Micah Lee died and his wife and son were badly injured when their Model 3 hit a tree at 65 miles an hour in 2019. They sued Tesla for $400 million.

Tesla's Autopilot not to blame for a crash that killed a driver and left his wife and son badly injured, jury finds

Microsoft has begun warning Xbox users that "unauthorized" accessories will no longer work on the company's consoles. The move is likely an effort to limit online cheating that can be enabled by certain external devices, but it seems set to have unintended consequences for communities that rely on adapters for more legitimate users.

Microsoft issues system-level ban for “unauthorized” Xbox accessories

On Thursday, Leica Camera released the first camera that can take pictures with automatically encrypted metadata and provide features such as an editing history. The company believes this system, called Content Credentials, will help photojournalists protect their work and prove authenticity in a world riddled with AI-manipulated content.

Leica camera has built-in defense against misleading AI, costs $9,125

Yesterday, Judge Amit Mehta granted some of the demands of outlets—including The New York Times, The Wall Street Journal, Bloomberg, MLex, and Law360—which, among other requests, had asked the court to mandate the sharing of dozens of exhibits that the public has so far been denied access to despite pending press requests.

Media outlets win fight to gain faster access to Google trial evidence

Welcome to The Cybersecurity 202! This trend is … annoying.   Was this forwarded to you?    Today, Post Live will speak with Senate Majority Leader Charles E. Schumer (D-N.Y.), Scale AI CEO Alexander Wang,

New House Speaker is a skeptic of U.S. cybersecurity agency

A "woke-free" beer company raked in an astounding $500,000 ... Ultra Right Beer initially started as an online-only brand in April, but soon moved to stores and restaurants in southern states ...

Brew dubbed 'Conservative Dad's Revenge' released by Ultra Right Beer Company

A search engine that uses facial recognition to help people scan billions of images to find their photos strewn across the Internet has officially banned searches of minors, The New York Times reported.

Search engine that scans billions of faces tries blocking kids from results

Following news of a major security incident at Okta earlier this week, the attack already seems to be sending ripples across the business world ... either employee-facing or user-facing,” Ars Technica reports. Canahuati added that 1Password has been ...

1Password says it might have been targeted following Okta breach

Leffer: People were asking about their individual social media ... These companies and organizations don't keep very good tabs on the sources of their data. They're just compiling it and then training air tools with it. A report from Ars Technica found ...

Generative AI Models Are Sucking Data Up From All Over the Internet, Yours Included

According to a company official who talked to Ars Technica, SpaceX intends to ramp up its mission numbers next year, mostly so that it could officially roll out its satellite-to-cell phone service. "With our 2 million users, (we) need that constellation ...

SpaceX will ramp up its launches in 2024 for Starlink's satellite-to-cell service

Serving the Technologist for more than a decade. IT news, reviews, and analysis.

