Windows

Microsoft is Killing off Windows 11's Mail and Calendar Apps By the End of the Year (theverge.com) 81

Microsoft is planning to no longer support the Windows Mail, Calendar, and People apps later this year. The Verge: The software giant has been moving existing users of these apps over to the new Outlook for Windows app in recent months, and now it has set an end of support date for the Mail, Calendar, and People apps of December 31st.

Once the apps reach end of support later this year, Microsoft warns that users who haven't moved to the new Outlook app "will no longer be able to send and receive email using Windows Mail and Calendar."

Microsoft has been rolling out the new Outlook for Windows app for years, with it officially reaching the general availability stage in August. The new web-based Outlook is designed to eventually replace the full desktop version of Outlook too, and Microsoft plans to provide enterprise customers a 12-month notice before it starts to move people away from the desktop version of Outlook.

AI

ChatGPT's Monthly Usage May Now Rival Google Chrome (digitaltrends.com) 54

An anonymous reader shared this report from Digital Trends: A number of popular generative AI platforms are seeing consistent growth as users are figuring out how they want to use the tools - and ChatGPT is at the top of the list with the most visits, at 3.7 billion worldwide. So many people are visiting the AI chatbot, its figures are rivaling browser market share. It can only be compared to Google Chrome figures in terms of monthly users, which is estimated to be around 3.45 billion.

Statistics from [web analytics company] Similarweb indicate that ChatGPT saw a 17.2% month-over-month (MoM) growth and a 115.9% year-over-year (YoY) traffic growth... Google's Chrome browser has a solid market share of 35.4 billion users in 2024. It has seen minimal growth YoY but has grown 45.35% in the last 5 years, according to Statscounter.

The article notes ChatGPT saw a jump in traffic when it changed its dowmain from chat.openai.com to just chatgpt.com -- and that OpenAI recently purchased the domain Chat.com (though "there is no word on what the company plans to do...") Meanwhile, other AI tools continue to see traffic and growth, despite not being at the same level as ChatGPT. Despite recent plagiarism claims, the Perplexity chatbot has seen 90.8 million visits in October, a 25.5% MoM growth and 199.2% YoY growth. Google's Gemini Chatbot saw 291.6 million visits in October, a 6.2% MoM growth and 19% YoY growth after the company introduced a new ChromeOS update that brought new AI features to its Chromebooks. Anthropic's Claude chatbot has seen 84.1 million visits in October, a 25.5% MoM growth and 394.9% YoY growth, after recently rolling out a desktop application for Windows and macOS. Microsoft's web-based Copilot website saw 69.4 million visits in October, an 87.6% MoM growth.
Firefox

20 Years Ago Today: 'Firefox Browser Takes on Microsoft' (archive.org) 50

A 2002 Slashdot post informed the world that "Recently Blake Ross, a developer of the Phoenix web browser, has made a post on the Mozillazine forums looking for a new name for the project. Apparently the people over at Phoenix Technologies decided that the name interferes with their trademark since they make an 'internet access device'..."

And then, on November 9 of 2004, the BBC reported that "Microsoft's Internet Explorer has a serious rival in the long-awaited Firefox 1.0 web browser, which has just been released." Their headline? "Firefox Browser Takes on Microsoft." Fans of the software have banded together to raise cash to pay for an advert in the New York Times announcing that version 1.0 of the browser is available. ["Are you fed up with your browser? You're not alone...."] The release of Firefox 1.0 on 9 November might even cause a few heads to turn at Microsoft because the program is steadily winning people away from the software giant's Internet Explorer browser.

Firefox has been created by the Mozilla Foundation which was started by former browser maker Netscape back in 1998... Earlier incarnations, but which had the same core technology, were called Phoenix and Firebird. Since then the software has been gaining praise and converts, not least because of the large number of security problems that have come to light in Microsoft's Internet Explorer. Rivals to IE got a boost in late June when two US computer security organisations warned people to avoid the Microsoft program to avoid falling victim to a serious vulnerability.

Internet monitoring firm WebSideStory has charted the growing population of people using the Firefox browser and says it is responsible for slowly eroding the stranglehold of IE. Before July this year, according to WebSideStory, Internet Explorer was used by about 95% of web surfers. That figure had remained static for years. In July the IE using population dropped to 94.7% and by the end of October stood at 92.9%. The Mozilla Foundation claims that Firefox has been downloaded almost eight million times and has publicly said it would be happy to garner 10% of the Windows- using, net-browsing population.

