Stories
Slash Boxes
Comments

SoylentNews is people

Log In

Log In

Create Account  |  Retrieve Password


Site News

Join our Folding@Home team:
Main F@H site
Our team page


Funding Goal
For 6-month period:
2022-07-01 to 2022-12-31
(All amounts are estimated)
Base Goal:
$3500.00

Currently:
$438.92

12.5%

Covers transactions:
2022-07-02 10:17:28 ..
2022-10-05 12:33:58 UTC
(SPIDs: [1838..1866])
Last Update:
2022-10-05 14:04:11 UTC --fnord666

Support us: Subscribe Here
and buy SoylentNews Swag


We always have a place for talented people, visit the Get Involved section on the wiki to see how you can make SoylentNews better.

On my linux machines, I run a virus scanner . . .

  • regularly
  • when I remember to enable it
  • only when I want to manually check files
  • only on my work computers
  • never
  • I don't have any linux machines, you insensitive clod!

[ Results | Polls ]
Comments:36 | Votes:307

posted by janrinok on Wednesday November 12, @09:49PM   Printer-friendly
from the soy-lattes-didn't-arrive-until-later dept.

A bitter new drink swept through the holy cities of Mecca and Medina in the early 1500s – and ignited one of the fiercest religious debates of the late-medieval Islamic world:

A new study, published in Darah: Journal of Arabian Peninsula Studies, explores how the arrival of coffee transformed the sacred landscape of the Hijaz. Drawing on chronicles, fatwas, poetry, and eyewitness travel accounts, historian Reda Asaad Sharif reveals how what is now a daily ritual was once denounced as a dangerous novelty — banned from marketplaces and even burned in the streets of Mecca.

Sharif traces coffee's journey from Abyssinia to Yemen, where Sufi mystics used it to stay awake for night-time dhikr (remembrance of God), before it reached Mecca around the year 1500 (AH 905). Its rapid popularity with pilgrims and townspeople provoked suspicion from conservative jurists. The very word qahwa — traditionally a poetic synonym for wine — cast a shadow over the new beverage.

According to Sharif, tensions came to a head in 1509 when Meccan scholars convened at the Mujāhidiyya hall near Bāb al-ʿUmra to debate coffee's legality. The chief Shāfiʿī judge Shaykh Nūr al-Dīn ʿAlī ibn Nāṣir issued a fatwa permitting coffee, praising its ability to sharpen alertness for worship.

Opponents countered that it altered the mind; two witnesses even swore it was intoxicating. The Mamluk governor responded by ordering the arrest of coffee-sellers and the burning of their coffee husks.

In June 1511, the market inspector Khāʾir Beg enforced a sweeping ban, citing reports that people were gathering in coffeehouses "in a manner similar to taverns, where certain people gather over it, pawn their possessions, and partake in other activities that are forbidden."

Sharif notes that the dispute escalated to the top of the Mamluk state. Sultan Qānṣūh al-Ghūrī issued a decree declaring:

As for coffee, we have been informed that certain people drink it in a manner similar to wine, mixing intoxicants into it, singing to it with instruments, dancing, and swaying. It is well known that even the water of Zamzam, if consumed in such a manner, would be forbidden. Therefore, its consumption and its circulation in the markets must be prevented.

Violators were punished with "around ten lashes or more," and some were paraded through the market as a warning.

When the Ottomans replaced the Mamluks in 1517 they, too, tried to curb the spread of coffee. Several times during the 16th century orders were sent from Constantinople banning not only the drink but coffeehouses too, as they were accused of promoting immoral behaviour.

[...] Various scholars also criticized the Ottoman ban, noting that these authorities were more lenient to the use of wine and hashish. However, it was the sheer number of people who enjoyed coffee that would soon turn the tide in favour of the drink. By the end of the 16th century, the debate was practically over, not only in the Hijaz, but throughout the Middle East and Ottoman territories, with coffee and coffeehouses becoming very popular.

Journal Reference: Sharif, R. A. (2025). The Role of Hijaz Coffeehouses in Serving Pilgrims from Their Emergence until the Beginning of the 20th Century. [OPEN] Darah Journal of Arabian Peninsula Studies, 3(2), 214-255. https://doi.org/10.1163/29501768-20250203


Original Submission

posted by janrinok on Wednesday November 12, @05:05PM   Printer-friendly

NASA confirms Voyager spacecraft has encountered a "wall of fire" at the edge of the Solar System:

After nearly half a century of traveling through space, NASA's Voyager mission has made another astonishing discovery — one that could redefine where our Solar System truly ends.

Voyager 1, launched 47 years ago, continues to send back data from farther away than any other human-made object. The spacecraft's long journey has allowed scientists to glimpse regions of space no probe has ever reached before, offering new insight into the outermost layers of the Solar System.

According to NASA, Voyager 1 has now encountered what researchers describe as a "wall of fire," a zone where temperatures reach between 30,000 and 50,000 kelvin — roughly 30,000 degrees Celsius. The finding was made as part of ongoing efforts to understand the boundary separating our Solar System from interstellar space.