Ars Technica

Using AR and VR technology at Work (src: shutterstock) As part of my doctoral research on the metaverse, I am creating some sci-fi vignettes which can be used as “imaginaries” of the future of the metaverse. An “imaginary” is a term that social scientists like to use to talk about a vision of the future, usually (thought not always) rooted in science fiction, which starts out with a small group but then gets adopted by a larger collective, companies and governments, etc. and eventually becomes a “sociotechnical imaginary”. See Metaverse . Each Metaverse Imaginary vignette will have a specific theme (see below) and incorporate multiple threads (see below). I will also add some commentary eventually about the state of the imaginary vis a vis startups and larger companies that are toiling to turn these imaginaries into reality. I’m putting these up for feedback and to spur discussion about the various future scenarios of the Metaverse. Imaginary #1 here Let’s jump right into the second vignette, with a short discussion of analyzing this and other imaginaries afterwards. Note that this is a near future imaginary and is more about the Future of Work, but not as extreme as some futures where new jobs and careers will be created in the Metaverse. As an example, in Ready Player One, Wade’s mother had two full time jobs in the OASIS (its fictional version of the Metaverse), one as a telemarketer and one in an online brothel in the Metaverse. Rather this vignette is about how the Metaverse might change the work of people who have existing jobs that might utilize the Metaverse. Other vignettes will get further into the Metaverse economy. Figure 1: Src: Ars Technica Vignette #2: A Day in the Life of an Engineer: AR, AI Assistants and more Susan got up early for her engineering team meeting. Since the Engineering team was spread out between Buenos Aires, San Francisco, Bangalore and Beijing, and corporate headquarters was in London, they had settled on GMT. Why was it that the corporate, which was probably the smallest office got to set a convenient time for the meeting? She brought up her personal assistant Aivie, or AI Avatar, which she had named Laurie. “Laure, can you get me a Chai Latte” she said as she put her smart glasses on. Of course, laure was hoooked into the smartspeaker in the apartment, but she preferred to see her assistant. The glasses were still in AR mode and Laure appeared next to her, in a not quite human form — she looked like a cross between a teddy bear and a cartoon, it was a furry avatar. But she had set it so that only she could see Laure, so she wouldn’t inconveniently appear while in the middle of a work meeting. “Yes, I have sent the order. Would you like to go pick it up?” asked the Aivie. When Susan paused wondering if she had time to go down, Laure responded: “It will be tight to get there in time. I can have it delivered.” “Very good..” muttered Susan as she was getting setup to go to work. She had dressed for work, but this was just a generic cream sweat suit that she used while working at home. The cream color made it easy to mask — like a green screen in the old days of film and TV production. Since it was just downstairs she knew Laure would find a courier that was nearby — all they had to do was pick up the drink and bring it up to her apartment. Luckily, Laure could authorizer her to come up when the front desk called so it wouldn’t bother Susan. The drink arrived just before Susan’s avatar arrived in the the 3D conference room. She had brought up her usual work avatar, which looked just like her but was dressed in more professional clothes. The landscape of the meeting was something that looked like a cross between a playground monkey bars and something out of an old Mad Max movie she’d seen when she was a kid — she thought it was called Thunderdome or something. She was floating up on one of the monkey bars. Her boss, Herbert, the VP of Engineering, was standing in the center of the dome-like contraption with a big screen above him. Technically, the screens were only necessary when viewing the real world, but it was a metaphor left over from the old days when people met in conference rooms and used actual screens to project things. The engineers in her sub-team, Hiram and Lisa popped up near her, and the other sub-teams all appeared on various parts of the 3d space, including the off-shore team she worked closely with in Bangalore, which included Ranjan and Rajiv and Preeti. At least that’s where they were supposed to be in Bangalore — physical meaning didn’t have the same. She sent them private messages of greeting and set up a private chat group so they could talk to each other while the presentation started. Joining Herbert was the main product manager, William for their software, called Automation 3.0. He brought up a 3d Chart that floated in the air of all the dependencies and milestones to get their next release, 3.2, out the door. It was a major upgrade and they’d already been working on it for the better parts of six months, and were behind schedule. Herbert and William reviewed the major objectives and when their turn came, their particular module zoomed up and as the lead engineer, she floated up to each of the specific points and updated the rest of the group on where they were and then turned it over to Ranjan for the offshore challenge they were facing. It was all very routine. Once the status part of the meeting was done, another person, the VP of Customer Success, Sharon, who was also located on the West coast of the US, appeared. “Our software, as you know, drives the robots that manufacture cars for the new Tesla plant in China. We’ve been working closely with them but there’s a problem. It started as a small glitch in the robots and they traced it to our control system.” She brought up a 3D model using a subpatch of realism that simulated the physics of Earth quite well. It was a giant robot arm and a partially constructed Tesla car. “Susan, we need your team to figure out what’s going on. This has become a second tier support issue and has halted their assembly line so we need to give it top priority.” Susan asked if the Beijing team had looked into it. Sharon responded that they were already on-site, she indicated to Chou, the support engineer who was on site, whose avatar lit up floating up on the other side of the giant dome. They had only gotten so far, he explained, his