×
Android

Google Pixel 7 Series Only Support 64-bit Apps (xda-developers.com) 29

An anonymous reader quotes a report from XDA Developers: As it turns out, the Google Pixel 7 series appears to be the first set of Android smartphones that only support 64-bit applications. [Android expert Mishaal Rahman first reported the news.] Rahman later corrected himself to say that it's a 64-bit Zygote but a 32-bit and 64-bit userspace, not a 64-bit only build of Android 13 as initially reported. This certainly lends credence to the claim that the Google Pixel tablet may come with a 64-bit only build of Android 13, though.

What this means is that for any apps that don't have 64-bit libraries, you won't be able to install them. This includes older versions of apps such as Jetpack Joyride and even older, completely defunct apps like Flappy Bird. It's not as if Tensor G2 doesn't support it either -- its three different cores all support AArch32 execution. Google could have enabled 32-bit support as they have done in its previous smartphones. Listing the Android Binary Interfaces (ABI) returns that there is nothing present for "armeabi-v7a" or "armeabi". "arm64-v8a" support is listed, but as per the Android documentation, it only supports the AArch64 instruction set.

What does this mean, and does it have any benefits? Most benefits won't really be visible to consumers, as these improvements are primarily found in heightened security, better performance, and reduced processing cost thanks to the lack of additional ABIs. All apps on the Google Play Store have had to have 64-bit support since August 2019, and the company stopped serving 32-bit apps that don't have any 64-bit support last year.

IOS

iOS 16 VPN Tunnels Leak Data, Even When Lockdown Mode Is Enabled (macrumors.com) 35

AmiMoJo shares a report from MacRumors: iOS 16 continues to leak data outside an active VPN tunnel, even when Lockdown mode is enabled, security researchers have discovered. Speaking to MacRumors, security researchers Tommy Mysk and Talal Haj Bakry explained that iOS 16's approach to VPN traffic is the same whether Lockdown mode is enabled or not. The news is significant since iOS has a persistent, unresolved issue with leaking data outside an active VPN tunnel.

According to a report from privacy company Proton, an iOS VPN bypass vulnerability had been identified in iOS 13.3.1, which persisted through three subsequent updates. Apple indicated it would add Kill Switch functionality in a future software update that would allow developers to block all existing connections if a VPN tunnel is lost, but this functionality does not appear to prevent data leaks as of iOS 15 and iOS 16. Mysk and Bakry have now discovered that iOS 16 communicates with select Apple services outside an active VPN tunnel and leaks DNS requests without the user's knowledge.

Mysk and Bakry also investigated whether iOS 16's Lockdown mode takes the necessary steps to fix this issue and funnel all traffic through a VPN when one is enabled, and it appears that the exact same issue persists whether Lockdown mode is enabled or not, particularly with push notifications. This means that the minority of users who are vulnerable to a cyberattack and need to enable Lockdown mode are equally at risk of data leaks outside their active VPN tunnel. [...] Due to the fact that iOS 16 leaks data outside the VPN tunnel even where Lockdown mode is enabled, internet service providers, governments, and other organizations may be able to identify users who have a large amount of traffic, potentially highlighting influential individuals. It is possible that Apple does not want a potentially malicious VPN app to collect some kinds of traffic, but seeing as ISPs and governments are then able to do this, even if that is what the user is specifically trying to avoid, it seems likely that this is part of the same VPN problem that affects iOS 16 as a whole.

Transportation

Lufthansa Changes Mind, Now Says Apple AirTags Are Allowed on Luggage (arstechnica.com) 19

Apple AirTags "are allowed on Lufthansa flights," Lufthansa announced this week — the opposite of their position last Sunday, remembers SFGate: The airline insisted the tech was "dangerous" and referred to International Civil Aviation Organization guidelines (set by the United Nations's specialized agency that recommends air transport policy) stipulating that baggage trackers are subject to the dangerous goods regulations. ["Furthermore, due to their transmission function, the trackers must be deactivated during the flight if they are in checked baggage," Lufthansa added on Twitter, "and cannot be used as a result"]
Ars Technica reports on the public relations debacle that then ensued: Outcry, close reading of the relevant sections (part 2, section C) of ICAO guidelines, and accusations of ulterior motives immediately followed. AppleInsider noted that the regulations are meant for lithium-ion batteries that could be accidentally activated; AirTag batteries are not lithium-ion, are encased, and are commonly used in watches, which have not been banned by any airline. The site also spoke with "multiple international aviation experts" who saw no such ban in ICAO regulations. One expert told the site the ban was "a way to stop Lufthansa from being embarrassed by lost luggage...."