Scientists have long debated where the Solar System actually ends. Some define it by the limits of the planets' orbits; others, by the reach of the Sun's gravitational and magnetic influence. The most accepted boundary is the heliopause — the outer edge of the heliosphere, the vast bubble created by the Sun's constant stream of charged particles, known as the solar wind.

"The Sun emits a constant stream of charged particles called the solar wind, which eventually travels past all the planets to a distance three times greater than that of Pluto before being stopped by the interstellar medium," NASA explains. "This forms a giant bubble around the Sun and its planets, known as the heliosphere."

The heliopause, then, is the frontier where the solar wind's strength fades and the interstellar medium begins. Both Voyager 1 and Voyager 2 have now crossed this line, making them the only spacecraft ever to venture into true interstellar space.

One of the most striking findings from this mission concerns the alignment of magnetic fields beyond the Solar System's edge. NASA said that Voyager 2's measurements confirm what Voyager 1 had detected years earlier — that the magnetic field just outside the heliopause runs parallel to the field inside the heliosphere.

"An observation made by Voyager 2 confirms a surprising result from Voyager 1: the magnetic field in the region just beyond the heliopause is parallel to the magnetic field inside the heliosphere," NASA noted. With data from both spacecraft, scientists can now confirm that this alignment is not a coincidence but a defining characteristic of the boundary region.

[Editor's Comment: I am confused - how did Voyager 1 and Voyager 2 pass through this wall of 30,000 Celsius? Can anyone explain please?--JR]


Original Submission

posted by janrinok on Wednesday November 12, @12:24PM   Printer-friendly
from the no-good-deed-goes-unpunished dept.

https://www.404media.co/fbi-tries-to-unmask-owner-of-infamous-archive-is-site/
https://archive.ph/TFqAx

The FBI is attempting to unmask the owner behind archive.today, a popular archiving site that is also regularly used to bypass paywalls on the internet and to avoid sending traffic to the original publishers of web content, according to a subpoena posted by the website. The FBI subpoena says it is part of a criminal investigation, though it does not provide any details about what alleged crime is being investigated. Archive.today is also popularly known by several of its mirrors, including archive.is and archive.ph.

The subpoena, which was posted on X by archive.today on October 30, was sent by the FBI to Tucows, a popular Canadian domain registrar. It demands that Tucows give the FBI the "customer or subscriber name, address of service, and billing address" and other information about the "customer behind archive.today."

"THE INFORMATION SOUGHT THROUGH THIS SUBPOENA RELATES TO A FEDERAL CRIMINAL INVESTIGATION BEING CONDUCTED BY THE FBI," the subpoena says. "YOUR COMPANY IS REQUIRED TO FURNISH THIS INFORMATION. YOU ARE REQUESTED NOT TO DISCLOSE THE EXISTENCE OF THIS SUBPOENA INDEFINITELY AS ANY SUCH DISCLOSURE COULD INTERFERE WITH AN ONGOING INVESTIGATION AND ENFORCEMENT OF THE LAW."

The subpoena also requests "Local and long distance telephone connection records (examples include: incoming and outgoing calls, push-to-talk, and SMS/MMS connection records); Means and source of payment (including any credit card or bank account number); Records of session times and duration for Internet connectivity; Telephone or Instrument number (including IMEI, IMSI, UFMI, and ESN) and/or other customer/subscriber number(s) used to identify customer/subscriber, including any temporarily assigned network address (including Internet Protocol addresses); Types of service used (e.g. push-to-talk, text, three-way calling, email services, cloud computing, gaming services, etc.)"

The subpoena was issued on October 30 and was reported Wednesday by the German news outlet Heise. The FBI, Archive.today, and Tucows did not respond to a request for comment.

The site, which is known by both archive.today, archive.is, or any number of other mirrors, started in the early 2010s but rose to prominence during the GamerGate movement.

GamerGaters would take snapshots of articles using archive.is in order to avoid sending traffic directly to the websites that published them.

They also used the service to document changes to articles. The site has since become a widely used archiving tool and internet resource, with hundreds of millions of pages saved. It is often used to bypass website paywalls, but it is also used to save snapshots of articles or government websites that are likely to change or be deleted. It is still also widely used to avoid sending traffic to the original publisher of content.

A 2013 blog post on archive.today explains that once a page has been archived, it is very difficult to delete, and that the only way to get a page deleted from the site is to email the webmaster there: "It would be ridiculous if the site which goal is to fight the dead link problem has dead links itself."

Very little is known about the person or people who work on archive.today, though there have been numerous attempts to identify the webmasters. The most interesting is this article on a site called Gyrovague, whose crawling through various archive.today blogs and web presences suggests "it's a one-person labor of love, operated by a Russian of considerable talent and access to Europe."

A FAQ page, which has not been updated since 2013, states the site "is privately funded; there are no complex finances behind it." A post on the site's blog from 2021 says "it is doomed to die at any moment."