voice booming across the entire dome — it was a strange trick that was used to amplify a voice so that everyone could hear, whereas in a realistic sim you could only hear those immediately near you and sound faded. They had tracked it down to her module. Susan agreed and asked Rajiv, who was the best debugger to come with her as soon as the meeting ended. The meeting ended and both Rajiv and Susan found themselves inside the realistic patch, a sub-sim that was a digital twin of the Chinese Tesla Plant. Since Chou and one other engineer was on-site, they could provide a video view and once the assembly line was shut down, they could holo-project her there to help with support. While they waited for the next break in the production line, Chou simulated the procedure using the simulated robotic arm and the half-done car. Tesla had been one of the first car companies to use the Metaverse, building a 3d environment that was a digital replica of one of their plants, using an old Nvidia relic called the Omniverse. When the realistic subpatches came up and the Earthverse 2 went live, the omniverse tech had been incorporated, built by teams of developers from around the world. At any one time, thousands of engineers were upgrading the Earthverse2 and the metaverse in general, depending on which sim and verse you were visiting, things could change right before your eyes. In a realistic sub-patch though they weren’t allowed to do live updates and everything had to be scheduled, since the point was that the laws of physics should be simulated exactly as necessary. “Patch will be updated in 1 hour,” flashed a virtual billboard above their heads. Standing with Susan and Rajiv was Jared, an AI troubleshooter that knew the interfaces between all the systems and could help in diagnosing the problem, though Jared wasn’t good enough to come up with real solutions. Chou had already been working with Jared, who looked like one of the old Dr. Who Doctors, a joke no doubt by the designers of Jared. Susan smiled, she knew one of the developers there in London and he was a Dr. Who fanatic. A few minutes later, the plant had a production break and Susan and Rajiv both shifted to projection mode. They now found themselves inside the actual physical manufacturing plant. Chou was no longer in avatar form. Rajiv looked the same, but Susan had chosen a different set of clothes for this visit — it was her standard “site visit” outfit and avatar. The others knew it was her. Susan now felt like she was actually in the plant though she had only limited mobility based on the portable holo-projector that Chou had brought with him. Chou however could move around easily and she could shift to his point of view (or at least the point of view from his glasses). Jared was also there but didn’t need to be projected. Chou pointed out the problem. “Jared,” said Susan, “please show me the code objects for modules 7–11 and the interfaces”. Rather than seeing a window with code, Jared popped up several holographic boxes, each of which was a module, connected to each other by numerous lines, each of which represented an interaction or exchange of data. Susan zoomed in on the lines between module 7 and 8, using her hand controls with her left hand. She was still sipping the Starbucks in her right hand. “Color code and show the values…” said Susan and the lines started changing colors and she could see text moving back and forth — too much and too fast to read. “Slow it down,” she said, and zoomed in further and again using her left hand selected several of the lines to zoom in on. “I think I see the problem..” she said, and took a sip from her Chai Latte in her right hand. “Let’s go back into the sim and try out a fix and see what that yields…” Things to Think About I’m putting these up for feedback and to spur discussion, so feel free to leave comments. Some questions to think about include: How far in the future is this vignette? (1 year, 5 years, 10 years or more)? What are some of the technologies that we already have, and what are some of the technologies that still need to be developed? Is the development a simple matter of better engineering, or does it require any new breakthroughs?Most of us are used to working remotely via zoom, how does the experience change if you are in a virtual space with other avatars? What kinds of issues come up in a work environment? How does this vignette reflect on issues of identity in the “real” world and among avatars — would you have different sets of clothes for your avatar to wear in different work-related environments?How about this idea of being in AR/VR ad projecting your avatar onto a physical location? Would others there be able to see you? Would you be able to see others? Consider that the metaverse could be a set of very different use cases, each with their own physics engines, but linked together via the avatar as the critical component. What considerations need to happen to make this a reality? How is the idea of a realistic sim different from the metaverse environments that most of us envision when we think of working in the metaverse? How good would the laws of physics have to be? How does this relate to NVidia’s omniverse, or other simulation software? What is the role of AI and virtual humans in the metaverse ? In this vignette, we have Jared, an AI assistant that is not quite AGI (artificial general intelligence) but is an expert on coding, and in fact might be able to pass the Turing Test. Is it possible that AI assistants wi ll know more about our technical systems and be able to debug them faster or in conjunction with humans? In the context of work, what does a “centaur” — a term for a human AI team — provide that neither the human or the AI might be able to provide alone? In this vignette we also have an AI assistant, called Laure, that is a personal assistant. If we use the Metaverse for work, what elements can we bring from our own lives, our assistants and data that knows about us? Would it be the same as installing our own software on a work laptop? Or are we talking about something completely different? How does this relatively short imaginary, relate to past imaginaries (TV shows, movies, or books) and how does this measure up with various visions of the Metaverse being put forward by companies like Meta, Microsoft, NVidia’s Omniverse, Epic, Unity, Decentraland, Upland, The SandBox or others? Also Published Here