Firefox is proving popular because, at the moment, it has far fewer security holes than Internet Explorer and has some innovations lacking in Microsoft's program. For instance, Firefox allows the pages of different websites to be arranged as tabs so users can switch easily between them. It blocks pop-ups, has a neat way of finding text on a page and lets you search through the pages you have browsed...

Firefox celebrated its 20th anniversary with a special video touting new and upcoming features like tab previews, marking up PDFs, and tab grouping.

And upgrading to the latest version of Firefox now displays this message on a "What's New" page. "Whether you just downloaded Firefox or have been with us since the beginning, you are a vital part of helping us make the internet a better place.

"We can't wait to show you what's coming next." ("Check out our special edition wallpapers — open a new tab and click the gear icon at the top right corner...")
United States

Forty-Three Monkeys Escape From US Research Lab (bbc.com) 138

An anonymous reader quotes a report from the BBC: Police are on the hunt for 43 monkeys who escaped from a research facility in South Carolina, after a keeper left their pen open. The rhesus macaque fugitives broke out of Alpha Genesis, a company that breeds primates for medical testing and research, and are on the loose in a part of the state known as the Lowcountry. Authorities have urged residents to keep their doors and windows securely closed and to report any sightings immediately. The escaped monkeys are young females, weighing about 7lbs (3.2kg) each, according to the Yemassee Police Department. Police said on Thursday that the company had located the "skittish" group, and "are working to entice them with food."

"Please do not attempt to approach these animals under any circumstances," police said. The statement added that traps had been set in the area, and police were on-site "utilizing thermal-imaging cameras in an attempt to locate the animals". Police say the research company has told them that because of their size, the monkeys have not yet been tested on and "are too young to carry disease."
In an update Friday, the local police department said the monkeys are still staying around the perimeter of the facility. "The primates are exhibiting calm and playful behavior, which is a positive indication," the department noted.

"They're just being goofy monkeys jumping back and forth playing with each other," Alpha Genesis CEO Greg Westergaard told CBS News Thursday. "It's kind of like a playground situation here."

The article points out that all the escaped monkeys "carry no contagious viruses because they were too young to test, according to the lab. "
AI

Even Microsoft Notepad Is Getting AI Text Editing Now 78

Microsoft is introducing a feature to Notepad called Rewrite that will let you use AI to "rephrase sentences, adjust tone, and modify the length of your content." The Verge reports: If you're a Windows Insider with early access to the feature, you can try it by highlighting the text you want to adjust in Notepad, right-clicking it, and choosing Rewrite. Notepad will then display a dialogue box where you can decide how they want to change their text -- for example, if it needs to be longer or shorter. Rewrite will then offer three rewritten versions that you can replace your work with.

It's worth noting that you'll have to sign in to your Microsoft account to use Rewrite, as it's "powered by a cloud-based service that requires authentication and authorization." Microsoft is launching this feature in preview on Windows 11 in the US, France, UK, Canada, Italy, and Germany.
In July, Microsoft rolled out spellcheck and autocorrect for Notepad.
Operating Systems

Sysadmin Shock As Windows Server 2025 Installs Itself After Update Labeling Error (theregister.com) 86

A security update mislabeling by Microsoft led to Windows Server 2022 systems unexpectedly upgrading to Windows Server 2025, impacting 7 percent of Heimdal customers and leaving administrators scrambling to manage unexpected licensing and configuration challenges. The Register reports: It took Heimdal a while to trace the problem. According to a post on Reddit: "Due to the limited initial footprint, identifying the root cause took some time. By 18:05 UTC, we traced the issue to the Windows Update API, where Microsoft had mistakenly labeled the Windows Server 2025 upgrade as KB5044284." It added: "Our team discovered this discrepancy in our patching repository, as the GUID for the Windows Server 2025 upgrade does not match the usual entries for KB5044284 associated with Windows 11. This appears to be an error on Microsoft's side, affecting both the speed of release and the classification of the update. After cross-checking with Microsoft's KB repository, we confirmed that the KB number indeed references Windows 11, not Windows Server 2025."

As of last night, Heimdal estimated that the unexpected upgrade had affected 7 percent of customers -- it said it had blocked KB5044284 across all server group policies. However, this is of little comfort to administrators finding themselves receiving an unexpected upgrade. Since rolling back to the previous configuration will present a challenge, affected users will be faced with finding out just how effective their backup strategy is or paying for the required license and dealing with all the changes that come with Windows Server 2025.