Numerous people pointed out that Lufthansa, in its online World Shop, sells Apple AirTags. One Ars staffer noted that Lufthansa had previously dabbled in selling a smart luggage tag, one that specifically used RFID and BLE to program an e-ink display with flight information. On Tuesday, Apple told numerous publications that it, too, disagreed with Lufthansa's interpretation. It went unsaid but was strongly implied that a company that is often the world's largest by revenue would take something like air travel regulations into consideration when designing portable find-your-object devices....

Representatives from the Federal Aviation Administration and Transportation Security Administration said early this week that Bluetooth-based trackers were allowed in checked luggage. The European Union Aviation Safety Agency said its regulations could "not in itself ban or allow" trackers, but airlines could determine their own guidelines.

On Wednesday, Lufthansa walked back the policy under the cover of "The German Aviation Authorities (Luftfahrtbundesamt)," which the airline said in a tweet "shared our risk assessment, that tracking devices with very low battery and transmission power in checked luggage do not pose a safety risk." This would seem to imply either that Lufthansa was acting on that authority's ruling without having previously mentioned it, or that Lufthansa had acted on its own and has now found an outside actor to approve their undoing.

Bitcoin

Tether, World's Biggest Stablecoin, Cuts Its Commercial Paper Holdings To Zero 53

Tether, the world's largest stablecoin, has slashed back its commercial paper holdings to zero, replacing them with U.S. Treasury bills instead, according to a blog post. CNBC reports: The popular U.S.-dollar-pegged cryptocurrency said the move is part of tether's "ongoing efforts to increase transparency" and back its tokens with "the most secure reserves in the market" -- in the ultimate hope of ensuring investor protection. There are now about 68.4 billion tether tokens in circulation, according to data from CoinMarketCap, up from 2 billion three years ago. The cryptocurrency has a market capitalization of $68.4 billion. "Tether has led the industry in transparency releasing attestations every three months, constantly reviewing the make up of its reserves," continued the statement.

Commercial paper is a form of short-term, unsecured debt issued by companies, and it is considered to be less reliable than Treasury bills. In October, Tether's Chief Technology Officer, Paolo Ardoino, tweeted that 58.1% of its assets were in T-bills, up from 43.5% in June. It is unclear where that percentage currently stands, but Ardoino did write in a post on Thursday that Tether was able to pay $7 billion, or 10% of its reserves, in 48 hours. "Ask your bank or other stablecoins if they can do that, in same time frame of course," he wrote. Thursday's statement went on to note that zeroing out the balance of its commercial paper holdings was also meant to be a step toward "greater transparency and trust, not only for tether but for the entire stablecoin industry."
While not yet large enough to cause disruption in U.S. money markets, tether could eventually reach a size where its owning of U.S. Treasuries becomes "really scary," Carol Alexander, a professor of finance at Sussex University, said.

"Suppose you go down the line and, instead of $80 billion, we've got $200 billion, and most of that is in liquid U.S. government securities," she said. "Then a crash in tether would have a substantial impact on U.S. money markets and would just tip the whole world into recession."
Security

How Wi-Fi Spy Drones Snooped On Financial Firm (theregister.com) 52

An anonymous reader quotes a report from The Register: Modified off-the-shelf drones have been found carrying wireless network-intrusion kit in a very unlikely place. Greg Linares, a security researcher, recently recounted an incident that he said occurred over the summer at a US East Coast financial firm focused on private investment. He told The Register that he was not involved directly with the investigation but interacted with those involved as part of his work in the finance sector. In a Twitter thread, Linares said the hacking incident was discovered when the financial firm spotted unusual activity on its internal Atlassian Confluence page that originated from within the company's network.

The company's security team responded and found that the user whose MAC address was used to gain partial access to the company Wi-Fi network was also logged in at home several miles away. That is to say, the user was active off-site but someone within Wi-Fi range of the building was trying to wirelessly use that user's MAC address, which is a red flag. The team then took steps to trace the Wi-Fi signal and used a Fluke system to identify the Wi-Fi device. "This led the team to the roof, where a 'modified DJI Matrice 600' and a 'modified DJI Phantom' series were discovered," Linares explained. The Phantom drone was in fine condition and had a modified Wi-Fi Pineapple device, used for network penetration testing, according to Linares. The Matrice drone was carrying a case that contained a Raspberry Pi, several batteries, a GPD mini laptop, a 4G modem, and another Wi-Fi device. It had landed near the building's heating and ventilation system and appeared to be damaged but still operable. "During their investigation, they determined that the DJI Phantom drone had originally been used a few days prior to intercept a worker's credentials and Wi-Fi," Linares said. "This data was later hard coded into the tools that were deployed with the Matrice."