Original Submission

posted by janrinok on Wednesday November 12, @07:34AM   Printer-friendly

https://9to5linux.com/trinity-desktop-environment-r14-1-5-released-with-support-for-debian-trixie

This release also adds support for the openSUSE Leap 16, Ubuntu 25.10, Fedora Linux 43, and Red Hat Enterprise Linux 10 operating systems.

Trinity Desktop Environment (TDE) R14.1.5 desktop environment has been released for nostalgic KDE 3.5 users as the fifth maintenance release of the R14.1.x series with various new features and enhancements.

Coming almost six and a half months after Trinity Desktop Environment R14.1.4, the Trinity Desktop Environment R14.1.5 release introduces support for recent GNU/Linux distributions, including Debian 13 "Trixie", Ubuntu 25.10 (Questing Quokka), openSUSE Leap 16, Fedora Linux 43, and RHEL 10.

The nightly builds also support the upcoming Debian 14 "Forky" operating system (Debian Testing). Support for older distributions that are no longer supported has been dropped in this release, including Ubuntu 23.10 (Mantic Minotaur), openSUSE Leap 15.5, and Fedora Linux 41.

New features in Trinity Desktop Environment R14.1.5 include tiling support on multi-monitor setups, along with user-friendly tiling band settings, support for a paste command to the KRDC remote desktop client to let you send clipboard content as text, and FFmpeg 8.0 support to the K9Copy DVD backup and DVD authoring program.

This release also brings various aesthetic improvements and new blur options to the Kicker application menu, a mute toggle button to Codeine's volume slider, support for the unzip v6 date format to the Ark file archiver, and improvements to various TDE-branded artwork and a new Flying Konqi wallpaper.

Last but not least, Trinity Desktop Environment R14.1.5 adds a new option to center the pop-up menu when using the Baghira style, support for the libgpgme 2.0 library to the tdepim component, support for OpenLDAP 2.5, and smooth resize as the default selection at start to the KolourPaint paint program.

Of course, numerous bugs were fixed, so check out the full release notes for more details about the changes included in TDE R14.1.5, which you can download for Linux distros, as well as BSD and DilOS systems from the official website.

Has anybody here used it? Any comments?

- Previously:

Trinity Desktop Environment 14.1.4 Released


Original Submission

posted by janrinok on Wednesday November 12, @02:51AM   Printer-friendly
from the opposite-of-debating-either-side dept.

Life is full of negotiations. Techies focused on their career specialty may not be well prepared to negotiate, but at MIT there is a highly respected class - https://betterworld.mit.edu/spectrum/issues/spring-2025/unlocking-unique-negotiation-playbooks

Introduction to negotiation theory and practice. Applications in government, business, and nonprofit settings are examined. Combines a hands-on personal skill-building orientation with a look at pertinent tactical and strategic foundations.

Preparation insights, persuasion tools, ethical benchmarks, and institutional influences are examined as they shape our ability to analyze problems, negotiate agreements, and resolve disputes in social, organizational, and political circumstances characterized by interdependent interests.
[...]
Verdini [the Prof] received the Institute's first-ever interdisciplinary PhD in negotiation, communication, diplomacy, and leadership in 2015. "I had fallen in love with these four fields because they ask for a full presence," he says. "You can't negotiate or lead effectively if you don't know what you stand for, and you can only figure out what you stand for if you're committed in a lifelong process of self-discovery and curiosity about oneself and each other."
[...]
Maya Makarovsky '25 [...] immediately saw how the course had "altered brain chemistry" for the better. One example: in the midst of passionate, defensive arguments in a business meeting, she was able to steer the discussion back to a more productive place.

"Before speaking, I took a moment to think of how to create value through our different interpretations of reality, and how we could convert an adversarial critical stance to one of mutual respect to work towards progress," she says. "11.011 empowered me to step back in the heated situation and think about what I should prioritize for all stakeholders involved, which was the long-term success of the project rather than short-term ego defense."

MIT OpenCourseWare offers this class (free, online), but it appears to be taught by the previous prof, not the rockstar noted in the Spectrum link above https://ocw.mit.edu/courses/11-011-the-art-and-science-of-negotiation-spring-2006/

Are you able to negotiate effectively? How did you learn? Your AC submitter learned by working with a couple of family members who were very good at negotiating--but it wasn't efficient, it took many years for their negotiating skills to rub off.


Original Submission

posted by janrinok on Tuesday November 11, @10:03PM   Printer-friendly

https://9to5linux.com/mx-linux-25-infinity-is-now-available-for-download-based-on-debian-13-trixie

This release introduces new Conky configurations, along with a default Conky configuration to change between 12h (AM/PM) and 24h for the locale.

The MX Linux 25 (codename Infinity) distribution has been released today for download based on the latest Debian 13 "Trixie" operating system stable series.

MX Linux 25 features the long-term supported Linux 6.12 LTS kernel series for the standard editions and a Liquorix-flavored Linux 6.15 kernel for the KDE Plasma edition and the Xfce-based AHS (Advanced Hardware Support) edition, offering both systemd and SysVinit flavors for the Xfce and Fluxbox editions.

