio Astronomy Observatory (NRAO), run by a university coalition, "We are doing exactly nothing special to prepare for the shutdown," Director Tony Beasley says. That contrasts with the government shutdown of 2013, when NRAO was forced to switch off its U.S.-based facilities after just a few days.

Other agencies will continue to provide services that are deemed essential but will cease other operations. For example, the National Weather Service will continue to issue forecasts and warnings but research to improve weather forecasts will be halted during a shutdown. As in the 2019 government shutdown, the forecasters who issue alerts such as tornado and hurricane warnings will be expected to do so but won't be paid until the shutdown ends.

In summary, the looming government shutdown will not halt science-related activities that are deemed necessary to imminently protecting life and property, such as issuing weather warnings. However, the employees who provide those services will not get paid until after the government shutdown ends. For agencies that do not have supplemental funds available, scientific research will generally be halted.


Original Submission

posted by martyb on Saturday September 30 2023, @10:04AM   Printer-friendly

Bing Chat responses infiltrated by ads pushing malware:

Bing Chat responses infiltrated by ads pushing malware

Malicious advertisements are now being injected into Microsoft's AI-powered Bing Chat responses, promoting fake download sites that distribute malware.

Bing Chat, powered by OpenAI's GPT-4 engine, was introduced by Microsoft in February 2023 to challenge Google's dominance in the search industry.

By offering users an interactive chat-based experience instead of the traditional search query and result format, Bing Chat aimed to make online searches more intuitive and user-friendly.

In March, Microsoft began injecting ads into Bing Chat conversations to generate revenue from this new platform.

However, incorporating ads into Bing Chat has opened the door to threat actors, who increasingly take out search advertisements to distribute malware.

Furthermore, conversing with AI-powered chat tools can instill unwarranted trust, potentially convincing users to click on ads, which isn't the case when skimming through impersonal search results.

This conversation-like interaction can imbue AI-provided URLs with a misplaced sense of authority and trustworthiness, so the existing problem of malvertizing in search platforms is amplified by the introduction of AI assistants.

The fact that these ads are labeled as promoted results when the user hovers over a link in Bing Chat conversations is likely too weak of a measure to mitigate the risk.

[...] The display of malvertising within Bing Chat conversations highlights the expanding frontier of cyber threats and makes it crucial for users to be wary of chatbot results and always double-check URLs before downloading anything.


Original Submission

posted by martyb on Saturday September 30 2023, @05:16AM   Printer-friendly

Disney's password-sharing crackdown has begun:

Starting on November 1st, Disney Plus will begin restricting password sharing. In Canada.

The company announced the change in an email sent to Canadian subscribers. Disney has not provided many details on how it plans to enforce this policy — its email merely states that "we're implementing restrictions on your ability to share your account or login credentials outside of your household." The announcement reads more like a strong finger wag than anything else. "You may not share your subscription outside of your household," reads the company's updated Help Center.

A new "account sharing" section in the Canadian subscriber agreement also notes that the company may "analyze the use of your account" and that failing to comply with the agreement could lead to account limits or termination.

The announcement comes over a month after Disney's Q3 earnings call, where CEO Bob Iger said that the company was "actively exploring" ways to address shared accounts. Iger said that a "significant" number of people are currently sharing passwords across Disney's services and added that Disney has the "technical capability" to monitor sign-ins.

Disney Plus is just the latest streaming service to attempt to tackle password sharing. Netflix has been testing such restrictions for over a year in various countries and began cracking down in the US in May 2023. Netflix accounts are restricted based on a user's IP address; subscribers, depending on the plan they select, have the option of adding additional members to their accounts for an additional fee. The company said in its Q2 earnings call that its policy has driven more subscribers to the service.

But hey, if it's any consolation: Canadian users now have access to the cheaper ad-supported tier. This next turn in the streaming wars is going to get pricey.


Original Submission

posted by janrinok on Saturday September 30 2023, @12:38AM   Printer-friendly
from the single-point-of-honeypot dept.

Cloudflare Users Exposed to Attacks Launched From Within Cloudflare: Researchers:

Gaps in Cloudflare's security controls allow users to bypass customer-configured protection mechanisms and target other users from the platform itself, technology consulting firm Certitude warns.

The issue, the company says, arises from the shared infrastructure that all Cloudflare tenants have access to, allowing malicious actors to abuse the trust customers place in the platform's protections to target them via Cloudflare.

A major cybersecurity vendor offering web application firewall (WAF), bot management, and distributed denial-of-service (DDoS) protections, Cloudflare relies on a network of reverse-proxy servers to inspect all traffic headed to customers' web servers for malicious activity.