According to Linares, the tools on the drones were used to target the company's internal Confluence page in order to reach other internal devices using the credentials stored there. The attack, he said, had limited success and is the third cyberattack involving a drone he's seen over the past two years. "The attackers specifically targeted a limited access network, used by both a third-party and internally, that was not secure due to recent changes at the company (e.g. restructuring/rebranding, new building, new building lease, new network setup or a combination of any of these scenarios)," Linares told The Register. "This is the reason why this temporary network unfortunately had limited access in order to login (credentials + MAC security). The attackers were using the attack in order to access an internal IT confluence server that contained other credentials for accessing other resources and storing IT procedures." [...] While the identity of the attacker has not been disclosed, Linares believes those responsible did their homework. "This was definitely a threat actor who likely did internal reconnaissance for several weeks, had physical proximity to the target environment, had a proper budget and knew their physical security limitations," he said.

Hardware

Older Samsung Phones Are Blowing Up (phonearena.com) 57

An anonymous reader shares a report: In case you follow the smartphone industry, particularly on YouTube and Twitter, you'd know that there have been recent reports of Samsung phones that are ... "blowing up", or at least about to. Of course, to most, that'd probably bring immediate Galaxy Note 7 flashbacks - we all remember when Samsung's 2016 flagship phone became the subject of universal entry checks, jokes, and legitimate fires. Despite trying, in the end Samsung wasn't able to handle the Note 7 battery crisis. The company recalled the defective phones and released a fresh batch of Note 7s (after having changed its battery supplier). The issues persisted, and the Note 7 was eventually officially discontinued less than two months after its official launch. But this time, the case is slightly different... The recently reported battery issues seem to be affecting any Samsung phone (as recent as 18 months old) that isn't used/charged regularly. Simply put, you could have a Samsung phone that's been sitting in a drawer for some time (without having been charged). This device could then suddenly start expanding and might eventually start looking like it was split in half due to a bloated battery. At this point, the cell would be expanding further and further until it's taken care of or... not (which could lead to an explosion or/and a fire). Popular YouTuber Arun did a video on this late last month and has corroborated his account with several other people.
Wireless Networking

Lufthansa Says Passengers Can't Use Apple AirTags to Track Checked Bags (nytimes.com) 72

UPDATE: Lufthansa has since reversed their position, and now says Apple AirTags "are allowed on Lufthansa flights, according to SFGate. But only after their earlier remarks stirred up a lot of consternation.

Slashdot's original story appears below:


Citing rules issued by the International Civil Aviation Organization (ICAO), German airliner Lufthansa says it is banning activated Apple AirTags from luggage "as they are classified as dangerous and need to be turned off." Slashdot reader AmiMoJo first shared the news with us. The New York Times reports: Lufthansa, a German airline, set off confusion recently after telling passengers that they could not use trackers like Apple AirTags in checked baggage because of international guidelines for personal electronic devices. Apple rejected that interpretation on Tuesday, saying its trackers comply with all regulations. It does not appear that any other airlines are requiring passengers to turn off the trackers, which have become popular as a way to find lost baggage.

Lufthansa found itself in the middle of the issue when reports surfaced in the German news media that the devices were prohibited. Though Lufthansa said it has no desire to prohibit the devices that it deemed safe, the airline seems to have stepped in a mess based on the reading of obscure international guidelines and regulations, with no clear consensus on what is and is not allowed in Europe.

Lufthansa said on Sunday on Twitter that the trackers must be deactivated in checked baggage on its flights, citing the International Civil Aviation Organization's guidelines for dangerous goods as well as the trackers' "transmission function." Shutting off the trackers renders them useless. The airline has not issued a specific policy prohibiting baggage trackers. Rather, it says it is at the mercy of the rules. On Tuesday, the airline said it was "in close contact with the respective institutions to find a solution as quickly as possible." It also indicated its own examination saw no danger from their use.
"The Lufthansa Group has conducted its own risk assessment with the result that tracking devices with very low battery and transmission power in checked luggage do not pose a safety risk," said Martin Leutke, a Lufthansa spokesman. "We have never issued a ban on devices like that. It is on the authorities to adapt regulations that right now limit the use of these devices for airline passengers in checked luggage."