Highlights of MX Linux 25 include support for Debian's new deb822 format for managing sources, a Qt 6 port of the MX Tools app, a new mx-updater tool that replaces the apt-notifier package updater tool, and Wayland by default for the KDE Plasma edition.

This release also features an updated installer that now includes a function to help "replace" an existing Linux installation and support for 64-bit UEFI Secure Boot installations. Moreover, MX Linux 25 introduces systemd-cryptsetup on the systemd-based ISOs to improve support for encrypted /home partitions.

New Conky configurations have been added as well in this release, along with a default Conky configuration, allowing users to change between 12h (AM/PM) and 24h for the locale, depending on the 12h/24h time display. MX Linux 25 also updates to the mx-ease and mx-matcha themes.

The Xfce edition got an improved Whisker Menu that has been updated to the new settings format. On the other hand, the KDE Plasma edition received root actions and other service menus for the Dolphin file manager, while TLP has been removed in favor of the power-profiles-dameon to fix an issue with the power profile widget.

The Fluxbox edition received many new configuration options, a revised panel configuration, revised root-level menus, revamped "appfinder" configurations for the Rofi tool, adjustments to the default toolbar configurations and the default styles, and Audacious as the default audio player instead of DeaDBeeF.

Among other changes, the Nvidia-installer (ddm-mx) received a fallback mode for the NVIDIA developer repository function and enhanced compatibility with Wayland, while the mx-updater utility was improved to make "automatic" updates work as expected.

MX Linux 25 is available for download right now from the official website as Xfce, KDE Plasma, and Fluxbox editions featuring the Xfce 4.20, KDE Plasma 6.3.6, and Fluxbox 1.3.7 graphical environments.


Original Submission

posted by janrinok on Tuesday November 11, @05:18PM   Printer-friendly
from the once-you-have-access-to-the-hardware..... dept.

On-chip TEEs withstand rooted OSes but fall instantly to cheap physical attacks:

Trusted execution environments, or TEEs, are everywhere—in blockchain architectures, virtually every cloud service, and computing involving AI, finance, and defense contractors. It's hard to overstate the reliance that entire industries have on three TEEs in particular: Confidential Compute from Nvidia, SEV-SNP from AMD, and SGX and TDX from Intel. All three come with assurances that confidential data and sensitive computing can't be viewed or altered, even if a server has suffered a complete compromise of the operating kernel.

A trio of novel physical attacks raises new questions about the true security offered by these TEES and the exaggerated promises and misconceptions coming from the big and small players using them.

The most recent attack, released Tuesday, is known as TEE.fail. It defeats the latest TEE protections from all three chipmakers. The low-cost, low-complexity attack works by placing a small piece of hardware between a single physical memory chip and the motherboard slot it plugs into. It also requires the attacker to compromise the operating system kernel. Once this three-minute attack is completed, Confidential Compute, SEV-SNP, and TDX/SDX can no longer be trusted. Unlike the Battering RAM and Wiretap attacks from last month—which worked only against CPUs using DDR4 memory—TEE.fail works against DDR5, allowing them to work against the latest TEEs.

All three chipmakers exclude physical attacks from threat models for their TEEs, also known as secure enclaves. Instead, assurances are limited to protecting data and execution from viewing or tampering, even when the kernel OS running the processor has been compromised. None of the chipmakers make these carveouts prominent, and they sometimes provide confusing statements about the TEE protections offered.

Many users of these TEEs make public assertions about the protections that are flat-out wrong, misleading, or unclear. All three chipmakers and many TEE users focus on the suitability of the enclaves for protecting servers on a network edge, which are often located in remote locations, where physical access is a top threat.

"These features keep getting broken, but that doesn't stop vendors from selling them for these use cases—and people keep believing them and spending time using them," said HD Moore, a security researcher and the founder and CEO of runZero.

He continued:

Overall, it's hard for a customer to know what they are getting when they buy confidential computing in the cloud. For on-premise deployments, it may not be obvious that physical attacks (including side channels) are specifically out of scope. This research shows that server-side TEEs are not effective against physical attacks, and even more surprising, Intel and AMD consider these out of scope. If you were expecting TEEs to provide private computing in untrusted data centers, these attacks should change your mind.

[...] Many TEE users run their infrastructure inside cloud providers such as AWS, Azure, or Google, where protections against supply-chain and physical attacks are extremely robust. That raises the bar for a TEE.fail-style attack significantly. (Whether the services could be compelled by governments with valid subpoenas to attack their own TEE is not clear.)

All these caveats notwithstanding, there's often (1) little discussion of the growing viability of cheap, physical attacks, (2) no evidence (yet) that implementations not vulnerable to the three attacks won't fall to follow-on research, or (3) no way for parties relying on TEEs to know where the servers are running and whether they're free from physical compromise.