Windows

Windows 11 Continues To Creep Up Behind Windows 10 (theregister.com) 69

An anonymous reader shares a report: With Windows 11 still failing to set the world alight, campaigners are warning that millions of perfectly good PCs could become landfill fodder when support for Windows 10 runs out in eleven and a bit months.

Figures compiled by StatCounter show that Windows 11 commanded a 35.55 percent share of the desktop Windows market in October. In comparison, the share of Windows 10 dropped to 60.97 percent, continuing a downward trend that began earlier this year -- it was still at 69.9 percent in April. Unless there is some marked acceleration, Windows 11 is unlikely to dominate the market by the time Microsoft pulls the plug on free updates for most of the Windows 10 world on October 14, 2025.

Power

The 'Passive Housing' Trend is Booming (yahoo.com) 145

The Washington Post reports that a former Etsy CEO remodeled their home into what's known as a passive house. It's "designed to be as energy efficient as possible, typically with top-notch insulation and a perfect seal that prevents outside air from penetrating the home; air flows in and out through filtration and exhaust systems only."

Their benefits include protection from pollution and pollen, noise insulation and a stable indoor temperature that minimizes energy needs. That translates to long-term savings on heating and cooling.

While the concept has been around for about 50 years, experts say that the United States is on the cusp of a passive house boom, driven by lowered costs, state-level energy code changes and a general greater awareness of — and desire for — more sustainable housing... Massachusetts — which alongside New York and Pennsylvania is one of the leading states in passive house adoption — has 272 passive house projects underway thanks to an incentive program, says Zack Semke [the director of the Passive House Accelerator, a group of industry professionals who aim to spread lessons in passive house building]. Consumer demand for passive houses is also increasing, says Michael Ingui, an architect in New York City and the founder of the Passive House Accelerator... The need to lower our energy footprint is so much more top-of-mind today than it was 10 years ago, Ingui says, and covid taught us about the importance of good ventilation and filtered fresh air. "People are searching for the healthiest house," he says, "and that's a passive house...."

These days, new passive houses are usually large, multifamily apartment buildings or high-end single-family homes. But that leaves out a large swath of homeowners in the middle. To widen passive house accessibility to include all types of people and their housing needs, we need better energy codes and even more policies and incentives, says In Cho, a sustainability architect, educator and a co-founder of the nonprofit Passive House for Everyone! Passive houses "can and should serve folks from all socioeconomic backgrounds," she says. Using a one-two punch of mandates for energy efficient buildings and greater awareness to the public, that increased demand for passive houses will lead to more supply, Cho says. And we're already seeing those changes in the market.

Take triple-pane windows, for example, which are higher performing and more insulating than their double-pane counterparts. Even just 10 to 20 years ago, the difference in price between the two was high enough to make triple-pane windows cost-prohibitive for a lot of people, Cho says. Over the years, as the benefits of higher performing windows became more well-known, and as cities and states changed their energy codes, more companies began producing better windows. Now they're basically at price parity, she says. If we keep pushing for greater awareness and further policy changes, it's possible that all of the components of passive house buildings could follow that trend.

"For large multifamily projects, we're already seeing price parity in some cases, Semke says...

"But as it stands, single-family passive houses are still likely to cost a margin more than non-passive houses, he says. This is because price parity is easier to achieve when working at larger scales, but also because many of the housing policies and incentives encouraging passive house buildings are geared toward these larger projects."
Windows

Want To Keep Getting Windows 10 Updates? It'll Cost You $30 (pcworld.com) 95

With Windows 10 support set to expire on October 14, 2025, Microsoft is offering a one-time, one-year Extended Security Updates plan for consumers. "For $30, you'll receive 'critical' and 'important' security updates -- basically security patches that will continue to protect your Windows 10 PC from any vulnerabilities," reports PCWorld. "That $30 is for one year's worth of updates, and that's the only option at this time." From the report: Microsoft has been warning users for years that Windows 10 support will expire in 2025, specifically October 14, 2025. At that point, Windows 10 will officially fall out of support: there will be no more feature updates or security patches. On paper, that would mean that any Windows 10 PC will be at risk of any new vulnerabilities that researchers uncover.