In its statement, Apple said that AirTags are "compliant with international airline travel safety regulations for carry-on and checked baggage."
NASA

NASA Says Dart Mission Succeeded In Shifting Asteroid's Orbit (theguardian.com) 77

An anonymous reader quotes a report from the Guardian: A spacecraft that plowed into a small, harmless asteroid millions of miles from Earth succeeded in shifting the orbit of the space rock, Nasa said on Tuesday, announcing the results of its first such test. The US space agency strategically launched the Double Asteroid Redirection Test ("Dart") spacecraft into the path of the asteroid, thereby throwing it off course. Nasa hopes to be able to deflect any asteroid or comet that comes to pose a real threat to Earth.

Dart altered the orbit of the Dimorphos asteroid by 32 minutes. Glaze said the minimum requirement for changing the orbital period was "really only 73 seconds." Last year, in a test that cost $325 million, another Dart spacecraft, roughly the size of a vending machine, was destroyed when it slammed into an asteroid 7m miles away, at 14,000mph.
In a tweet, the vice-president, Kamala Harris, said: "Congratulations to the team at Nasa for successfully altering the orbit of an asteroid. The Dart mission marks the first time humans have changed the motion of a celestial body in space, demonstrating technology that could one day be used to protect Earth."

The scientist and educator Bill Nye said: "We're celebrating ... because a mission like this could save the world."

The Nasa administrator, the former astronaut and Democratic Florida senator Bill Nelson, said: "We showed the world that Nasa is serious as a defender of this planet."

Lori Glaze, director of Nasa's planetary division, said: "Let's all just take a moment to soak this in. We're all here this afternoon because for the first time ever, humanity has changed the orbit of a planetary body."
Communications

Starlink Makes Maiden Asia Foray With Japan Launch (bloomberg.com) 14

Starlink has debuted in Japan, making it the first Asian nation to receive SpaceX's satellite internet service. From a report: Much of the country's north, including Tokyo, can now receive Starlink's signals, according to a map the startup shared on Twitter. Other areas including southern Japan and Hokkaido are expected to receive the service by the fourth quarter, before neighboring South Korea early next year.
Space

Stoke Space Aims To Build Rapidly Reusable Rocket With a Completely Novel Design (arstechnica.com) 62

Andy Lapsa and Tom Feldman, former Blue Origin engineers and the founders of Stoke Space, are working to develop the first fully recyclable space rocket -- one that features a reusable first and second stage. Here's an excerpt from Ars Technica's exclusive report, written by Eric Berger: In the 20 months since its initial seed round of funding, Stoke has built a second-stage engine, a prototype for the second stage, turbopumps, and manufacturing facilities. It also increased its headcount to 72 people and finalized the overall design for the rocket, which has a lift capacity of 1.65 metric tons to low-Earth orbit, in fully reusable mode. Last month, the company started to test-fire its upper-stage engines at a facility in Moses Lake, Washington. The images and video show an intriguing-looking ring with 15 discrete thrusters firing for several seconds. The circular structure is 13 feet in diameter, and this novel-looking design is Stoke's answer to one of the biggest challenges of getting a second stage back from orbit.

Most commonly, a traditional rocket has an upper stage with a single engine. This second-stage rocket engine has a larger nozzle -- often bell-shaped -- to optimize the flow of engine exhaust in a vacuum. Because all parts of a rocket are designed to be as light as possible, such extended nozzles are often fairly fragile because they're only exposed above Earth's atmosphere. So one problem with getting an upper stage back from Earth, especially if you want to use the engine to control and slow its descent, is protecting this large nozzle. One way to do that is to bury the engine nozzle in a large heat shield, but that would require more structure and mass, and it may not be dynamically stable. Stoke's answer was using a ring of 30 smaller thrusters. (The tests last month only employed 15 of the 30 thrusters). In a vacuum, the plumes from these nozzles are designed to merge and act as one. And during reentry, with a smaller number of smaller thrusters firing, it's easier to protect the nozzles. "What you're seeing in the photos of the test is a high-performance upper-stage engine that can operate within atmosphere at deep throttle to support vertical landing but then also perform at a higher ISP than some variants of the RL 10 engine in space," Lapsa said.

Another significant second-stage problem is protecting the whole vehicle from the super-heated atmosphere during reentry. NASA's Space Shuttle accomplished this with brittle thermal tiles, but these required 30,000 employee hours to inspect, test, and refurbish between flights. SpaceX is using a different type of ceramic tile, designed to be more reusable, for Starship. Given Stoke's background in rocket engines, Lapsa said it made the most sense to try a regeneratively cooled heat shield. The vehicle's ductile metallic outer layer will be lined with small cavities to flow propellant through the material to keep it cool during reentry. The second stage, therefore, will return to Earth somewhat like a space capsule -- base first, with the regeneratively cooled heat shield.