An Imaginary Day in the Life of an Engineer in the Metaverse - A Sci Fi Vignette

In a year dominated by pandemic, there was also a lot of notable technology news and analysis. Take a stroll back through a year that felt like a century with my compendium of the best tech reporting, writing, and commentary of 2020: January Sonos said what every smaller tech company was thinking: working with big tech sucks , Dieter Bohn The Verge https://www.theverge.com/2020/1/8/21056198/sonos-google-statement-lawsuit-ces-reaction-big-tech We’re fighting fake news AI bots by using more AI. That’s a mistake. , Samuel Woolley MIT Technology Review https://www.technologyreview.com/2020/01/08/130983/were-fighting-fake-news-ai-bots-by-using-more-ai-thats-a-mistake/ YouTube moderators are being forced to sign a statement acknowledging the job can give them PTSD , Casey Newton The Verge https://www.theverge.com/2020/1/24/21075830/youtube-moderators-ptsd-accenture-statement-lawsuits-mental-health February Why Facebook’s data-sharing project ballooned into a 2-year debacle , Issie Lapowsky Protocol https://www.protocol.com/facebook-data-sharing-researchers Here’s the File Clearview AI Has Been Keeping on Me, and Probably on You Too , Anna Merlan Motherboard/VICE https://www.vice.com/en_us/article/5dmkyq/heres-the-file-clearview-ai-has-been-keeping-on-me-and-probably-on-you-too Big Tech’s Takeovers Finally Get Scrutiny , Kara Swisher The New York Times https://www.nytimes.com/2020/02/14/opinion/ftc-investigation-google-facebook.html Why Your State Has Terrible Internet Access , Karl Bode Motherboard/VICE https://www.vice.com/en/article/v74pda/why-your-state-has-terrible-internet-access March Pixar’s computer graphics pioneers have won the $1 million Turing Award , Charlotte Jee MIT Technology Review https://www.technologyreview.com/2020/03/18/905239/pixars-computer-graphics-pioneers-have-won-the-1-million-turing-award/ Why Don’t We Just Ban Targeted Advertising? , Gilad Edelman Wired https://www.wired.com/story/why-dont-we-just-ban-targeted-advertising/ April How a nonprofit you’ve never heard of made the web safer for everyone , Glenn Fleishman Fast Company https://www.fastcompany.com/90467660/how-a-nonprofit-youve-never-heard-of-made-the-web-safer-for-everyone You Can Now Check If Your ISP Uses Basic Security Measures , Lily Hay Newman Wired https://www.wired.com/story/cloudflare-bgp-routing-safe-yet/ Another pandemic woe: Zoom fatigue , Scott Rosenberg Axios https://www.axios.com/zoom-fatigue-coronavirus-teleconferencing-f5c0ce17-483f-4c71-9a7d-f023d7e7a45b.html May Poynter Institute launches WhatsApp chatbot to debunk coronavirus-related hoaxes , Manish Singh TechCrunch https://techcrunch.com/2020/05/04/poynter-institutes-international-fact-checking-network-launches-chatbot-on-whatsapp-to-debunk-thousands-of-coronavirus-related-hoaxes/ Facebook will pay $52 million in settlement with moderators who developed PTSD on the job , Casey Newton The Verge https://www.theverge.com/2020/5/12/21255870/facebook-content-moderator-settlement-scola-ptsd-mental-health Chrome will start blocking resource-heavy ads in August , Emil Protalinski VentureBeat https://venturebeat.com/2020/05/14/chrome-will-start-blocking-resource-heavy-ads-in-august/ Microsoft: We were wrong about open source, but luckily you can change , Liam Tung ZDNet https://www.zdnet.com/article/microsoft-we-were-wrong-about-open-source-but-luckily-you-can-change/ June DOD's third attempt to implement IPv6 isn't going well , Catalin Cimpanu ZDNet https://www.zdnet.com/article/dods-third-attempt-to-implement-ipv6-isnt-going-well/#ftag=RSSbaffb68 Amazon sues former AWS marketing VP Brian Hall after he takes Google Cloud job , ogle-cloud-job/ Todd Bishop GeekWire https://www.geekwire.com/2020/amazon-sues-former-aws-marketing-vp-brian-hall-accepts-go IBM will no longer offer, develop, or research facial recognition technology , Jay Peters The Verge https://www.theverge.com/2020/6/8/21284683/ibm-no-longer-general-purpose-facial-recognition-analysis-software AWS said it mitigated a 2.3 Tbps DDoS attack, the largest ever , Catalin Cimpanu ZDNet https://www.zdnet.com/article/aws-said-it-mitigated-a-2-3-tbps-ddos-attack-the-largest-ever/ The FBI said it used Instagram, Etsy, and LinkedIn to track down a protester in Philadelphia accused of setting a police car on fire , Lisa Eadicicco Business Insider https://www.businessinsider.com/fbi-uses-instagram-etsy-linkedin-to-find-george-floyd-protester-2020-6 Why tech didn’t save us from covid-19 David Rotman, MIT Technology Review https://www.technologyreview.com/2020/06/17/1003312/why-tech-didnt-save-us-from-covid-19/ July China’s Software Stalked Uighurs Earlier and More Widely, Researchers Learn and , Paul Mozur Nicole Perlroth The New York Times https://www.nytimes.com/2020/07/01/technology/china-uighurs-hackers-malware-hackers-smartphones.html Inside Facebook’s exclusive clubs for its top advertisers , Hannah Murphy Financial Times https://www.ft.com/content/89a89532-2be4-47a0-b79a-841421532c0e Facebook gets in a Twitter tangle , Casey Newton The Interface https://www.getrevue.co/profile/caseynewton/issues/facebook-gets-in-a-twitter-tangle-265375 The Work-From-Home Shift Shocked Companies—Now They’re Learning Its Lessons , Christopher Mims The Wall Street Journal https://www.wsj.com/articles/the-work-from-home-shift-shocked-companiesnow-theyre-learning-its-lessons-11595649628 Microsoft Said to Be in Talks to Buy TikTok, as Trump Weighs Curtailing App , , and Mike Isaac Ana Swanson Alan Rappeport, The New York Times https://www.nytimes.com/2020/07/31/technology/tiktok-microsoft.html Nvidia in talks to buy Arm from SoftBank for more than $32bn , , and , Arash Massoudi Tim Bradshaw James Fontanella-Khan Financial Times https://www.ft.com/content/4ed67726-1a56-4ce2-9d62-a5ec2a8f35b5 August The Pandemic Workday Is 48 Minutes Longer and Has More Meetings , Jeff Green Bloomberg https://www.bloomberg.com/news/articles/2020-08-03/the-pandemic-workday-is-48-minutes-longer-and-has-more-meetings