Previously, Microsoft had quietly hinted that consumers would be offered the same ESU protections offered to businesses and enterprises, as it did in December 2023 and again in an "editor's note" shared in an April 2024 support post, in which the company said that "details will be shared at a later date for consumers." That time is now, apparently.

Back in December 2023, Microsoft offered the ESU on an annual basis to businesses for three years, one year at a time. The fees would double each year, charging businesses hundreds of dollars for the privilege. Consumers won't be offered the same deal, as a Microsoft representative said via email that it'll be a "one-time, one-year option for $30."

Microsoft

Microsoft Delays Recall Again (theverge.com) 47

Microsoft is once again delaying the roll out of its controversial Recall feature for Copilot Plus PCs. From a report: The software giant had planned to start testing Recall, which creates screenshots of mostly everything you see or do on a Copilot Plus PC, with Windows Insiders in October. Now, Microsoft says it needs more time to get the feature ready.

"We are committed to delivering a secure and trusted experience with Recall. To ensure we deliver on these important updates, we're taking additional time to refine the experience before previewing it with Windows Insiders," says Brandon LeBlanc, senior product manager of Windows, in a statement to The Verge. "Originally planned for October, Recall will now be available for preview with Windows Insiders on Copilot Plus PCs by December."

The Courts

Delta Sues CrowdStrike Over Software Update That Prompted Mass Flight Disruptions (reuters.com) 78

An anonymous reader quotes a report from Reuters: Delta Air Lines on Friday sued cybersecurity firm CrowdStrike in a Georgia state court after a global outage in July caused mass flight cancellations, disrupted travel plans of 1.3 million customers and cost the carrier more than $500 million. Delta's lawsuit filed in Fulton County Superior Court called the faulty software update from CrowdStrike "catastrophic" and said the firm "forced untested and faulty updates to its customers, causing more than 8.5 million Microsoft Windows-based computers around the world to crash." [...]

Delta, which has purchased CrowdStrike products since 2022, said the outage forced it to cancel 7,000 flights, impacting 1.3 million passengers over five days. "If CrowdStrike had tested the faulty update on even one computer before deployment, the computer would have crashed," Delta's lawsuit says. "Because the faulty update could not be removed remotely, CrowdStrike crippled Delta's business and created immense delays for Delta customers." Delta said that as part of its IT-planning and infrastructure, it has invested billions of dollars "in licensing and building some of the best technology solutions in the airline industry."

Graphics

Adobe Made Its Painting App Completely Free To Take On Procreate 27

Adobe's Fresco painting app is now free for everyone, in an attempt to lure illustrators to join its creative software suite. The Verge reports: Fresco is essentially Adobe's answer to apps like Procreate and Clip Studio Paint, which all provide a variety of tools for both digital art and simulating real-world materials like sketching pencils and watercolor paints. Adobe Fresco is designed for touch and stylus-supported devices, and is available on iPad, iPhone, and Windows PCs. The app already had a free-to-use tier, but premium features like access to the full Adobe Fonts library, a much wider brush selection, and the ability to import custom brushes previously required a $9.99 annual subscription. That's pretty affordable for an Adobe subscription, but still couldn't compete with Procreate's $12.99 one-time purchase model.

Starting today, all of Fresco's premium features are no longer locked behind a paywall. The app first launched in 2019 and isn't particularly well-known compared to more established Adobe apps like Photoshop and Illustrator that feature more complex, professional design tools. Fresco still has some interesting features of its own, like reflective and rotation symmetry (which mirror artwork as you draw) and the ability to quickly animate drawings with motion presets like "bounce" and "breathe."
Hardware

Qualcomm Brings Laptop-Class CPU Cores To Phones With Snapdragon 8 Elite (arstechnica.com) 26

An anonymous reader quotes a report from Ars Technica: Qualcomm has a new chip for flagship phones, and the best part is that it uses an improved version of the Oryon CPU architecture that the Snapdragon X Elite chips brought to Windows PCs earlier this year. The Snapdragon 8 Elite is the follow-up to last year's Snapdragon 8 Gen 3 -- yet another change to the naming convention that Qualcomm uses for its high-end phone chips, though, as usual, the number 8 is still involved. The 8 Elite uses a "brand-new, 2nd-generation Qualcomm Oryon CPU" with clock speeds up to 4.32 GHz, which Qualcomm says will improve performance by about 45 percent compared to the Snapdragon 8 Gen 3.