"We don't know where the hardware is," Daniel Genkin, one of the researchers behind both TEE.fail and Wiretap, said in an interview. "From a user perspective, I don't even have a way to verify where the server is. Therefore, I have no way to verify if it's in a reputable facility or an attacker's basement."

[...] The root cause of all three physical attacks is the choice of deterministic encryption. This form of encryption produces the same ciphertext each time the same plaintext is encrypted with the same key. A TEE.fail attacker can copy ciphertext strings and use them in replay attacks. (Probabilistic encryption, by contrast, resists such attacks because the same plaintext can encrypt to a wide range of ciphertexts that are randomly chosen during the encryption process.)

[...] With possession of the key, the attacker can use the compromised server to peer into data or tamper with the code flowing through the enclave and send the relying party an assurance that the device is secure. With this key, even CPUs built by other chipmakers can send an attestation that the hardware is protected by the Intel TEEs.

[...] "Now that we have interpositioned DDR5 traffic, our work shows that even the most modern of TEEs across all vendors with available hardware is vulnerable to cheap physical attacks," Genkin said.

The equipment required by TEE.fail runs off-the-shelf gear that costs less than $1,000. One of the devices the researchers built fits into a 17-inch briefcase, so it can be smuggled into a facility housing a TEE-protected server. Once the physical attack is performed, the device does not need to be connected again. Attackers breaking TEEs on servers they operate have no need for stealth, allowing them to use a larger device, which the researchers also built.

[...] "It's a really hard problem," Moore said. "I'm not sure what the current state of the art is, but if you can't afford custom hardware, the best you can do is rely on the CPU provider's TEE, and this research shows how weak this is from the perspective of an attacker with physical access. The enclave is really a Band-Aid or hardening mechanism over a really difficult problem, and it's both imperfect and dangerous if compromised, for all sorts of reasons."


Original Submission

posted by hubie on Tuesday November 11, @12:37PM   Printer-friendly
from the let's-be-careful-out-there dept.

Two Windows Vulnerabilities, One a 0-Day, are Under Active Exploitation

Both vulnerabilities are being exploited in wide-scale operations:

Two Windows vulnerabilities—one a zero-day that has been known to attackers since 2017 and the other a critical flaw that Microsoft initially tried and failed to patch recently—are under active exploitation in widespread attacks targeting a swath of the Internet, researchers say.

The zero-day went undiscovered until March, when security firm Trend Micro said it had been under active exploitation since 2017, by as many as 11 separate advanced persistent threats (APTs). These APT groups, often with ties to nation-states, relentlessly attack specific individuals or groups of interest. Trend Micro went on to say that the groups were exploiting the vulnerability, then tracked as ZDI-CAN-25373, to install various known post-exploitation payloads on infrastructure located in nearly 60 countries, with the US, Canada, Russia, and Korea being the most common.

Seven months later, Microsoft still hasn't patched the vulnerability, which stems from a bug in the Windows Shortcut binary format. The Windows component makes opening apps or accessing files easier and faster by allowing a single binary file to invoke them without having to navigate to their locations. In recent months, the ZDI-CAN-25373 tracking designation has been changed to CVE-2025-9491.

On Thursday, security firm Arctic Wolf reported that it observed a China-aligned threat group, tracked as UNC-6384, exploiting CVE-2025-9491 in attacks against various European nations. The final payload is a widely used remote access trojan known as PlugX. To better conceal the malware, the exploit keeps the binary file encrypted in the RC4 format until the final step in the attack.

"The breadth of targeting across multiple European nations within a condensed timeframe suggests either a large-scale coordinated intelligence collection operation or deployment of multiple parallel operational teams with shared tooling but independent targeting," Arctic Wolf said. "The consistency in tradecraft across disparate targets indicates centralized tool development and operational security standards even if execution is distributed across multiple teams."

With no patch available, Windows users are left with a limited number of options for fending off attacks. The most effective countermeasure is locking down .lnk functions by blocking or restricting the usage of .lnk files from untrusted origins. This can be done by setting the Windows Explorer to disable the automatic resolution of such files. The severity rating for CVE-2025-9491 is 7 out of 10.

The other Windows vulnerability was patched last week, when Microsoft issued an unscheduled update. CVE-2025-59287 carries a severity rating of 9.8. It resides in the Windows Server Update Services, which administrators use to install, patch, or delete apps on vast fleets of servers. Microsoft previously attempted to patch the potentially wormable remote code execution vulnerability, caused by a serialization flaw, a week earlier in its October Patch Tuesday release. Publicly released proof-of-concept code quickly proved that the attempted fix was incomplete

Around the same time that Microsoft released its second fix, security firm Huntress said it had observed the WSUS flaw being exploited starting on October 23. Security firm Eye reported the same finding shortly after.

NPM Flooded With Malicious Packages Downloaded More Than 86,000 Times

Packages downloaded from NPM can fetch dependencies from untrusted sites:

Attackers are exploiting a major weakness that has allowed them access to the NPM code repository with more than 100 credential-stealing packages since August, mostly without detection.

