Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 17 submissions in the queue.

Log In

Log In

Create Account  |  Retrieve Password


Site News

Join our Folding@Home team:
Main F@H site
Our team page


Funding Goal
For 6-month period:
2022-07-01 to 2022-12-31
(All amounts are estimated)
Base Goal:
$3500.00

Currently:
$438.92

12.5%

Covers transactions:
2022-07-02 10:17:28 ..
2022-10-05 12:33:58 UTC
(SPIDs: [1838..1866])
Last Update:
2022-10-05 14:04:11 UTC --fnord666

Support us: Subscribe Here
and buy SoylentNews Swag


We always have a place for talented people, visit the Get Involved section on the wiki to see how you can make SoylentNews better.

Idiosyncratic use of punctuation - which of these annoys you the most?

  • Declarations and assignments that end with }; (C, C++, Javascript, etc.)
  • (Parenthesis (pile-ups (at (the (end (of (Lisp (code))))))))
  • Syntactically-significant whitespace (Python, Ruby, Haskell...)
  • Perl sigils: @array, $array[index], %hash, $hash{key}
  • Unnecessary sigils, like $variable in PHP
  • macro!() in Rust
  • Do you have any idea how much I spent on this Space Cadet keyboard, you insensitive clod?!
  • Something even worse...

[ Results | Polls ]
Comments:39 | Votes:85

posted by janrinok on Tuesday August 13, @08:06PM   Printer-friendly

Arthur T Knackerbracket has processed the following story:

A multi-decade study led by researchers from the University of Sydney has unveiled concerning trends in international trade that are exacerbating inequalities between the Global North rich countries and Global South developing countries.

The research identifies both positive and negative trends driven by international trade but does highlight the role that high-income countries play in driving polarizing trends, undermining progress towards reaching the United Nations Sustainable Development Goals.

[...] As the world approaches the 2030 Agenda for Sustainable Development, the research underlines the urgent need for countries to recognize their influence beyond national borders.

The research lead for the study is Associate Professor Arunima Malik from the Center for Integrated Sustainability Analysis in the Faculty of Science, and Discipline of Accounting, Governance and Regulation in the Business School.

She said, "Sustainable Development Goals are nationally focused and therefore tend not to take international effects into account. This misses the fact that in today's globalized world, consumption in one region can significantly affect the well-being of people in countries far away."

The study takes a global approach to supply chains and is the first to assess the trends over an extended period of the global environmental and social impacts from international trade.

The findings reveal that high-income countries often outsource environmentally and socially detrimental production to low-income nations, resulting in the shifting of burdens that disproportionately affects developing regions.

Co-author Professor Manfred Lenzen, Professor of Sustainability Research at the Center for Integrated Sustainability Analysis, said, "Our findings indicate the Global North's outsourcing practices are contributing to a widening divide between countries that benefit from trade and those that bear the brunt of its adverse effects."

This dynamic not only perpetuates economic disparities, but also exacerbates social and environmental challenges in the Global South.

"It isn't all negative. International trade can also have positive impacts," said co-author, Dr. Mengyu Li, a Horizon Fellow also at the Center for Integrated Analysis in the Faculty of Science. "While trade can promote economic growth and reduce poverty, it can also lead to increasing pollution, waste, resource depletion and social inequalities, especially in the Global South."

The research, which spans three decades from 1990 to 2018, employs a systematic quantitative assessment of 12 selected Sustainable Development Goals. The authors say that the lack of defined consumption-based indicators aligned with the SDG framework has hindered a comprehensive understanding of these trends.

As an alternative, the authors propose the use of consumption-based proxies to analyze global supply chain dynamics, trends and their implications for progress towards the UN SDGs.

The study identified the biggest polarizing effects in SDG13 (Climate Action), SDG11 (Sustainable Cities and Communities) and SDG2 (Zero Hunger). The biggest equalizing effects were identified for SDG8 (Decent Work and Economic Growth) and SDG1 (No Poverty).

Provided by University of Sydney

More information: Arunima Malik et al, Polarizing and equalizing trends in international trade and Sustainable Development Goals, Nature Sustainability (2024). DOI: 10.1038/s41893-024-01397-5


Original Submission

posted by janrinok on Tuesday August 13, @03:21PM   Printer-friendly
from the who-owns-the-Representatives-and-Senators? dept.

https://apnews.com/article/consumer-protection-ftc-fcc-biden-250f6eece6e2665535019128e8fa38da

In the name of consumer protection, a slew of U.S. federal agencies are working to make it easier for Americans to click the unsubscribe button for unwanted memberships and recurring payment services.