Rather than a mix of large, medium, and small CPU cores as it has used in the past, the 8 Elite has two "Prime" cores for hitting that high peak clock speed, while the other six are all "Performance" cores that peak at a lower 3.53 GHz. But it doesn't look like Qualcomm is using a mix of different CPU architectures anymore, choosing to distinguish the higher-performing core from the lower-performing ones by clock speed alone. Qualcomm promises a similar 40 percent performance boost from the new Adreno 830 GPU. The chip also includes a marginally improved Snapdragon X80 5G modem, up from an X75 modem in the Snapdragon 8 Gen 3 -- its main improvement appears to be support for additional antennas, for a total of six, but the download speed still tops out at a theoretical 10Gbps. Wi-Fi 7 support appears to be the same as in the 8 Gen 3, but the 8 Elite does support the Bluetooth 6.0 standard, up from Bluetooth 5.4 in the 8 Gen 3.

Qualcomm says the new chip's CPU features "44% improved power efficiency" and "40% greater power efficiency" for the GPU, which ought to keep power usage in line despite the performance improvements -- these gains are probably attributable to the new 3 nm TSMC manufacturing process, compared to the 4 nm process used for the Snapdragon 8 Gen 3. And no 2024 chip announcement would be complete without some kind of AI mention: Qualcomm's image signal processor is now an "AI ISP," which Qualcomm says "recognizes and enhances virtually anything in the frame, including faces, hair, clothing, objects, backgrounds, and beyond." These capabilities can allow it to remove objects from the background of photos, among other things, using the on-device processing power of the chip's Hexagon neural processing unit (NPU). The NPU is 45 percent faster than the one in the Snapdragon 8 Gen 3. Phones using the Snapdragon 8 Elite should begin appearing in "the coming weeks."

IT

Comic Sans Got the Last Laugh 57

On July 4, 2012, CERN physicist Fabiola Gianotti announced a major quantum field theory discovery using a PowerPoint presentation in Comic Sans, sparking both mockery and debate. The font, created by Vincent Connare for Microsoft Bob in 1994, featured deliberately imperfect letters inspired by comic books. Comic Sans shipped with Windows 95 and exploded in popularity as personal computing democratized typography. A backlash emerged as the font appeared on everything from funeral notices to museum signs, culminating in Dave and Holly Combs's "Ban Comic Sans" campaign.
ISS

NASA Further Delays First Operational Starliner Flight (spacenews.com) 33

NASA will rely on SpaceX's Crew Dragon for two crewed missions to the ISS in 2025 while evaluating whether Boeing's Starliner requires another test flight for certification. SpaceNews reports: In an Oct. 15 statement, NASA said it will use Crew Dragon for both the Crew-10 mission to the ISS, scheduled for no earlier than February 2025, and the Crew-11 mission scheduled for no earlier than July. Crew-10 will fly NASA astronauts Anne McClain and Nichole Ayers along with astronaut Takuya Onishi from the Japanese space agency JAXA and Roscosmos cosmonaut Kirill Peskov. NASA has not yet announced the crew for the Crew-11 mission.

Earlier this year, NASA had hoped that Boeing's CST-100 Starliner would be certified in time to fly the early 2025 mission. Problems with the Crew Flight Test mission, which launched in June with NASA astronauts Butch Wilmore and Suni Williams on board, led NASA to conclude in July that the spacecraft would not be certified in time. It delayed that Starliner-1 mission from February to August 2025, moving up Crew-10 to February. NASA also announced then that it would prepare Crew-11 in parallel with Starliner-1 for launch in that August 2025 slot.
"The timing and configuration of Starliner's next flight will be determined once a better understanding of Boeing's path to system certification is established," NASA said in its statement about the 2025 missions. "NASA is keeping options on the table for how best to achieve system certification, including windows of opportunity for a potential Starliner flight in 2025."
Businesses

Basecamp-Maker 37Signals Says Its 'Cloud Exit' Will Save It $10 Million Over 5 Years (arstechnica.com) 83

An anonymous reader quotes a report from Ars Technica: 37Signals is not a company that makes its policy or management decisions quietly. The productivity software company was an avowedly Mac-centric shop until Apple's move to kill home screen web apps (or Progressive Web Apps, or PWAs) led the firm and its very-public-facing co-founder, David Heinemeier Hansson, to declare a "Return to Windows," followed by a stew of Windows/Mac/Linux. The company waged a public battle with Apple over its App Store subscription policies, and the resulting outcry helped nudge Apple a bit. 37Signals has maintained an active blog for years, its co-founders and employees have written numerous business advice books, and its blog and social media posts regularly hit the front pages of Hacker News.