The finding, laid out Wednesday by security firm Koi, brings attention to an NPM practice that allows installed packages to automatically pull down and run unvetted packages from untrusted domains. Koi said a campaign it tracks as PhantomRaven has exploited NPM's use of "Remote Dynamic Dependencies" to flood NPM with 126 malicious packages that have been downloaded more than 86,000 times. Some 80 of those packages remained available as of Wednesday morning, Koi said.

"PhantomRaven demonstrates how sophisticated attackers are getting [better] at exploiting blind spots in traditional security tooling," Koi's Oren Yomtov wrote. "Remote Dynamic Dependencies aren't visible to static analysis."

Remote Dynamic Dependencies provide greater flexibility in accessing dependencies—the code libraries that are mandatory for many other packages to work. Normally, dependencies are visible to the developer installing the package. They're usually downloaded from NPM's trusted infrastructure.

RDD works differently. It allows a package to download dependencies from untrusted websites, even those that connect over HTTP, which is unencrypted. The PhantomRaven attackers exploited this leniency by including code in the 126 packages uploaded to NPM. The code downloads malicious dependencies from URLs, including http://packages.storeartifact.com/npm/unused-imports. Koi said these dependencies are "invisible" to developers and many security scanners. Instead, they show the package contains "0 Dependencies." An NPM feature causes these invisible downloads to be automatically installed.

Compounding the weakness, the dependencies are downloaded "fresh" from the attacker server each time a package is installed, rather than being cached, versioned, or otherwise static, as Koi explained:

This opens the door to sophisticated targeting. In theory, they could check the IP address of every request and serve different payloads: benign code to security researchers on VPNs, malicious code to corporate networks, specialized payloads for cloud environments. Or play the long game—return clean code for weeks to build trust and pass security scans, then flip a switch and start serving the malicious version.

[...] Anyone who regularly downloads packages from NPM should check the Koi post for a list of indicators that their system has been compromised through PhantomRaven. These indicators can be used in system scans to determine whether they've been targeted.


Original Submission #1Original Submission #2

posted by hubie on Tuesday November 11, @07:50AM   Printer-friendly
from the can-you-hear-me-now? dept.

https://www.bleepingcomputer.com/news/security/uk-carriers-to-block-spoofed-phone-numbers-in-fraud-crackdown/

Under a new partnership with the government aimed at combating fraud, Britain's largest mobile carriers have committed to upgrading their networks to eliminate scammers' ability to spoof phone numbers within a year.

This agreement is part of the new Telecoms Charter, which brings together law enforcement, government agencies, and Britain's top mobile networks, including BT EE, Virgin Media O2, Vodafone Three, Tesco Mobile, TalkTalk, and Sky.

It requires carriers to upgrade their networks to indicate when calls originate from abroad, preventing fraudsters from impersonating banks, government agencies, and other trusted organizations.

"Advanced call tracing technology will also be rolled out across mobile networks to give police the intelligence to track down scammers operating across the country and dismantle their operations," the UK Home Office said in a Wednesday press release.

"New commitments to boost data sharing with the police will shine a light on the mobile networks that let scam calls slip through the net, empowering customers and making it harder for scams to go undetected."

[...] According to data shared by the UK government today, 96% of mobile users check caller ID before answering, with three-quarters blocking calls from unknown international numbers, a trend exploited by scammers who spoof UK numbers to appear local and trustworthy.

"Spoofed calls allow scammers to deceive the public with fake identities and false promises. In a major upgrade of our mobile network, call spoofing will be eliminated within a year - stripping away the tools scammers use to cheat people out of their hard-earned cash," said Minister for Fraud Lord Hanson.


Original Submission

posted by hubie on Tuesday November 11, @03:04AM   Printer-friendly
from the times-of-your-life dept.

Breakingviews - AI sets up Kodak moment for global consultants:

Management consultants are getting closer to their Kodak moment. The likes of $155 billion Accenture made their mark by charging corporate clients way less than what they would have had to pay to provide IT, cyber protection and offshore call centres themselves. Artificial intelligence is making the industry's dynamics look problematically like that of the camera giant that famously filed for bankruptcy protection in 2012 - after having its lunch eaten by digital competition.

As the AI boom develops, consultants are in a tricky spot. The pandemic, inflation and economic uncertainty have encouraged many of their big clients to tighten expenditure. The U.S. government, one of the biggest spenders, has been cancelling multiple billion-dollar contracts in an effort to conserve cash. In March, 10 of the largest consultants including Deloitte, Accenture, Booz Allen Hamilton, IBM and Guidehouse were targeted by the Department of Government Efficiency to justify their fees. As a result, the largest listed players' shares have collapsed by up to 30% in the past two years, against the S&P 500's 50% jump.

AI is, in some respects, a boon. In September, Accenture said it had helped it cut 11,000 jobs, and CEO Julie Sweet is set to augment that with staff that cannot be retrained. Salesforce recently laid off 4000 customer support workers. Microsoft has halted hiring in its consulting business.