A broad new government initiative, dubbed "Time Is Money," includes a rollout of new regulations and the promise of more for industries spanning from healthcare and fitness memberships to media subscriptions.

"The administration is cracking down on all the ways that companies, through paperwork, hold times and general aggravation waste people's money and waste people's time and really hold onto their money," Neera Tanden, White House domestic policy adviser, told reporters Friday in advance of the announcement.

"Essentially in all of these practices, companies are delaying services to you or really trying to make it so difficult for you to cancel the service that they get to hold onto your money for longer and longer," Tanden said. "These seemingly small inconveniences don't happen by accident — they have huge financial consequences."


Original Submission

posted by hubie on Tuesday August 13, @10:37AM   Printer-friendly

Arthur T Knackerbracket has processed the following story:

In separate statements, ASUS and MSI announced their plans to deliver the new microcode for 13th and 14th Gen Raptor Lake Core family of CPUs over the course of August.

The updated CPU microcode, which should be finalized in the coming days, is supposed to stop Intel's wobbly desktop microprocessors from crashing at normal clock speeds (an "instability" as the x86 giant puts it) to frying themselves and causing permanent damage if not complete failure.

Apparently, the original microcode for Raptor Lake processors applied too much voltage to chips. While increasing voltage can make it possible to hit higher clock speeds with ironclad stability, too much voltage can be dangerous and degrade the silicon.

Although microcode updates are developed by Intel, they have to be distributed via motherboard BIOSes developed by individual motherboard vendors, including DIY brands like ASUS and MSI, and also OEMs. When it comes to microcode patches, Intel (and its rival AMD) can't guarantee when users will receive it or if all users will even get it at all, since it is up to individual motherboard makers to issue new BIOS versions.

That's not ideal for both Chipzilla and owners of Raptor Lake CPUs, as the longer it takes for the microcode to disseminate, the more opportunities there are for more chips to fail, providing more fuel for potential class action lawsuits.

However, at least ASUS and MSI seem to be working fast on updating their motherboards, with both saying that they'll start distributing BIOSes with the new microcode next week. Intel said the microcode itself wouldn't be done until the middle of the month.

[...] "The two tech companies have yet to update any 600 series boards, however. For its part, Gigabyte says it expects all of its motherboards to get updated by the second week of September at the latest, a representative toldThe Register.


Original Submission

posted by hubie on Tuesday August 13, @05:50AM   Printer-friendly

Arthur T Knackerbracket has processed the following story:

Engineers on NASA's NEOWISE (Near-Earth Object Wide-field Infrared Survey Explorer) mission commanded the spacecraft to turn its transmitter off for the last time Thursday. This concludes more than 10 years of its planetary defense mission to search for asteroids and comets, including those that could pose a threat to Earth.

[...] NASA ended the mission because NEOWISE will soon drop too low in its orbit around Earth to provide usable science data. An uptick in solar activity is heating the upper atmosphere, causing it to expand and create drag on the spacecraft, which does not have a propulsion system to keep it in orbit. Now decommissioned, NEOWISE is expected to safely burn up in our planet's atmosphere in late 2024.

During its operational lifetime, the infrared survey telescope exceeded scientific objectives for not one but two missions, starting with the WISE (Wide-field Infrared Survey Explorer) mission. Managed by JPL, WISE launched in December 2009 with a seven-month mission to scan the entire infrared sky.

By July 2010, WISE had accomplished this with far greater sensitivity than previous surveys. A few months later, the telescope ran out of the coolant that kept heat produced by the spacecraft from interfering with its infrared observations. (Invisible to the human eye, infrared wavelengths are associated with heat.)

NASA extended the mission under the name NEOWISE until February 2011 to complete a survey of the main belt asteroids, at which point the spacecraft was put into hibernation.

Analysis of this data showed that although the lack of coolant meant the space telescope could no longer observe the faintest infrared objects in the universe, it could still make precise observations of asteroids and comets that generate a strong infrared signal from being heated by the sun as they travel past our planet.

NASA brought the telescope out of hibernation in 2013 under the Near-Earth Object Observations Program, a precursor for the agency's Planetary Defense Coordination Office, to continue the NEOWISE survey of asteroids and comets in the pursuit of planetary defense.

[...] "The NEOWISE mission has provided a unique, long-duration data set of the infrared sky that will be used by scientists for decades to come," said Amy Mainzer, principal investigator for both NEOWISE and NEO Surveyor at the University of California, Los Angeles. "But its additional legacy is that it has helped lay the groundwork for NASA's next planetary defense infrared space telescope."