TikTok Ban? Creators and Fans Are Big Mad , Taylor Lorenz The New York Times https://www.nytimes.com/2020/08/02/style/tiktok-ban-threat-trump.html Insecure satellite Internet is threatening ship and plane safety , Dan Goodin Ars Technica https://arstechnica.com/information-technology/2020/08/insecure-satellite-internet-is-threatening-ship-and-plane-safety/ Why quantum computing matters , Bryan Walsh Axios https://www.axios.com/newsletters/axios-future-44b480f7-05cf-4c98-8ae4-871f04f1cec2.html September Wirecard and me: Dan McCrum on exposing a criminal enterprise , Dan McCrum Financial Times https://www.ft.com/content/745e34a1-0ca7-432c-b062-950c20e41f03 Unlimited Information Is Transforming Society and , Naomi Oreskes Erik M. Conway Scientific American https://www.scientificamerican.com/article/unlimited-information-is-transforming-society/ Apple v. Epic — a briefing on the antitrust arguments and interesting facts , Dean Takahashi VentureBeat https://venturebeat.com/2020/09/11/the-deanbeat-apple-v-epic-a-briefing-on-the-antitrust-arguments-and-interesting-facts/ "I Have Blood On My Hands": A Whistleblower Says Facebook Ignored Global Political Manipulation , , and , Craig Silverman Ryan Mac Pranav Dixit BuzzFeed News https://www.buzzfeednews.com/article/craigsilverman/facebook-ignore-political-manipulation-whistleblower-memo Ransomware attack at German hospital leads to death of patient , Lawrence Abrams BleepingComputer https://www.bleepingcomputer.com/news/security/ransomware-attack-at-german-hospital-leads-to-death-of-patient/#.X2ORHzTKn58.twitter Can Big Tech save the planet? Maybe not, but it won't be for lack of trying , Jerry Bowles Diginomica https://diginomica.com/can-big-tech-save-planet-maybe-not-it-wont-be-lack-trying Amazon details its low-bandwidth Sidewalk neighborhood network, coming to Echo and Tile devices soon , Frederic Lardinois TechCrunch https://techcrunch.com/2020/09/21/amazon-details-its-low-bandwidth-sidewalk-neighborhood-network-coming-to-echo-and-tile-devices-soon/ How Work Became an Inescapable Hellhole , Anne Helen Petersen Wired https://www.wired.com/story/how-work-became-an-inescapable-hellhole/ October The Eighth Wonder of the World , Josh Dzieza The Verge https://www.theverge.com/21507966/foxconn-empty-factories-wisconsin-jobs-loophole-trump Artificial intelligence and the antitrust case against Google , Khari Johnson VentureBeat https://venturebeat.com/2020/10/21/artificial-intelligence-and-the-antitrust-case-against-google/ Governments are using the pandemic as an excuse to restrict internet freedom , Charlotte Jee MIT Technology Review https://www.technologyreview.com/2020/10/14/1010361/governments-are-using-the-pandemic-as-an-excuse-to-restrict-internet-freedom/ 25 moments in tech that defined the past 25 years Fast Company Staff, Fast Company https://www.fastcompany.com/90565059/25-moments-in-tech-that-defined-the-past-25-years The Justice Dept.’s Lawsuit Against Google: Too Little, Too Late , Kara Swisher The New York Times https://www.nytimes.com/2020/10/20/opinion/google-justice-lawsuit.html Quibi Is Shutting Down Barely Six Months After Going Live , , and , Benjamin Mullin Joe Flint Maureen Farrell The Wall Street Journal https://www.wsj.com/articles/quibi-weighs-shutting-down-as-problems-mount-11603301946 Taking Back Our Privacy , Anna Wiener The New Yorker https://www.newyorker.com/magazine/2020/10/26/taking-back-our-privacy November Someone has transferred ~$1 billion from a bitcoin wallet quiet since 2015 , Dan Goodin Ars Technica https://arstechnica.com/information-technology/2020/11/someone-has-withdrawn-1-billion-from-a-bitcoin-wallet-dormant-since-2015/ Marissa Mayer wants to clean up your contacts, and that’s just for starters Harry McCracken, Fast Company https://www.fastcompany.com/90576544/marissa-mayer-enrique-munoz-torres-sunshine-lumi-labs CVS becomes first national retailer to offer support for PayPal and Venmo QR codes at checkout , Sarah Perez TechCrunch https://techcrunch.com/2020/11/16/cvs-becomes-first-national-retailer-to-offer-support-for-paypal-and-venmo-qr-codes-at-checkout/ Trump Fires Security Chief Christopher Krebs , y Brian Krebs Krebs on Securit https://krebsonsecurity.com/2020/11/trump-fires-security-chief-christopher-krebs/ Amazon Works to Avoid Google’s Fate With EU Antitrust Regulators , Aoife White Bloomberg https://www.bloomberg.com/news/articles/2020-12-01/amazon-amzn-works-to-avoid-eu-antitrust-fines-placed-on-google-googl Apple to pay $113M settlement over its iPhone 'batterygate' slowdowns , Ian Sherr CNET https://www.cnet.com/news/apple-to-pay-113-million-settlement-over-its-iphone-batterygate-slowdowns/ London A.I. Lab Claims Breakthrough That Could Accelerate Drug Discovery , Cade Metz The New York Times https://www.nytimes.com/2020/11/30/technology/deepmind-ai-protein-folding.html December Google AI ethics co-lead Timnit Gebru says she was fired over an email , Khari Johnson VentureBeat https://venturebeat.com/2020/12/03/google-ai-ethics-co-lead-timnit-gebru-says-she-was-fired-over-an-email/ Here’s the NLRB Complaint Alleging Google Illegally Fired and Surveilled Workers , Lauren Kaori Gurley Motherboard/VICE https://www.vice.com/en/article/xgzg8n/heres-the-nlrb-complaint-alleging-google-illegally-fired-and-surveilled-workers In 2020, Disinformation Broke the US , Jane Lytvynenko BuzzFeed News https://www.buzzfeednews.com/article/janelytvynenko/disinformation-broke-us Armed police raid home of Florida scientist fired over Covid-19 data , Ed Pilkington The Guardian https://www.theguardian.com/us-news/2020/dec/07/florida-police-raid-data-scientist-coronavirus Huawei tested AI software that could recognize Uighur minorities and alert police, report says and , Drew Harwell Eva Dou The Washington Post https://www.washingtonpost.com/technology/2020/12/08/huawei-tested-ai-software-that-could-recognize-uighur-minorities-alert-police-report-says/ Image courtesy of Gerd Altmann from Pixabay