So when 37Signals decided to pull its seven cloud-based apps off Amazon Web Services in the fall of 2022, it didn't do so quietly or without details. Back then, Hansson described his firm as paying "an at times almost absurd premium" for defense against "wild swings or towering peaks in usage." In early 2023, Hansson wrote that 37Signals expected to save $7 million over five years by buying more than $600,000 worth of Dell server gear and hosting its own apps.

Late last week, Hansson had an update: it's more like $10 million (and, he told the BBC, more like $800,000 in gear). By squeezing more hardware into existing racks and power allowances, estimating seven years' life for that hardware, and eventually transferring its 10 petabytes of S3 storage into a dual-DC Pure Storage flash array, 37Signals expects to save money, run faster, and have more storage available. "The motto of the 2010s and early 2020s -- all-cloud, everything, all the time -- seems to finally have peaked," Hansson writes. "And thank heavens for that!" He adds the caveat that companies with "enormous fluctuations in load," and those in early or uncertain stages, still have a place in the cloud.

AMD

Chip Designers Recall the Big AMD-Intel Battle Over x86-64 Support (tomshardware.com) 47

Tom's Hardware reports on some interesting hardware history being shared on X.com: AMD engineer Phil Park identified a curious nugget of PC architectural history from, of all places, a year-old Quora answer posted by former Intel engineer [and Pentium Pro architect] Robert Colwell. The nugget indicates that Intel could have beaten AMD to the x86-64 punch if the former wasn't dead-set on the x64-only Itanium line of CPUs.
Colwell had responded on Quora to the question "Shouldn't Intel with its vast resources have been able to develop both architectures?" This was a marketing decision by Intel — they believed, probably rightly, that bringing out a new 64-bit feature in the x86 would be perceived as betting against their own native-64-bit Itanium, and might well severely damage Itanium's chances. I was told, not once, but twice, that if I "didn't stop yammering about the need to go 64-bits in x86 I'd be fired on the spot" and was directly ordered to take out that 64-bit stuff. I decided to split the difference, by leaving in the gates but fusing off the functionality. That way, if I was right about Itanium and what AMD would do, Intel could very quickly get back in the game with x86. As far as I'm concerned, that's exactly what did happen.
Phil Park continued the discussion on X.com. "He didn't quite get what he wanted, but he got close since they had x86-64 support in subsequent products when Intel made their comeback." (So, Park posted later in the thread, "I think he won the long game.")

Park also shared a post from Nicholas Wilt (NVIDIA CUDA designer who earlier did GPU computing work at Microsoft and built the prototype for Windows Desktop Manager): I have an x86-64 story of my own. I pressed a friend at AMD to develop an alternative to Itanium. "For all the talk about Wintel," I told him, "these companies bear no love for one another. If you guys developed a 64-bit extension of x86, Microsoft would support it...."

Interesting coda: When it became clear that x86-64 was beating Itanium in the market, Intel reportedly petitioned Microsoft to change the architecture and Microsoft told Intel to pound sand.

AMD

Spectre Flaws Still Haunt Intel, AMD as Researchers Found Fresh Attack Method (theregister.com) 33

"Six years after the Spectre transient execution processor design flaws were disclosed, efforts to patch the problem continue to fall short," writes the Register: Johannes Wikner and Kaveh Razavi of Swiss University ETH Zurich on Friday published details about a cross-process Spectre attack that derandomizes Address Space Layout Randomization and leaks the hash of the root password from the Set User ID (suid) process on recent Intel processors. The researchers claim they successfully conducted such an attack.... [Read their upcomong paper here.] The indirect branch predictor barrier (IBPB) was intended as a defense against Spectre v2 (CVE-2017-5715) attacks on x86 Intel and AMD chips. IBPB is designed to prevent forwarding of previously learned indirect branch target predictions for speculative execution. Evidently, the barrier wasn't implemented properly.