Original Submission

posted by hubie on Tuesday August 13, @01:04AM   Printer-friendly

The company has revealed details of AI model safety testing—including concerns about its new anthropomorphic interface:

In late July, OpenAI began rolling out an eerily humanlike voice interface for ChatGPT. In a safety analysis released today, the company acknowledges that this anthropomorphic voice may lure some users into becoming emotionally attached to their chatbot.

The warnings are included in a "system card" for GPT-4o, a technical document that lays out what the company believes are the risks associated with the model, plus details surrounding safety testing and the mitigation efforts the company's taking to reduce potential risk.

OpenAI has faced scrutiny in recent months after a number of employees working on AI's long-term risks quit the company. Some subsequently accused OpenAI of taking unnecessary chances and muzzling dissenters in its race to commercialize AI. Revealing more details of OpenAI's safety regime may help mitigate the criticism and reassure the public that the company takes the issue seriously.

The risks explored in the new system card are wide-ranging, and include the potential for GPT-4o to amplify societal biases, spread disinformation, and aid in the development of chemical or biological weapons. It also discloses details of testing designed to ensure that AI models won't try to break free of their controls, deceive people, or scheme catastrophic plans.

[...] Lucie-Aimée Kaffee, an applied policy researcher at Hugging Face, a company that hosts AI tools, notes that OpenAI's system card for GPT-4o does not include extensive details on the model's training data or who owns that data. "The question of consent in creating such a large dataset spanning multiple modalities, including text, image, and speech, needs to be addressed," Kaffee says.

[...] The new system card highlights how rapidly AI risks are evolving with the development of powerful new features such as OpenAI's voice interface. In May, when the company unveiled its voice mode, which can respond swiftly and handle interruptions in a natural back and forth, many users noticed it appeared overly flirtatious in demos. The company later faced criticism from the actress Scarlett Johansson, who accused it of copying her style of speech.

[...] Anthropomorphism might cause users to place more trust in the output of a model when it "hallucinates" incorrect information, OpenAI says. Over time, it might even affect users' relationships with other people. "Users might form social relationships with the AI, reducing their need for human interaction—potentially benefiting lonely individuals but possibly affecting healthy relationships," the document says.

Joaquin Quiñonero Candela, head of preparedness at OpenAI, says that voice mode could evolve into a uniquely powerful interface. He also notes that the kind of emotional effects seen with GPT-4o can be positive—say, by helping those who are lonely or who need to practice social interactions. He adds that the company will study anthropomorphism and the emotional connections closely, including by monitoring how beta testers interact with ChatGPT. "We don't have results to share at the moment, but it's on our list of concerns," he says.


Original Submission

posted by hubie on Monday August 12, @08:22PM   Printer-friendly

Days after Georgia Democrats warned that the state's new online portal for canceling voter registrations could be abused, officials have confirmed misuse attempts — including efforts to cancel the registrations of prominent Republicans:

On Friday (August 2), four days after Georgia Democrats began warning that bad actors could abuse the state's new online portal for canceling voter registrations, the Secretary of State's Office acknowledged to ProPublica that it had identified multiple such attempts — including unsuccessful efforts to cancel the registrations of two prominent Republicans, Rep. Marjorie Taylor Greene and Georgia Secretary of State Brad Raffensperger.

The confirmation of the attempts to misuse the portal follows separate discoveries by The Associated Press and The Current that the portal suffered at least two security glitches that briefly exposed voters' dates of birth, the last four digits of their Social Security numbers and their full driver's license numbers — the exact information needed to cancel others' voter registrations.

[...] The official X account for Georgia Senate Democrats posted that the voter registration cancellation portal "empowers conspiracy theorists and other bad actors to deny Georgians the right to vote." In response, one commenter replied with the birthdays of Republican officials, including Greene and Raffensperger, noting: "​​Lots of people have their birthday in the public domain." One user posted, "Overwhelm them with cancelled well-known Republican's registrations!"

To start the cancellation process on the portal, all users need is a voter's name, date of birth and county of residence. To finalize the cancellation request, they also must provide the last four digits of the voter's Social Security number or their full driver's license number. There's also an option to fill out a form with that information and print and send it to the voter's county election office or the Georgia Secretary of State's Office. Hassinger said that election workers would not approve any paper request that lacked a Social Security number or driver's license number.

Originally spotted on Schneier on Security.

Related:


Original Submission

posted by hubie on Monday August 12, @03:37PM   Printer-friendly

Arthur T Knackerbracket has processed the following story:

Just like Boeing, once upon a time, Intel was the darling of the engineering world. Both companies were the premier tech companies in their day, but those days are long gone now.

[...] Intel hasn't experienced such speculator public failures, but it is tripping over its own feet a lot lately. As everyone knows, Intel's 13th and 14th Gen processors, particularly the Raptor Lake series, have been failing… a lot.