Stoke Space has a very long road ahead of it to reach space. Engine tests are an important step, but they're only the first step of many. Next up for the company is "hop" tests with a full-scale version of the second stage at the Moses Lake facility in central Washington. This prototype won't have a fairing as it would during launch, but it will still stand 19 feet tall. Initially, the tests will be low-altitude, probably measured in hundreds of feet. If there's an engineering need to go higher, the company will consider that, Lapsa said. But for now, the goal is to prove the capability to control the rocket during ascent and descent and make a soft landing. This is a shockingly difficult guidance, navigation, and control problem, especially with a novel system of distributed thrusters. "This is kind of a final proof point of this architecture," Lapsa said. "It is new. It's different. It's weird. It's original. There were a lot of questions that we had about how this thing is going to work. But we've already mitigated a lot of risk." If Stoke can manage to land the upper stage, it can move ahead with the first stage and start to turn the yet-unnamed rocket into an orbital vehicle. It sounds easy, but it's not...

First Person Shooters (Games)

Doom Runs At 60 FPS In Notepad (tomshardware.com) 52

Game developer Sam Chiet has found another use for Microsoft Notepad. The ingenious creator has gotten Doom (1993) to run at 60 FPS through the boring text editor in Windows. Tom's Hardware reports: Chiet highlighted that he didn't have to modify the Notepad application. Dubbed "NotepadDOOM," the project is fully playable. Although Chiet didn't explain how the mod works, has committed to launching NotepadDOOM for other Doom fans to try out. Chiet said in a subsequent tweet that "it'll take some work to polish NotepadDOOM into something releasable, but it'll almost certainly happen over the next couple days." John Romero, one of Doom's creators, was impressed and replied to Chiet in a tweet that the mod was "incredible."

You can see the iconic 1993 shooter running in its full glory on Chiet's YouTube channel. It's Notepad, so obviously, Chiet replaced the graphics with characters and numbers. The gameplay looks pretty smooth, although we did catch some screen tearing. However, that could be because Notepad can't write the text fast enough on screen.

Windows

Windows 95 Went the Extra Mile To Ensure Compatibility of SimCity, Other Games (arstechnica.com) 77

An anonymous reader quotes a report from Ars Technica: It's still possible to learn a lot of interesting things about old operating systems. Sometimes, those things are already documented (on a blog post) that miraculously still exist. One such quirk showed up recently when someone noticed how Microsoft made sure that SimCity and other popular apps worked on Windows 95. A recent tweet by @Kalyoshika highlights an excerpt from a blog post by Fog Creek Software co-founder, Stack Overflow co-creator, and longtime software blogger Joel Spolsky. The larger post is about chicken-and-egg OS/software appeal and demand. The part that caught the eye of a Hardcore Gaming 101 podcast co-host is how the Windows 3.1 version of SimCity worked on the Windows 95 system. Windows 95 merged MS-DOS and Windows apps, upgraded APIs from 16 to 32-bit, and was hyper-marketed. A popular app like SimCity, which sold more than 5 million copies, needed to work without a hitch.

Spolsky's post summarizes how SimCity became Windows 95-ready, as he heard it, without input from Maxis or user workarounds: "Jon Ross, who wrote the original version of SimCity for Windows 3.x, told me that he accidentally left a bug in SimCity where he read memory that he had just freed. Yep. It worked fine on Windows 3.x, because the memory never went anywhere. Here's the amazing part: On beta versions of Windows 95, SimCity wasn't working in testing. Microsoft tracked down the bug and added specific code to Windows 95 that looks for SimCity. If it finds SimCity running, it runs the memory allocator in a special mode that doesn't free memory right away. That's the kind of obsession with backward compatibility that made people willing to upgrade to Windows 95."

Spolsky (in 2000) considers this a credit to Microsoft and an example of how to break the chicken-and-egg problem: "provide a backwards compatibility mode which either delivers a truckload of chickens, or a truckload of eggs, depending on how you look at it, and sit back and rake in the bucks." Windows developers may have deserved some sit-back time, seeing the extent of the tweaks they often have to make for individual games and apps in Windows 95. Further in @Kalyoshika's replies, you can find another example, pulled from the Compatibility Administrator in Windows' Assessment and Deployment Kit (ADK). A screenshot from @code_and_beer shows how Windows NT, upon detecting files typically installed with Final Fantasy VII, will implement a fittingly titled compatibility fix: "Win95VersionLie." Simply telling the game that it's on Windows 95 seems to fix a major issue with its operation, along with a few other emulation and virtualization tweaks.
"Mike Perry, former creative director at Sim empire Maxis (and later EA), noted later that there was, technically, a 32-bit Windows 95 version of Sim City available, as shown by the 'Deluxe Edition' bundle of the game," adds Ars. "He also states that Ross worked for Microsoft after leaving Maxis, which would further explain why Microsoft was so keen to ensure people could keep building parks in the perfect grid position to improve resident happiness."
Education