According to Certitude, because traffic originating from Cloudflare's own infrastructure is considered trusted by default, it is not passed through the configured reverse-proxy servers, as is traffic from other parties.

Because of that, the consulting firm says, an attacker registered with Cloudflare can target other users on the platform, essentially bypassing the platform's protections.

One gap Certitude discovered is related to the 'Authenticated Origin Pulls' on Transport Layer mechanism, which relies on a Cloudflare SSL certificate for authentication.

When setting up the authentication mechanism to their web servers (origin servers), customers can opt for using a Cloudflare certificate or for using their own certificate.

However, because the available options are insufficiently documented, and because a custom certificate can only be used with an API, "it is reasonable to assume that customers will opt for the more convenient choice of using the Cloudflare certificate," Certitude notes.

The use of a shared certificate means that all connections originating from Cloudflare are permitted, regardless of the tenant initiating them.

A similar gap was identified in the 'Allowlist Cloudflare IP addresses' on Network Layer mechanism, which blocks connections originating from outside Cloudflare's IP ranges, but permits all connections from within Cloudflare's infrastructure.

"An attacker can establish a custom domain with Cloudflare, direct the DNS A record to the victims IP address. Next, they disable all protection features for that custom domain and route their attack(s) through Cloudflare's infrastructure, effectively bypassing the protection features that the victim has configured," Certitude explains.

The consulting firm has published a proof-of-concept (PoC) demonstration of these issues and recommends the use of custom certificates for connection authentication and the use of Cloudflare Aegis to mitigate the gaps.

Certitude says it reported the issues through Cloudflare's bug bounty program in March, and that its report was marked as 'informative' and closed without a fix. A Cloudflare spokesperson has yet to respond to SecurityWeek's request for a statement.


Original Submission

posted by martyb on Friday September 29 2023, @08:31PM   Printer-friendly
from the R.I.P. dept.

Dianne Feinstein, longest-serving female US senator in history, dies at 90:

Dianne Feinstein, whose three decades in the Senate made her the longest-serving female US senator in history, has died following months of declining health. She was 90.

Trailblazing California Sen. Dianne Feinstein dies at 90:

Dianne Feinstein, who became California's first female senator and went on to serve six terms, the longest of any woman in Senate history -- and whose political career was forever changed by the assassination of two colleagues -- has died. She was 90.

Her office said in a statement that she died on Thursday night at her home in Washington. The cause was not disclosed. She had voted as recently as earlier that day.

"There are few women who can be called senator, chairman, mayor, wife, mom and grandmother," her chief of staff, James Sauls, said in a statement. He called Feinstein "a force of nature who made an incredible impact on our country and her home state."

"She left a legacy that is undeniable and extraordinary. There is much to say about who she was and what she did," Sauls said, "but for now, we are going to grieve the passing of our beloved boss, mentor and friend."

Senate Majority Leader Chuck Schumer seemed at varying points to choke back tears as he memorialized Feinstein in remarks from the chamber on Friday morning, hailing her as "one of the most amazing people to ever grace the Senate." In memoriam, her Senate desk appeared to be draped in black cloth beneath a vase bursting with white roses. Flags outside the Capitol were also lowered to half-staff.

President Joe Biden, in his own statement, called Feinstein a "pioneering American," a "true friend" and "a role model for so many."

Over her three decades in the Senate, Feinstein transformed from a barrier-breaking member of the Democratic Party's liberal vanguard, championing the legalization of same-sex marriage and a ban on assault-style weapons, to one of the Washington's establishment members, esteemed by lawmakers on both sides of the aisle but increasingly criticized by outside progressives who argued that she refused to step aside for the next generation.

In her final years, her work on Capitol Hill had also begun to be overshadowed by concern about her mental and physical health even as she insisted she remained a robust public servant, despite her hospitalizations, reports of episodes of confusion and other issues.

In announcing earlier this year that she planned to retire at the end of her latest term, in 2025, Feinstein said: "Each of us was sent here to solve problems. That's what I've done for the last 30 years, and that's what I plan to do for the next two years. My thanks to the people of California for allowing me to serve them."

California Gov. Gavin Newsom, a fellow Democrat, will now appoint someone to serve out the remainder of Feinstein's term, ahead of the 2024 race to succeed her. He has committed to naming a Black woman -- who would then be only the third such senator in history -- but has also said he will not pick any of the candidates in the current Democratic primary race, which includes Rep. Barbara Lee.

Additional reporting at ABC, NPR, The New York Times among many others.


Original Submission