[...] Today, adding insult to injury, these problems appear most often in its top-of-the-line Core i9-13900K and Core i9-14900K CPUs. When you pay north of $500 or £400 for a single processor, you're not likely to take it kindly when the video flips out. Funny that.

[...] In addition, Intel has been struggling with yields on its new chip families. Now, Intel hopes to catch up with AMD and TSMC by 2026 with its next-generation 2nm CPUs. I hate to tell you this, Intel, but it's not like they'll be sitting around waiting for you.

Intel CEO Pat Gelsinger referred to this struggle as a “death march" back in 2022. I don't think I would have used that phrase, but it appears to be more apt than ever.

Numerous soon-to-be ex-Intel employees doubtlessly would agree with me. Recently, Intel announced it would soon be laying off 16,000 staffers. That's 15 percent of its workforce if you're playing the stock market.

The market wasn't impressed. Between the layoffs, missing its guidance numbers, and chopping back its dividend, Intel's share price is dropping like it's in a, well, death march.

Why is all this happening? I think it's the result of poor management decisions and underinvestment in critical manufacturing technologies. In particular, it was how Intel prioritized business strategies and financial performance over engineering excellence.

Starting with Paul Otellini as CEO in 2005 through Brian Krzanich, who became CEO in 2013, and Bob Swan, who succeeded Krzanich in 2019, bean-counting and not engineering, was the name of Intel's game. That's not a recipe for success.

Intel also made several strategic blunders. Chipzilla's decision to pass on producing chips for the iPhone, considering the mobile market unprofitable, was a critical error. Would Arm even exist, never mind dominating the mobile space, if Intel had played its cards right? Seriously, did anyone ever believe that Intel Atom processors would power iPhones? I don't think so!

This was followed by Intel's botched venture into the 5G modem market. Despite grand announcements and promises, Intel failed to deliver a competitive product, ultimately losing out to competitors such as Qualcomm.

[...] Oh, and Intel does have an AI chip. I bet you didn't know that. I didn't until I started researching for this story. And I make my living from watching tech developments all day long.

The chip is named the Gaudi 3. This is an AI accelerator that Intel claims can beat Nvidia's H100 AI processors. We'll see. I'm not holding my breath.

I also noticed, though, that Intel doesn't actually make this chip. It relies instead on TSMC, at least until Intel gets its AI foundry business up and running.

I'm not counting Intel out — not yet, anyway. But a few years ago, I wouldn't have written Boeing off either, and that was a bad bet. It wouldn't surprise me if my hope for Intel to get its act together also turns out to be forlorn.


Original Submission

posted by mrpg on Monday August 12, @10:55AM   Printer-friendly
from the shake-shake dept.

Arthur T Knackerbracket has processed the following story:

A groundbreaking study has revealed new insights into the Earth’s crust’s immediate behavior following earthquakes. Researchers have utilized sub-daily Global Positioning System (GPS) solutions to accurately measure the spatial and temporal evolution of early afterslip following the 2010 Mw 8.8 Maule earthquake. This innovative approach marks a significant advancement in seismic analysis, offering a more precise and rapid depiction of ground deformations, which is essential for assessing seismic hazards and understanding fault line activities.

The aftermath of an earthquake is marked by intricate postseismic adjustments, particularly the elusive early afterslip. Daily seismic monitoring has struggled to capture the rapid and complex ground movements occurring in the critical hours post-quake. The intricacies of these initial activities and their profound implications for seismic hazard assessment highlight an urgent need for more refined and immediate monitoring techniques.

Wuhan University researchers, in a paper published on July 29, 2024, in Satellite Navigation, unveil their meticulous examination of the Maule earthquake’s early afterslip. Utilizing sub-daily GPS solutions, the study delivers a comprehensive narrative of the ground surface deformations occurring in the pivotal hours following the earthquake.

Reference: “Rapid early afterslip characteristics of the 2010 moment magnitude (Mw) 8.8 Maule earthquake determined with sub-daily GPS solutions” by Kai Liu, Yangmao Wen, Jing Zeng, Jianghui Geng, Zhao Li and Caijun Xu, 29 July 2024, Satellite Navigation.
  DOI: 10.1186/s43020-024-00145-6


Original Submission

posted by mrpg on Monday August 12, @06:10AM   Printer-friendly
from the backdoors-as-a-service dept.