A Minecraft Player Set Out To Build the Known Universe, Block by Block (nytimes.com) 29

Christopher Slayton spent two months exploring black holes, identifying the colors of Saturn's rings and looking at his home planet from outer space. Mr. Slayton, 18, didn't have to leave his desk to do so. He set out to build the entire observable universe, block by block, in Minecraft, a video game where users build and explore worlds. From a report: By the end, he felt as if he had traveled to every corner of the universe. "Everyone freaks out about the power and expansiveness of the universe, which I never really got that much," he said. But after working for a month and 15 days to build it and additional two weeks to create a YouTube video unveiling it, "I realized even more how beautiful it is." Mr. Slayton, known as ChrisDaCow on his Minecraft-focused YouTube, Reddit, Twitter, Instagram and TikTok accounts, has been playing the game for almost a decade, and he's not a user of any other games, he said. He started posting videos of his "builds," which are landscapes he creates inside the game, on YouTube in 2019. This channel has become his main priority since he graduated high school this spring.

[...] Exploring and learning concepts via Minecraft can be seen as a generational shift, said Ken Thompson, an assistant professor of digital game design at the University of Connecticut. About two-thirds of Americans play video games, according to a 2022 industry report. Professor Thompson said young people, such as Mr. Slayton, could apply problem solving and critical thinking when tackling projects such as the universe creation. "There are very serious applications," he said, adding, "then there's also this wonderful science side of it where we're experimenting with systems that are otherwise really hard to conceptualize." In 2022, some students at his university held a commencement ceremony in Minecraft, organized by the gaming club, after the in-person event was canceled because of the coronavirus pandemic. They created the campus and avatars representing students and even faculty to stage the virtual gathering.

Intel

Intel Confirms Alder Lake BIOS Source Code Leaked (tomshardware.com) 61

Tom's Hardware reports: We recently broke the news that Intel's Alder Lake BIOS source code had been leaked to 4chan and Github, with the 6GB file containing tools and code for building and optimizing BIOS/UEFI images. We reported the leak within hours of the initial occurrence, so we didn't yet have confirmation from Intel that the leak was genuine. Intel has now issued a statement to Tom's Hardware confirming the incident:

"Our proprietary UEFI code appears to have been leaked by a third party. We do not believe this exposes any new security vulnerabilities as we do not rely on obfuscation of information as a security measure. This code is covered under our bug bounty program within the Project Circuit Breaker campaign, and we encourage any researchers who may identify potential vulnerabilities to bring them our attention through this program...."


The BIOS/UEFI of a computer initializes the hardware before the operating system has loaded, so among its many responsibilities, is establishing connections to certain security mechanisms, like the TPM (Trusted Platform Module). Now that the BIOS/UEFI code is in the wild and Intel has confirmed it as legitimate, both nefarious actors and security researchers alike will undoubtedly probe it to search for potential backdoors and security vulnerabilities....

Intel hasn't confirmed who leaked the code or where and how it was exfiltrated. However, we do know that the GitHub repository, now taken down but already replicated widely, was created by an apparent LC Future Center employee, a China-based ODM that manufactures laptops for several OEMs, including Lenovo.

Thanks to Slashdot reader Hmmmmmm for sharing the news.
Iphone

The iPhone 14's 'Crash Detection' Keeps Calling 911 on Rollercoasters (theverge.com) 126

"The iPhone 14's new Crash Detection feature, which is supposed to alert authorities when it detects you've been in a car accident, has an unexpected side effect," reports the Verge.

"It dials 911 on rollercoasters." According to a report from The Wall Street Journal, the feature has had law enforcement sent to amusement parks on numerous occasions after mistaking a thrill ride's twists, turns, and hard braking for a real emergency....

If the sensors detect that you've been in an accident, your iPhone will display an alert and call emergency services if you don't dismiss it within 20 seconds. When it calls law enforcement, it will play an audio message that alerts authorities you've been in a crash, and also provides them with your location....

[WSJ reporter Joanna Stern] says Warren County, where Kings Island is located, received six emergency calls triggered by park rides since the iPhone 14's release. She also points out that other users have experienced similar issues in amusement parks across the country.

"My time on the crash-detection beat has proven that the feature can absolutely save a life," Stern acknowledged on Twitter. "There's already proof of it helping in real crashes. But there are situations where it works and it shouldn't and others where it doesn't work and it should.

"Such is the story of technology!"