The 59 Best Technology Journalism Stories Published in 2020

Here’s my compendium of the best tech reporting, writing, and commentary of 2019: January Josh Constine, Facebook pays teens to install VPN that spies on them TechCrunch https://techcrunch.com/2019/01/29/facebook-project-atlas/ Joseph Cox, I Gave a Bounty Hunter $300. Then He Located Our Phone Motherboard (Vice) https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty-hunter-300-dollars-located-phone-microbilt-zumigo-tmobile Martin Giles, Explainer: What is a quantum computer? MIT Technology Review https://www.technologyreview.com/s/612844/what-is-quantum-computing/ February Casey Newton, Illustrations: Corey Brickley, Photos: Jessica Chou The Trauma Floor: The secret lives of Facebook moderators in America The Verge https://www.theverge.com/2019/2/25/18229714/cognizant-facebook-content-moderator-interviews-trauma-working-conditions-arizona Catalin Cimpanu, Russia to disconnect from the internet as part of a planned test ZDNet https://www.zdnet.com/article/russia-to-disconnect-from-the-internet-as-part-of-a-planned-test/ Taylor Lorenz, When Kids Realize Their Whole Life Is Already Online The Atlantic https://www.theatlantic.com/technology/archive/2019/02/when-kids-realize-their-whole-life-already-online/582916/ Jonathan Corum, NASA’s Opportunity Rover Dies on Mars The New York Times https://www.nytimes.com/interactive/2019/02/13/science/opportunity-rover-mars-map.html March Cory Doctorow, Myspace lost all the music its users uploaded between 2003 and 2015 Boing Boing https://boingboing.net/2019/03/17/facebook-is-next.html Greg Epstein, Silicon Valley’s inequality machine TechCrunch (ExtraCrunch) https://techcrunch.com/2019/03/02/silicon-valleys-inequality-machine-anand-giridharadas/ Joe Veix, Photos, Brandon Tauszik I Rode an E-Scooter as Far From Civilization as Its Batteries Could Take Me Gizmodo https://gizmodo.com/i-rode-an-e-scooter-as-far-from-civilization-as-its-bat-1833434599 Micah Maidenberg, Who Controls Diners’ Data? OpenTable Moves to Assert Control The Wall Street Journal https://www.wsj.com/articles/who-controls-diners-data-opentable-moves-to-assert-control-11552644121 Mike Isaac, As Mark Zuckerberg Tightens Grip on Facebook, 2 Top Deputies Leave The New York Times https://www.nytimes.com/2019/03/14/technology/facebook-chris-cox.html April Alfred Ng, Facebook still tracks you after you deactivate account CNET https://www.cnet.com/news/facebook-is-still-tracking-you-after-you-deactivate-your-account/ Nicholas Thompson and Fred Vogelstein, 15 Months of Fresh Hell Inside Facebook Wired https://www.wired.com/story/facebook-mark-zuckerberg-15-months-of-fresh-hell/ Darren Byler, China’s hi-tech war on its Muslim minority The Guardian https://www.theguardian.com/news/2019/apr/11/china-hi-tech-war-on-muslim-minority-xinjiang-uighurs-surveillance-face-recognition Daniel Oberhaus, A Programmer Solved a 20-Year-Old, Forgotten Crypto Puzzle Wired https://www.wired.com/story/a-programmer-solved-a-20-year-old-forgotten-crypto-puzzle/ May Paul Ford, Why I (Still) Love Tech: In Defense of a Difficult Industry Wired https://www.wired.com/story/why-we-love-tech-defense-difficult-industry/ Nathan Heller, The Hidden Radicalism of Chris Hughes’s Call to Break Up Facebook The New Yorker https://www.newyorker.com/tech/annals-of-technology/the-hidden-radicalism-of-chris-hughess-call-to-break-up-facebook John Kennedy, A year after GDPR, how is Ireland tackling the data giants? Siliconrepublic https://www.siliconrepublic.com/enterprise/gdpr-ireland-dpc-investigations June Casey Newton Illustrations: Corey Brickley, Photos: Amelia Holowaty Krales Bodies in Seats: At Facebook’s worst-performing content moderation site in North America, one contractor has died, and others say they fear for their lives The Verge https://www.theverge.com/2019/6/19/18681845/facebook-moderator-interviews-video-trauma-ptsd-cognizant-tampa Nitasha Tiku, Three Years of Misery Inside Google, the Happiest Company in Tech Wired https://www.wired.com/story/inside-google-three-years-misery-happiest-company-tech/ Alfred Ng, Amazon’s helping police build a surveillance network with Ring doorbells CNET https://www.cnet.com/features/amazons-helping-police-build-a-surveillance-network-with-ring-doorbells/ Julia Alexander, YouTube looks to demonetization as punishment for major creators, but it doesn’t work The Verge https://www.theverge.com/2019/6/25/18744246/youtube-demonetization-steven-crowder-patreon-advertising-merch Jack Gillum and Jeff Kao, and Photos: Adrienne Grunwald Aggression Detectors: The Unproven, Invasive Surveillance Technology Schools Are Using to Monitor Students ProPublica Wired https://features.propublica.org/aggression-detector/the-unproven-invasive-surveillance-technology-schools-are-using-to-monitor-students/ July Brian Krebs, Capital One Data Theft Impacts 106M People KrebsonSecurity https://krebsonsecurity.com/2019/07/capital-one-data-theft-impacts-106m-people/ Farhad Manjoo, The Tech Industry Is Building a Vast Digital Underclass The New York Times https://www.nytimes.com/2019/07/24/opinion/doordash-tipping.html Andy Newman, Photos: Christopher Lee My Frantic Life as a Cab-Dodging, Tip-Chasing Food App Deliveryman The New York Times https://www.nytimes.com/2019/07/21/nyregion/doordash-ubereats-food-app-delivery-bike.html Patrick Howell O’Neill, What happens when a country’s entire adult population is hacked? MIT Technology Review https://www.technologyreview.com/f/613973/what-happens-when-a-countrys-entire-adult-population-is-hacked/ Charlotte Jee, How “stalkerware” apps are letting abusive partners spy on their victims MIT Technology Review https://www.technologyreview.com/s/613915/stalkerware-apps-are-letting-abusive-partners-spy-on-their-victims/ Dan Goodin, My browser, the spy: How extensions slurped up browsing histories from 4M users Ars Technica https://arstechnica.com/information-technology/2019/07/dataspii-inside-the-debacle-that-dished-private-data-from-apple-tesla-blue-origin-and-4m-people/ Sue Halpern, How Cyberweapons Are Changing the Landscape of Modern Warfare The New Yorker https://www.newyorker.com/tech/annals-of-technology/how-cyber-weapons-are-changing-the-landscape-of-modern-warfare Jennifer Walter, The Mechanical Turk: How a Chess-playing Hoax Inspired Real Computers Discover Magazine https://www.discovermagazine.com/technology/the-mechanical-turk-how-a-chess-playing-hoax-inspired-real-computers August Elizabeth Lopatto, WeWork Isn’t a Tech Company, It’s a Soap Opera The Verge https://www.theverge.com/2019/8/15/20806366/we-company-wework-ipo-adam-neumann Greg Williams, Inside DeepMind’s epic mission to solve science’s trickiest problem Wired UK https://www.wired.co.uk/article/deepmind-protein-folding Wes Schlagenhauf, Yelp swaps restaurant phone numbers with Grubhub’s to boost referral revenue The Hustle https://thehustle.co/yelp-grubhub-restaurant-controversy/ Nick Heath, Python is eating the world: How one developer’s side project became the hottest programming language on the planet TechRepublic https://www.techrepublic.com/article/python-is-eating-the-world-how-one-developers-side-project-became-the-hottest-programming-language-on-the-planet/ September Madhumita Murgla and Richard Waters, Google claims to have reached quantum supremacy Financial Times https://www.ft.com/content/b9bb4e54-dbc1-11e9-8f9b-77216ebe1f17 Kim Zetter and Huib Modderkolk, Revealed: How a secret Dutch mole aided the U.S.-Israeli Stuxnet cyberattack on Iran Yahoo News https://news.yahoo.com/revealed-how-a-secret-dutch-mole-aided-the-us-israeli-stuxnet-cyber-attack-on-iran-160026018.html Kara Swisher, He Who Must Not Be Tolerated The New York Times https://www.nytimes.com/2019/09/08/opinion/joichi-ito.html Andrew Marantz, The Dark Side of Techno-Utopianism The New Yorker https://www.newyorker.com/magazine/2019/09/30/the-dark-side-of-techno-utopianism Anna Wiener, Four Years in Startups The New Yorker https://www.newyorker.com/magazine/2019/09/30/four-years-in-startups October Casey Newton, All Hands On Deck The Verge https://www.theverge.com/2019/10/1/20756701/mark-zuckerberg-facebook-leak-audio-ftc-antitrust-elizabeth-warren-tiktok-comments Kara Swisher, The Sum of Zuckerberg’s Fears The New York Times Paris Martineau, Turkish ISP Blocks Social Media Sites Near Syrian Border Wired https://www.wired.com/story/turkish-isp-blocks-social-media-syrian-border/ Cory Doctorow, Bruce Schneier makes the case for “public interest technologists” Boing Boing https://boingboing.net/2019/10/10/public-interest-at-scale.html Katherine Miller, The 2010s Broke Our Sense Of Time Buzzfeed News https://www.buzzfeednews.com/article/katherinemiller/the-2010s-have-broken-our-sense-of-time November Lily Hay Newman, How the Iranian Government Shut Off the Internet Wired https://www.wired.com/story/iran-internet-shutoff/ Rob Copeland, Google’s ‘Project Nightingale’ Gathers Personal Health Data on Millions of Americans The Wall Street Journal https://www.wsj.com/articles/google-s-secret-project-nightingale-gathers-personal-health-data-on-millions-of-americans-11573496790 Ashlee Vance, Images: Guy Martin Open Source Code Will Survive the Apocalypse in an Arctic Cave Bloomberg https://www.bloomberg.com/news/features/2019-11-13/microsoft-apocalypse-proofs-open-source-code-in-an-arctic-cave Ben Thompson, The Google Squeeze Stratechery https://stratechery.com/2019/the-google-squeeze/ Susan D’Agostino, Photos: Cody O’Loughlin The Architect of Modern Algorithms Quanta Magazine https://www.quantamagazine.org/barbara-liskov-is-the-architect-of-modern-algorithms-20191120/ Greg Epstein, Will the future of work be ethical? TechCrunch (ExtraCrunch) https://techcrunch.com/2019/11/28/will-the-future-of-work-be-ethical/ December Adi Robertson, Illustrations by Alex Castro / How to fight lies, tricks, and chaos online The Verge https://www.theverge.com/2019/12/3/20980741/fake-news-facebook-twitter-misinformation-lies-fact-check-how-to-internet-guide Dan Goodin, New crypto-cracking record reached, with less help than usual from Moore’s Law Ars Technica https://arstechnica.com/information-technology/2019/12/new-crypto-cracking-record-reached-with-less-help-than-usual-from-moores-law/ Josh Constine, Instagram still doesn’t age-check kids. That must change. TechCrunch https://techcrunch.com/2019/12/03/instagram-age-limit/ Casey Newton, Larry Page is the tech world’s Dr. Manhattan The Verge https://www.theverge.com/interface/2019/12/4/20993633/larry-page-sergey-brin-quit-google-dr-manhattan-watchmen-strained-metaphor Zoe Schiffer, Illustrations by Grayson Blackmon and Will Joel Emotional Baggage The Verge https://www.theverge.com/2019/12/5/20995453/away-luggage-ceo-steph-korey-toxic-work-environment-travel-inclusion Caroline Haskins, Image: Hunter French How Ring Transmits Fear to American Suburbs Motherboard (Vice) https://www.vice.com/en_us/article/ywaa57/how-ring-transmits-fear-to-american-suburbs Stuart A. Thompson and Charlie Warzel, Twelve Million Phones, One Dataset, Zero Privacy The New York Times https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html