'Sinkclose' Flaw in Hundreds of Millions of AMD Chips Allows Deep, Virtually Unfixable Infections:

Security flaws in your computer's firmware, the deep-seated code that loads first when you turn the machine on and controls even how its operating system boots up, have long been a target for hackers looking for a stealthy foothold. But only rarely does that kind of vulnerability appear not in the firmware of any particular computer maker, but in the chips found across hundreds of millions of PCs and servers. Now security researchers have found one such flaw that has persisted in AMD processors for decades, and that would allow malware to burrow deep enough into a computer's memory that, in many cases, it may be easier to discard a machine than to disinfect it.

At the Defcon hacker conference tomorrow, Enrique Nissim and Krzysztof Okupski, researchers from the security firm IOActive, plan to present a vulnerability in AMD chips they're calling Sinkclose. The flaw would allow hackers to run their own code in one of the most privileged modes of an AMD processor, known as System Management Mode, designed to be reserved only for a specific, protected portion of its firmware. IOActive's researchers warn that it affects virtually all AMD chips dating back to 2006, or possibly even earlier.

Nissim and Okupski note that exploiting the bug would require hackers to already have obtained relatively deep access to an AMD-based PC or server, but that the Sinkclose flaw would then allow them to plant their malicious code far deeper still. In fact, for any machine with one of the vulnerable AMD chips, the IOActive researchers warn that an attacker could infect the computer with malware known as a "bootkit" that evades antivirus tools and is potentially invisible to the operating system, while offering a hacker full access to tamper with the machine and surveil its activity. For systems with certain faulty configurations in how a computer maker implemented AMD's security feature known as Platform Secure Boot—which the researchers warn encompasses the large majority of the systems they tested—a malware infection installed via Sinkclose could be harder yet to detect or remediate, they say, surviving even a reinstallation of the operating system.

"Imagine nation-state hackers or whoever wants to persist on your system. Even if you wipe your drive clean, it's still going to be there," says Okupski. "It's going to be nearly undetectable and nearly unpatchable." Only opening a computer's case, physically connecting directly to a certain portion of its memory chips with a hardware-based programming tool known as SPI Flash programmer and meticulously scouring the memory would allow the malware to be removed, Okupski says.

See also:


Original Submission

posted by mrpg on Monday August 12, @01:31AM   Printer-friendly
from the the-truth-is-out-there-but-so-are-lies dept.

Arthur T Knackerbracket has processed the following story:

It is hoped a new "toolkit" will help people separate truth from lies and unsubstantiated opinion, and prevent the spread of misinformation.

The checklist, published in the journal Experimental Physiology, was written by scientists from the Universities of Portsmouth and Edinburgh.

They warn the "truth is under attack" and have highlighted the urgent need for critical thinking and scientific literacy to combat the rise of unfounded, misleading and often damaging claims which the experts say are amplified by social media.

From political debates to claims for new products or health-enhancing interventions, claims are frequently presented as "scientific findings" supported by "expert" opinions.

[...] "At the very least, the next time you hear phrases like 'they say this is great' or 'this is scientifically proven' start by asking 'who are they?' and 'which scientists, using which methods?' Be cautious and questioning; snake oil and its vendors still exist, and they come in many guises."

Provided by University of Portsmouth

More information: G. Drummond et al, How to spot the truth, Experimental Physiology (2024). DOI: 10.1113/EP092160


Original Submission

posted by janrinok on Sunday August 11, @08:53PM   Printer-friendly
from the get-the-popcorn dept.

Arthur T Knackerbracket has processed the following story:

Texas is one of eight states that have enacted laws that force adults to prove their age before accessing porn sites. Soon it will try to persuade the Supreme Court that its law doesn’t violate the First Amendment. 

Good luck with that. 

These laws are unconstitutional: They deny adults the well-established right to access constitutionally protected speech.

Texas’ H.B. 1181 forces any website made up of one-third or more adult content to verify every visitor’s age. Some adult sites have responded to the law by shutting down their services in Texas. The Free Speech Coalition challenged the law on First Amendment grounds, arguing that mandatory age verification does more than keep minors away from porn — the law nannies adults as well, barring them from constitutionally protected speech. 

The district court agreed with the challengers. Laws regulating speech because of its content (i.e., because it is sexually explicit) are presumed invalid. Under strict scrutiny, the state must show that its regulation is narrowly tailored to serve a compelling government interest. In other words, the government needs an exceptionally good reason to regulate, and it can’t regulate more speech than necessary. 

The case will turn on what level of scrutiny applies. Protecting minors from obscene speech is a permissible state interest, as the Fifth Circuit court established when it applied the lowest form of scrutiny — rational basis review — to uphold the law. But not all speech that is obscene to minors is obscene to adults. Judge Higginbotham, dissenting from the Fifth Circuit’s decision, pointed out that kids might have no right to watch certain scenes from Game of Thrones — but adults do.