Unfortunately, big clients are cottoning on to the advantages too. One finance chief of a large UK company outlined the issue for Breakingviews via an illustrative example. Say an outsourced project costs the client $1 million to do themselves, and Accenture and the like have historically been able to do the same job for $200,000. With the advent of machine learning, companies can do the same work for just $10,000.

This gives clients considerable leverage. If consultants won't lower their prices to near the relevant level, the client can find one who will. Or just do the job itself.

[...] Either way, none of this will stop clients demanding knockdown prices. Kodak did emerge from bankruptcy protection in 2013 as a smaller company that is now worth around $500 million - a far cry from the $30 billion-plus it fetched in its 1990s heyday. The risk for the consultants is a similar valuation downer.

Are any of you Soylentil independent consultants feeling this pinch?


Original Submission

posted by mrpg on Monday November 10, @10:22PM   Printer-friendly
from the burn-baby-burn dept.

New South Wales has banned Australians from taking ebikes on trains

[...] Those who own converted e-bikes are now banned from using certain public transport services in New South Wales.

It comes as the state government seeks to crack down on battery-related fires linked to e-mobility devices.

The new rule came into effect on November 1.

Converted e-bikes, which have become increasingly popular in recent years, are regular pedal bicycles that have been retrofitted with an electric motor and battery.

[...] According to Transport for NSW, converted e-bikes have a “higher risk of electrical failure and fire risk to DIY installations, inadequate wiring and use of second-hand batteries and incompatible or poor-quality components.”

Commercially manufactured e-bikes and shared e-bikes will still be permitted.

Riders caught bringing a banned e-bike on board face a $400 on-the-spot fine, with a maximum penalty of $1,110.

NSW’s e-bike ban could spread nationwide after a spate of similar e-bike battery fire incidents in other states have affected public transport services in recent years.


Original Submission

posted by mrpg on Monday November 10, @05:40PM   Printer-friendly
from the Hide-and-Seek dept.

The Australian Wine Industry has had enough of counterfeits which are weighing in at an estimated cost of $70 billion. Bottle caps with NFC and an application to read the value to verify that the bottle is authentic.

Australian wines have long been sought after on international shelves, renowned for their bold flavours and global appeal.

But recent reports of counterfeit Australian wines circulating overseas are sparking new fears that one of our nation’s most valuable exports is under threat – with a growing underground market of fake bottles waiting to cash in.

It’s estimated that counterfeit wine affects up to 20 per cent of the global $350 billion wine industry, ripping off up to $70 billion a year.

And the trade is becoming more sophisticated than just crude label forgery, replicating bottles and even serial numbers with extreme accuracy.

Now, the industry is turning to technology to fight back through the use of “smart” bottle tops.

Perth company Cellr has developed a product to combat the fake wine market, with technology built directly into bottles.

The caps include Near Field Communication (NFC) and Radio Frequency Identification (RFID) chips that can be scanned using an accompanying app.


Original Submission

posted by mrpg on Monday November 10, @01:00PM   Printer-friendly
from the Following-an-old-lead dept.

This story, from Australia's national broadcaster, details how scientists were keen to use old lead from a ship that sunk in Roman times to shield modern instruments from stray radiation.

When a 2,000-year-old Roman shipwreck was found off the Sardinian coast in 1988, it didn't just thrill archaeologists — physicists were excited too.

The discovery grabbed the attention of one in particular: Ettore Fiorini, a particle physicist with Italy's Institute for Nuclear Physics (INFN).

He didn't care too much about the ship. He was more interested in its cargo — hundreds of lead bars, each weighing 33 kilogrammes.

[...] Ancient lead is useful for sensitive physics experiments because it has lost the radioactivity that can complicate observations.

When trying to observe elementary particles, which are the tiniest building blocks that make up reality, physicists need to silence any background noise.

[...] Lead is a suitable shield from this radioactivity — which can come from cosmic rays or bananas — because it's super dense.

But freshly mined lead has some radioactive "noise" of its own, because it naturally contains a trace amount of the unstable isotope lead-210, which releases energy as it decays.

[...] Which is why, according to metallurgist Kevin Laws of the University of New South Wales, physicists are on the lookout for lead mined during ancient Roman times.

It has had plenty of time to become stable.

"But there is debate that by utilising lead from sources such as shipwrecks we are destroying historical items and record," Dr Laws says.


Original Submission

posted by mrpg on Monday November 10, @08:21AM   Printer-friendly
from the you-have-to-pay-through-the-butt-to-get-some-coffee dept.

Fans of kopi luwak claim the coffee has a unique aroma and taste. A new chemical analysis backs them up:

In 2007's The Bucket List, Jack Nicholson's billionaire magnate is a fan of a luxury coffee called kopi luwak, only to be informed that the beans first pass through the digestive tracts of civets and are harvested from their feces prior to roasting. The implication is that the billionaire just liked drinking gimmicky expensive coffee without realizing its less-than-luxurious origins. It's one of the most expensive coffees in the world, ranging from $45 per pound to $590 per pound, depending on whether the beans are farmed or collected in the wild.