Thanks to long-time Slashdot reader schwit1 for sharing the story.
Classic Games (Games)

Alleged Poker-Cheating Scandal Gets Weirder: Employee Stole $15,000 In Chips (nypost.com) 66

An experienced poker player lost to a relative newcomer. But then, "Somehow, the Robbi Jade Lew-Garrett Adelstein scandal diving the poker world just got weirder," reports the New York Post: An internal investigation conducted by Hustler Casino Live — which streamed the game from Los Angeles — has shown that one of their High Stakes Poker Productions employees stole three $5,000 chips from Lew's stack after the broadcast concluded on September 29. The employee, Bryan Sagbigsal, was terminated from his position after he admitted to taking $15,000 in chips from Lew's stack...

The $15,000 worth of chips taken by Sagbigsal was seen as some as him taking his cut of a cheating scam.

"There is zero evidence that I cheated," Lew posted on Twitter, "simply because I did not. I have been thrust into a bizarre situation where I am being asked to prove my innocence continually, and as of yet, there is not a single thread of direct evidence illustrating my guilt. My accusers, now having exhausted buzzing seats, camera rings, microphone water bottles, and other spy paraphernalia, have now moved on to me having an alleged conspiring relationship with someone I do not know... who, in fact, stole from me."

As a precaution the casino's technology and security protocols are now being audited — but the publicity seems good for business. Hustler Casino Live is now calling the hand "The most insane hero call in poker history," and it's already racked up over half a million views on YouTube.

Here's what I see. (Am I missing something?)

After three of the five "community" cards were dealt face up, Garrett Adelstein had four of the five cards needed for a straight flush — leaving nine clubs in the deck left to draw for a flush, and an additional six that would've at least given him a straight. But with no help from the fourth "community" card, Garrett had just a 53% chance of winning. He bet $10,000, but instead of backing down Robbi raised him by $10,000. Garrett then tried an even larger bet, daring Robbi to go all-in with her $109,000 in chips — or fold. Did she sense that this suddenly-higher bet was a bluff? With nothing but a high-card jack, Robbi refused to fold — and won the hand when the fifth card failed to help either her or Garrett.
Encryption

VPN, Tor Use Increases in Iran After Internet 'Curfews' (cnbc.com) 22

Iran's government is trying to limit internet access, reports CNBC — while Iranians are trying a variety of technologies to bypass the blocks: Outages first started hitting Iran's telecommunications networks on September 19, according to data from internet monitoring companies Cloudflare and NetBlocks, and have been ongoing for the last two and a half weeks. Internet monitoring groups and digital rights activists say they're seeing "curfew-style" network disruptions every day, with access being throttled from around 4 p.m. local time until well into the night. Tehran blocked access to WhatsApp and Instagram, two of the last remaining uncensored social media services in Iran. Twitter, Facebook, YouTube and several other platforms have been banned for years.

As a result, Iranians have flocked to VPNs, services that encrypt and reroute their traffic to a remote server elsewhere in the world to conceal their online activity. This has allowed them to restore connections to restricted websites and apps. On September 22, a day after WhatsApp and Instagram were banned, demand for VPN services skyrocketed 2,164% compared to the 28 days prior, according to figures from Top10VPN, a VPN reviews and research site. By September 26, demand peaked at 3,082% above average, and it has continued to remain high since, at 1,991% above normal levels, Top10VPN said....

Mahsa Alimardani, a researcher at free speech campaign group Article 19, said a contact she's been communicating with in Iran showed his network failing to connect to Google, despite having installed a VPN. "This is new refined deep packet inspection technology that they've developed to make the network extremely unreliable," she said. Such technology allows internet service providers and governments to monitor and block data on a network. Authorities are being much more aggressive in seeking to thwart new VPN connections, she added....

VPNs aren't the only techniques citizens can use to circumvent internet censorship. Volunteers are setting up so-called Snowflake proxy servers, or "proxies," on their browsers to allow Iranians access to Tor — software that routes traffic through a "relay" network around the world to obfuscate their activity.

Earth

Why Hurricane Ian Killed So Many People (cnn.com) 174

It was Florida's deadliest hurricane in 87 years, tied for the fifth-strongest hurricane to make landfall in the continental U.S. and killing more than 100 people after veering south into unexpected areas.

But a Rutgers University health psychologist suggests other factors might've made Hurricane Ian more deadly: Ian also underwent rapid intensification, perhaps influenced by climate change, which meant that its wind speeds increased dramatically as it passed over the warm waters of the Gulf of Mexico before landfall.