There’s just one problem: Adults do care about age verification.

H.B. 1181 bars age verification providers from retaining “identifying” information. But nothing in the law stops providers from sharing that same info, and people are rightly concerned about whether their private sexual desires will stay private. That you visited an adult site is bad enough. Getting your personal Pornhub search history leaked along with your government ID is enough to make even the most shameless person consider changing their name and becoming a hermit. 

Texas swears up and down that age verification tech is secure, but that doesn’t inspire confidence in anyone following cybersecurity news. Malware is out there. Data leaks happen. 

A bored employee glancing at your driver’s license as you walk into the sex shop is not the same thing as submitting to a biometric face scan and algorithmic ID verification, by order of the government, before you can press play on a dirty video. Just thinking about it kills the mood, which may be part of the point. 

Texas pretends there’s no difference between the bored bouncer and biometric scans, but if you knew the bouncer had an encyclopedic, inhuman ability to remember every name and face that came through the door and loose lips, well, you wouldn’t go there either. 

Hand-waving away these differences is the kind of thing you only do if you’re highly ideologically motivated. But normal people are very reasonably concerned about whether their personal sexual preferences will be leaked to their boss, mother-in-law, or fellow citizens. Mandatory age verification turns people off of viewing porn entirely, and it chills their free expression. 

Sexual preferences are private and sensitive; they’re exactly the type of thing you don’t want leaking. So, of course, sexual content is a particularly juicy target for would-be hackers and extortionists. People pay handsomely to keep “sextortion” quiet. If you’re worried about your privacy and you don’t trust the age verification software (you shouldn’t), you’re likely to avoid the risk up front. One adult site says only 6% of visitors go through age verification and that even fewer succeed. Thus the chilling effect: even though adult access to porn is technically legal, people are so afraid of having their ID and last watched video plastered across the internet that they stop watching in the first place. 

If the Supreme Court recognizes this and applies strict scrutiny, it will ask whether less restrictive means could protect minors. Back in 2004, the Court tossed out COPA, a law requiring credit card verification to access sexually explicit materials, reasoning that blocking and filtering software would protect minors without burdening adult speech. Today’s filtering software is far more effective than what was available twenty years ago — as the district court found — and, notably, filtering software doesn’t scan adults’ faces. 

Sex — a “subject of absorbing interest to mankind,” as one justice once put it — matters. Adults have the right to sexually explicit speech, free of the fear that their identifying information will be leaked or sent to the state. Texas can and should seek to protect kids without stoking that fear. 

[Ed's Comment: Much more in the original article ]


Original Submission

posted by janrinok on Sunday August 11, @04:10PM   Printer-friendly
from the sorry,-its-another-Boeing-report dept.

A new report finds Boeing's rockets are built with an unqualified work force

From Ars Technica:
new report finds Boeing's rockets are built with an unqualified work force

The NASA program to develop a new upper stage for the Space Launch System rocket is seven years behind schedule and significantly over budget, a new report from the space agency's inspector general finds. [Here is a direct link to PDF of NASA report] However, beyond these headline numbers, there is also some eye-opening information about the project's prime contractor, Boeing, and its poor quality control practices.

[....] "We found an array of issues that could hinder SLS Block 1B's readiness for Artemis IV including Boeing's inadequate quality management system, escalating costs and schedules, and inadequate visibility into the Block 1B's projected costs," [...]

[....] Boeing's quality control issues are largely caused by its workforce having insufficient aerospace production experience," the report states. "The lack of a trained and qualified workforce increases the risk that the contractor will continue to manufacture parts and components that do not adhere to NASA requirements and industry standards. [...]

[....] we found Boeing's quality management system at Michoud does not adhere to these standards or NASA requirements. NASA engages DCMA to conduct surveillance of Boeing's core and upper stage manufacturing efforts at Michoud, and when deficiencies in quality are found, DCMA issues Corrective Action Requests (CAR) to the contractor. CARs are labeled Level I through IV, with Level I the least serious deficiency. From September 2021 to September 2023, DCMA issued Boeing 71 Level I and II CARs, as well as a draft Level III CAR. According to DCMA officials, this is a high number of CARs for a space flight system at this stage in development and reflects a recurring and degraded state of product quality control. Boeing's process to address deficiencies to date has been ineffective, and the company has generally been nonresponsive in taking corrective actions when the same quality control issues reoccur.