Whether kopi luwak is worth that hefty price tag depends on who you ask. A Washington Post food critic once compared the beverage to stale Folgers, memorably describing the flavor as "petrified dinosaur droppings steeped in bathtub water." Yet kopi luwak has many genuine fans who claim the coffee has a unique aroma and taste. Based on a new chemical analysis, they might have a point, according to a paper published in Scientific Reports.

Technically, kopi luwak is a method of processing, not a specific coffee bean variety. Asian palm civets hang around coffee plantations because they love to feast on ripened coffee berries; the berries constitute most of their diet, along with various seeds. The consumed berries undergo fermentation as they pass through the animal's intestines, and the civets digest the pulp and excrete the beans. Coffee farmers then collect the scat to recover the excreted beans and process and roast them to produce kopi luwak.

There have been numerous scientific studies over the last 15–20 years aimed at identifying any key differences between civet coffee and regular varieties, with mixed results. Some have noted differences in volatile compounds, protein, sugar, mineral concentrations, and caffeine levels, as well as lower acidity and bitterness, and higher levels of acetic acid and lipids.

It's not just about aromas and flavors, either. Because kopi luwak is so pricey, there is a thriving counterfeit trade, so achieving a better understanding of its specific chemistry helps detect fake products. And given the increased concern over intensive farming, where civets are kept in captivity and force-fed coffee berries, that deeper understanding could lead to a viable artificial fermentation process.

[...] The civet beans had higher fat levels, particularly those compounds known to influence aroma and flavor, such as caprylic acid and methyl esters—contributing to kopi luwak's distinctive aroma and flavor—but lower levels of caffeine, protein, and acidity, which would reduce the bitterness. The lower acidity is likely due to the coffee berries being naturally fermented in the civets' digestive tracts, and there is more to learn about the role the gut microbiome plays in all of this. There were also several volatile organic compounds, common to standard coffee, that were extremely low or absent entirely in the civet samples.

In short, the comparative analysis "further supports the notion that civet coffee is chemically different from conventionally produced coffee of similar types, mainly due to fermentation," the authors concluded. They recommend further research using roasted samples, along with studying other coffee varieties, samples from a more diverse selection of farms, and the influence of certain ecological conditions, such as canopy cover and the presence of wild trees.

Journal Reference: Mitra, R., Jose, T., Abhiram Krishnan, P. et al. Civet Robusta and natural Robusta coffee are different on key fatty acid methyl esters and total fat. [OPEN] Sci Rep 15, 36281 (2025). https://doi.org/10.1038/s41598-025-21545-x


Original Submission

posted by jelizondo on Monday November 10, @03:47AM   Printer-friendly

I thought this was an interesting angle on the Air India crash back in June - questioning whether the crash of the Boeing 787 might be a technical fault, rather than pilot error as had been presumed previously by media reporting:

https://www.bbc.co.uk/news/articles/c33pzypkkdzo

"""
Nearly five months after a plane crash in India which killed 260 people, the investigation has become mired in controversy – with the country's Supreme Court the latest to weigh in. An interim report was released in July, but critics argue it unfairly focused on the actions of the pilots, diverting attention away from a possible fault with the aircraft. On Friday, a judge in India's Supreme Court insisted that nobody could blame the aircraft's captain. His comments came a week after the airline's boss insisted there was no problem with the aircraft.

Because the accident happened in India, the investigation is being led by the country's Air Accident investigation Bureau (AAIB). However, because the aircraft and its engines were designed and built in America, US officials are also taking part.

Indian aviation safety consultant Capt. Mohan Ranganathan strongly implied that pilot suicide could have caused the accident, in an interview with the country's NDTV channel. Capt. Amit Singh, founder of the Safety Matters Foundation, has produced a report which claims the available evidence "strongly supports the theory of an electrical disturbance as the primary cause of the engine shutdown" that led to the disaster.
"""

This article:
https://safetymatters.co.in/flight-ai171-analysing-electrical-system-anomalies/
has more details on the electrical faults

"""
A primary theory under examination attributes this shutdown to an electrical disturbance... The Flight Data Recorder (FDR) captured ... transitions of the fuel cutoff switches, reflecting the commanded state as interpreted by the aircraft's digital systems, rather than direct physical manipulation by the crew...

The aft Enhanced Airborne Flight Recorder (EAFR) was located in the tail section of the aircraft, specifically at STA 1847, on the rooftop of Building A. This unit sustained significant "impact and thermal damages to the housing," with investigators noting that "wires were protruding from the housing and the connectors were burnt"... The absence of soot on the aft EAFR casing despite sooted surroundings , indicates that a clean-burning likely caused the thermal damage, high-heat source such as an electrical fault or localized metallic combustion, rather than a widespread fuel-fed fire.
"""

See also:
https://safetymatters.co.in/when-words-create-blame-reading-the-ai171-preliminary-report-through-the-lens-of-language/


Original Submission