Emergency managers typically need at least 48 hours to successfully evacuate areas of southwest Florida. However, voluntary evacuation orders for Lee County were issued less than 48 hours prior to landfall, and for some areas were made mandatory just 24 hours before the storm came ashore. This was less than the amount of time outlined in Lee County's own emergency management plan.

While the lack of sufficient time to evacuate was cited by some as a reason why they stayed behind, there are other factors that may also have suppressed evacuations in some of the hardest hit areas. In order to correctly follow evacuation orders, people need to first know their evacuation zone. Research from other areas of the country indicates that many people don't. That's why the evacuation zone locator websites in the affected counties were crucial. However, so many people were checking their zones that some of these websites crashed in the days before the storm.

The article asks whether the early voluntary evacuation order "lulled some residents into being less concerned" and ultimately compounded problems. "In areas where evacuation orders were issued later, people who weren't expecting to evacuate needed to find and understand this evacuation zone information quickly...."

"People need to know that they are in an area being asked to evacuate — and waiting until the storm is on its way to find out their zone may be too late. Emergency managers need to educate people in advance of imminent storms while also developing more robust websites to handle the queries in the days before the storm."
Television

After 23 Years, Weather Channel's Iconic Computerized Channel Is Shutting Down (arstechnica.com) 10

An anonymous reader quotes a report from Ars Technica: In the early 2000s, Americans who wanted to catch the local weather forecast at any time might turn on their TV and switch over to Weatherscan, a 24-hour computer-controlled weather forecast channel with a relaxing smooth jazz soundtrack. After 23 years, The Weather Channel announced that Weatherscan will be shutting down permanently on or before December 9. But a group of die-hard fans will not let it go quietly into the night.

Launched in 1999, Weatherscan currently appears in a dwindling number of local American cable TV and satellite markets. It shows automated local weather information on a loop, generated by an Intellistar computer system installed locally for each market. Declining viewership and the ubiquity of smartphone weather apps are the primary reasons it's going offline. There are also technical issues with maintaining the hardware behind the service. "Weatherscan has been dying a slow death over the course of the last 10 years because the hardware is aging," says Mike Bates, a tech hobbyist who collects and restores Weather Channel computer hardware as part of a group of die-hard fans who follow insider news from the company. "It's 20 years old now, and more and more cable companies have been pulling the service." [...]

Hobbyists like Bates (who goes by "techknight" on Twitter) have collected the hardware necessary to run their own Weatherscan stations out of their homes. Some have also created software that simulates the service in a browser. [...] However, getting Weatherscan to run locally was a team effort, primarily by friends named Ethan, Brian, and Jesse. One of the Intellistar computer models behind the service runs FreeBSD on a Pentium 4-based PC in a blue rack-mount enclosure. It includes an ATI card for generating the graphics and a proprietary PowerPC-based card that pulls it all together to make it broadcast-ready. To get Weatherscan working at home, the group of friends found decommissioned Intellistar units on eBay and used forensic tools to reconstruct data from the hard drives, piecing together a working version of the Weatherscan software from multiple sources. Since then, they have exhibited their work at shows like the Vintage Computer Festival Midwest last month.

Twitter

Twitter Knows You Took a Screenshot, Asks You To Share Instead (arstechnica.com) 54

An anonymous reader quotes a report from Ars Technica: Twitter is seemingly working to remind people that interesting tweets are something you should click, load, and view while logged into the company's ad-funded service, not merely see in a screenshot. That's why some users are seeing a "Share Tweet?" pop-up whenever the Twitter app notices them taking a screenshot. Social media analyst Matt Navarra noted the two kinds of nudge prompts in a tweet: "Copy link" and "Share Tweet." TechCrunch noted that some of its staff members were receiving the prompt and pointed to another tweet in which Twitter provided both "Copy link" and "Share Tweet" buttons.

Twitter makes money when people visit the site in a browser or load it in Twitter's official apps, then see sponsored tweets or pre-roll advertisements on native videos (users can also sign up for a Twitter Blue subscription). Screenshots, whether shared directly or on competing social platforms, don't create revenue. Engaging with Twitter itself could encourage people to sign up and do more of that. Twitter reported 237.8 million "average monetizable daily active usage" in Q2 2022, up 16.6 percent compared to the same quarter in 2021. The company claims this increase was driven by "ongoing product improvements" and "global conversation around current events." It makes sense why Twitter, the corporate entity, prefers tweet links to screenshots, enough so to A/B/C test a prompt that can make users feel like the Twitter app is both closely watching and scolding them. But for Twitter, the cultural entity, screenshots are enormously valuable, likely more so than links alone. If you've been engaging in Internet culture for years, you've seen why.

Slashdot Top Deals