Quality control issues at Michoud are largely due to the lack of a sufficient number of trained and experienced aerospace workers at Boeing. To mitigate these challenges, Boeing provides training and work orders to its employees. Considering the significant quality control deficiencies at Michoud, we found these efforts to be inadequate. For example, during our visit to Michoud in April 2023, we observed a liquid oxygen fuel tank dome—a critical component of the SLS Core Stage 3—segregated and pending disposition on whether and how it can safely be used going forward due to welds that did not meet NASA specifications. According to NASA officials, the welding issues arose due to Boeing's inexperienced technicians and inadequate work order planning and supervision. The lack of a trained and qualified workforce increases the risk that Boeing will continue to manufacture parts and components that do not adhere to
NASA requirements and industry standards,

Report Slams Boeing For Bad Work, But Not Over The Starliner

Arthur T Knackerbracket has processed the following story:

[...] This is a high-stakes program. The first three Block 1 SLS systems will put US crews on the Moon for the first time in half a century and, if all goes well, enable creation of a base on our sole natural satellite.

If the program misses its schedule, Boeing won't be the only one wearing blame.

The report notes that NASA has changed made decisions that delayed the program and helped it to sail beyond initial budgets.

The OIG suggests four ways to improve matters:

  1. Establish a training program for Boeing contractors to ensure quality control is up to standard;
  2. Implement financial penalties for Boeing if it fails to meet quality standards;
  3. Draw up a detailed timeline for the development of EUS and ensure it is followed;
  4. Work with the Defense Contract Management Agency to ensure compliance.

NASA agreed with three of those points, but is unwilling to charge Boeing if the contractor fails to meet quality standards.

"NASA non-concurs. NASA interprets this recommendation to be directing NASA to institute penalties outside the bounds of the contract," the agency argued. "Instituting financial penalties outside the bounds of the contract subverts the control process of the contract."

Maybe someone at NASA should ask Butch Wilmore and Suni Williams – the two Boeing Starliner test pilots who might be stuck in space until next year – how they feel about that.

The report comes at an unfortunate time for Boeing's new CEO Kelly Ortberg, who started work on Thursday. Ortberg, a qualified mechanical engineer who has spent most of his life in aerospace, was lured out of retirement at 64 to fix Boeing's corporate problems. His first move was to return Boeing's corporate headquarters to Seattle and spend his first day on the production floor speaking with staff.

[...] "It also means meeting our commitments to each other and working collaboratively across Boeing to meet our goals. People's lives depend on what we do every day, and we must keep that top of mind with every decision we make."

The CEO is apparently quite popular at Boeing, as his management style elevates engineering.


Original Submission #1Original Submission #2

posted by janrinok on Sunday August 11, @11:23AM   Printer-friendly
from the somebody-else's-computer dept.

Experts Uncover Severe AWS Flaws Leading to RCE, Data Theft, and Full-Service Takeovers:

Cybersecurity researchers have discovered multiple critical flaws in Amazon Web Services (AWS) offerings that, if successfully exploited, could result in serious consequences.

"The impact of these vulnerabilities range between remote code execution (RCE), full-service user takeover (which might provide powerful administrative access), manipulation of AI modules, exposing sensitive data, data exfiltration and denial of service," cloud security firm Aqua said in a detailed report shared with The Hacker News.

Following responsible disclosure in February 2024, Amazon addressed the shortcomings over several months from March to June. The findings were presented at Black Hat USA 2024.

Central to the issue, dubbed Bucket Monopoly, is an attack vector referred to as Shadow Resource, which, in this case, refers to the automatic creation of an AWS S3 bucket when using services like CloudFormation, Glue, EMR, SageMaker, ServiceCatalog, and CodeStar.

The S3 bucket name created in this manner is both unique and follows a predefined naming convention ("cf-templates-{Hash}-{Region}"). An attacker could take advantage of this behavior to set up buckets in unused AWS regions and wait for a legitimate AWS customer to use one of the susceptible services to gain covert access to the contents of the S3 bucket.

Based on the permissions granted to the adversary-controlled S3 bucket, the approach could be used to escalate to trigger a DoS condition, or execute code, manipulate or steal data, and even gain full control over the victim account without the user's knowledge.

To maximize their chances of success, using Bucket Monopoly, attackers can create unclaimed buckets in advance in all available regions and store malicious code in the bucket. When the targeted organization enables one of the vulnerable services in a new region for the first time, the malicious code will be unknowingly executed, potentially resulting in the creation of an admin user that can grant control to the attackers.

However, it's important to consider that the attacker will have to wait for the victim to deploy a new CloudFormation stack in a new region for the first time to successfully launch the attack. Modifying the CloudFormation template file in the S3 bucket to create a rogue admin user also depends on whether the victim account has permission to manage IAM roles.