"We found a microcode bug in the recent Intel microarchitectures — like Golden Cove and Raptor Cove, found in the 12th, 13th and 14th generations of Intel Core processors, and the 5th and 6th generations of Xeon processors — which retains branch predictions such that they may still be used after IBPB should have invalidated them," explained Wikner. "Such post-barrier speculation allows an attacker to bypass security boundaries imposed by process contexts and virtual machines." Wikner and Razavi also managed to leak arbitrary kernel memory from an unprivileged process on AMD silicon built with its Zen 2 architecture.

Videos of the Intel and AMD attacks have been posted, with all the cinematic dynamism one might expect from command line interaction.

Intel chips — including Intel Core 12th, 13th, and 14th generation and Xeon 5th and 6th — may be vulnerable. On AMD Zen 1(+) and Zen 2 hardware, the issue potentially affects Linux users. The relevant details were disclosed in June 2024, but Intel and AMD found the problem independently. Intel fixed the issue in a microcode patch (INTEL-SA-00982) released in March, 2024. Nonetheless, some Intel hardware may not have received that microcode update. In their technical summary, Wikner and Razavi observe: "This microcode update was, however, not available in Ubuntu repositories at the time of writing this paper." It appears Ubuntu has subsequently dealt with the issue.

AMD issued its own advisory in November 2022, in security bulletin AMD-SB-1040. The firm notes that hypervisor and/or operating system vendors have work to do on their own mitigations. "Because AMD's issue was previously known and tracked under AMD-SB-1040, AMD considers the issue a software bug," the researchers explain. "We are currently working with the Linux kernel maintainers to merge our proposed software patch."

BleepingComputer adds that the ETH Zurich team "is working with Linux kernel maintainers to develop a patch for AMD processors, which will be available here when ready."
IT

DoNotPay Will Now Call Customer Service Hotlines For You (fastcompany.com) 20

An anonymous reader shares a report: If you dread the thought of calling to change an airline ticket or negotiate your internet bill, a new artificial intelligence tool may provide a solution. DoNotPay, which offers an assortment of consumer-friendly services like tracking subscriptions, generating burner phone numbers, and searching for unclaimed property, now features a bot that will call customer service numbers for users, navigate through phone menus and sit through hold music, then politely but firmly advocate on users' behalf.

The company shared examples of its AI calling a cellphone provider for help porting a phone number and talking with an airline to cancel a flight within the 24-hour cancellation window. Joshua Browder, CEO and founder of DoNotPay, says getting updates on lost luggage and seeking compensation for flight delays are also common use cases. DoNotPay already offered tools to connect to customer service agents via chat windows, and to draft and send emails, faxes, and even snail mail to companies on behalf of users.

But while the service's artificial intelligence had enough smarts to wait on hold for users, then hand over a call when an agent was available, until recently AI models were not capable of carrying on a convincing voice conversation with a human operator in real time. Browder says that changed with Open AI's GPT-4o model, unveiled in May. "That has reduced the delay by about 70%, so instead of it taking three seconds to come up with a response, it now takes under a second, and that's finally fast enough to hold these phone conversations," he says. "So now we're doing thousands of these calls."

Security

Fake Google Meet Conference Errors Push Infostealing Malware (bleepingcomputer.com) 6

An anonymous reader quotes a report from BleepingComputer: A new ClickFix campaign is luring users to fraudulent Google Meet conference pages showing fake connectivity errors that deliver info-stealing malware for Windows and macOS operating systems. ClickFix is a social-engineering tactic that emerged in May, first reported by cybersecurity company Proofpoint, from a threat actor (TA571) that used messages impersonating errors for Google Chrome, Microsoft Word, and OneDrive. The errors prompted the victim to copy to clipboard a piece of PowerShell code that would fix the issues by running it in Windows Command Prompt. Victims would thus infect systems with various malware such as DarkGate, Matanbuchus, NetSupport, Amadey Loader, XMRig, a clipboard hijacker, and Lumma Stealer.

In July, McAfee reported that the ClickFix campaigns were becoming mode frequent, especially in the United States and Japan. A new report from Sekoia, a SaaS cybersecurity provider, notes that ClickFix campaigns have evolved significantly and now use a Google Meet lure, phishing emails targeting transport and logistics firms, fake Facebook pages, and deceptive GitHub issues. According to the French cybersecurity company, some of the more recent campaigns are conducted by two threat groups, the Slavic Nation Empire (SNE) and Scamquerteo, considered to be sub-teams of the cryptocurrency scam gangs Marko Polo and CryptoLove.

Slashdot Top Deals