Aqua said it found five other AWS services that rely on a similar naming methodology for the S3 buckets – {Service Prefix}-{AWS Account ID}-{Region} – thereby exposing them to Shadow Resource attacks and ultimately permitting a threat actor to escalate privileges and perform malicious actions, including DoS, information disclosure, data manipulation, and arbitrary code execution -

  • AWS Glue: aws-glue-assets-{Account-ID}-{Region}
  • AWS Elastic MapReduce (EMR): aws-emr-studio -{Account-ID}-{Region}
  • AWS SageMaker: sagemaker-{Region}-{Account-ID}
  • AWS CodeStar: aws-codestar-{Region}-{Account-ID}
  • AWS Service Catalog: cf-templates-{Hash}-{Region}

The company also noted that AWS account IDs should be considered a secret, contrary to what Amazon states in its documentation, as they could be used to stage similar attacks.

"This attack vector affects not only AWS services but also many open-source projects used by organizations to deploy resources in their AWS environments," Aqua said. "Many open-source projects create S3 buckets automatically as part of their functionality or instruct their users to deploy S3 buckets."

"Instead of using predictable or static identifiers in the bucket name, it is advisable to generate a unique hash or a random identifier for each region and account, incorporating this value into the S3 bucket name. This approach helps protect against attackers claiming your bucket prematurely."

See also:


Original Submission

posted by hubie on Sunday August 11, @05:41AM   Printer-friendly

Three part story. And, as it is on Medium (yuck), archive links are provided should the Medium links go hidden or disappear:

Part 1: The Cocainemaker, Reefer Madness, and the Vice-President of The Coca-Cola Company
https://rmcortes.medium.com/the-cocainemaker-reefer-madness-and-the-vice-president-of-the-coca-cola-company-e1b39e65b63c#.b43mv3bzh
Archive Link: https://archive.is/rdUt2

Part 2: How Coca-Cola Changed the World for Coca
https://rmcortes.medium.com/how-coke-changed-the-world-for-coca-95ccec58193b#.xa0rcxrdi
Archive link: https://archive.is/gbQeo

Part 3: I Wasn't the First Person to Find the NJ Cocaine Factory
https://rmcortes.medium.com/i-wasnt-the-first-to-find-the-nj-cocaine-factory-5f37aed74776
Archive link: https://archive.is/XypPx

In 1886, a pharmacist named Dr. John Pemberton mixed extract of the green coca leaf — containing the recently discovered marvel of cocaine — with the caffeine kick of West African kola nuts, making a "Brain Workers' Panacea" tonic called Coca-Cola.

Touted to relieve mental and physical exhaustion, "Coke" arrived alongside a wave of cocaine products advertised to ease toothaches and labor pains. Cocaine was said to cure fatigue, nervousness, impotence, even addiction to morphine.

But the medical miracle soon changed into the story of a crime epidemic. Cocaine's addictive properties were discovered and its increased availability fueled racial fears: cocaine made Negroes insane and murderous; Jewish doctors were identified as its peddlers.

The United States began prohibition of coca leaf, along with the cocaine it produces, with the Harrison Narcotics Act of 1914.


Original Submission

posted by hubie on Sunday August 11, @12:58AM   Printer-friendly
from the I-guess-it's-back-to-crypto dept.

Arthur T Knackerbracket has processed the following story:

Amid fears of a US recession, there seems to be growing impatience among investors when it comes to the massive investment Big Tech has made into their AI products.

It has been a tough time for Big Tech in the stock market, as some of the biggest companies in the world have shed hundreds of billions in value after their latest earnings failed to meet the growing demands of investors.

[...] The value of some of these companies has soared in recent years, thanks to the major focus on AI technology, which has been a hot topic in the tech industry. But recent shifts in the stock market meant these companies were on track to lose roughly $800bn in value, Reuters reports.

The reason for the plunge is tied to fears of a potential recession in the US. For example, recent jobs data for the country was worse than expected. These concerns have caused a knock-on effect, with stock markets facing turmoil in Europe, Japan and Ireland.

But another concern among investors is the heavy financing many of these companies have put in AI technology, with the payoff coming too slowly for some Wall Street investors. This is despite the major boost this focus has had – Microsoft and Nvidia in particular saw their valuations grow massively over the past couple of years thanks to the recent AI boom.

[...] In a recent letter from activist investor group Elliot Management referenced by the Financial Times, the group described AI as overrated and claimed Nvidia is “in bubble land”.

One looming concern in the AI sector is the future of OpenAI, one of the key sparks of the generative AI hype since the launch of its product ChatGPT. Microsoft has been a major investor into OpenAI. But recent reports suggest OpenAI is burning through billions of dollars to stay afloat.


Original Submission