The 59 Best Technology Journalism Stories Published in 2019

Besides the massive , what makes the one answering the questions about data collection by big tech companies? Facebook is not alone as the and other companies arguably collect information than Facebook. Here’s a look at why Facebook is taking the floor in answering questions from the Senate. Cambridge Analytica scandal Facebook internet’s privacy villain even more People Know Who Mark Zuckerberg Is Mark Zuckerberg is likely one of the most recognizable CEOs in the world. Thanks to , a movie about how Zuck founded Facebook, people know more about his story than any other CEO. The Social Network Other CEOs: Alphabet’s , Google’s , Amazon’s , and Twitter’s are well known in the tech realm. However most people wouldn’t recognize them in person or know much about them beyond their position. Zuckerberg is an icon, he embraces the spotlight — even if people . Larry Page Sundar Pichai Jeff Bezos Jack Dorsey criticize his authenticity People Use Facebook on a Daily Basis on average log onto Facebook daily and are considered daily active users. Internet users can relate to concerns about Facebook because they use the service so often and have a deep connection with it. 4 billion people Adding privacy protection to Facebook is something people can directly relate to and understand. People Agree To Facebook’s Privacy Policy & Terms of Service Facebook uses a broad blanket when users create an account. However, many features on Facebook are opt-out, meaning they are enabled by default and users have to choose to turn them off. privacy policy These policies, which very few users actually read, are a problem. If people can’t easily understand how their data is used, the privacy policies aren’t accomplishing their purpose for the users (only protecting the companies legally). Users Are Generally Comfortable with Sharing Information on Facebook People are comfortable sharing content on Facebook. Whether it’s a photo of their family or a status update, putting this out there has become the norm for Facebook users. Because people perceive Facebook as a social environment, they are given reinforcement — likes, shares, comments — for sharing information. Make your online presence work for you, not against you. Employers and admissions officers report that the internet can be a good place for applicants to present their talents, professionalism, and sociability. -Source: DigitalResponsibility.org Filling out a profile on Facebook involves making certain information about you public, at least to your friends. People don’t associate sharing information with or Amazon, by contrast. Google Facebook’s Data Collection Goes Well Beyond It’s Core Product Facebook says it has removed these , but prior to 2015 users could be targeted under the categories “diagnosis with HIV or AIDS”, “erectile dysfunction” and “binge-eating disorder awareness”. How would Facebook gather this data through its core products? targeting options “Facebook can learn almost anything about you by using artificial intelligence to analyze your behavior,” said for the Electronic Frontier Foundation, a digital rights nonprofit. “That knowledge turns out be perfect both for advertising and propaganda. Will Facebook ever prevent itself from learning people’s political views, or other sensitive facts about them?” Peter Eckersley, the chief computer scientist Facebook uses its to collect information about users and their connections. many apps and products Facebook’s Product Line Facebook Instagram Messenger WhatsApp Internet.org by Facebook Oculus Facebook Has Virtually No Direct Competitors Mark Zuckerberg may be adamant that , but the numbers don’t lie. There are companies that provide parts of what Facebook does, but none are true alternatives. Facebook is not a monopoly Even companies calling themselves offer just a portion of Facebook’s features. And none can even come close to Facebook’s . alternatives to Facebook 2.2 billion users Facebook Offers Very Little Transparency Unfortunately because Facebook has so little competition, they don’t need to offer transparency. And users have demonstrated that even if they would like for the platform to share more about how it works, they aren’t willing to delete their accounts over it. Facebook discloses which information it gathers in its terms of use. However, users are often surprised to learn about the social network sharing other information with third-parties such as advertisers or other firms, like . Cambridge Analytica Source: Statista.com The company owns Facebook Messenger and WhatsApp, making it the biggest player in the mobile messaging market by far. Messaging as a market is unique because users rely on other people using the same apps as them to communicate. If a user wants to switch to a different messaging app, in most cases they need the people they are communicating with to also switch. Conclusion So Facebook’s celebrity CEO, it’s massive user base and its monopoly status, make it a prime example for the tech industry as a whole. Because Facebook is so ingrained throughout the internet and every browsing session, people can clearly see the effects of . How Facebook responds to lawmakers’ questions will impact the future of for the entire internet and tech industry. data collection privacy regulations Read More _Google’s parent company, Alphabet, has a market cap of $712 billion. Within Google’s range of products, there are seven…_hackernoon.com Data Privacy Concerns with Google _Facebook's house of cards has taken yet another tumble today after Ars Technica revealed that Facebook tracks call and…_choosetoencrypt.com Facebook May Have Consent, But Not Approval - Choose To Encrypt _Facebook just revamped its privacy settings and terms of use, mostly in response to users who were upset about the…_choosetoencrypt.com Facebook Won't Fix the Internet's Bigger Privacy Problem - Choose To Encrypt

Why Facebook Is The Perfect Representative of Tech’s Privacy Problem

You’re likely going through a stressful time right now, as your company falls under fire from many different angles over its use of my data. , the company you created, now has more users ( ) than there are people in China ( ), the largest country in the world. Facebook ~2.1 billion ~1.4 billion You have the ability to reach all of these users with whatever message you’d like them to see, whenever you want them to see it. You control the way billions of people get their news and information, you have immense influence over the connected world. It’s because of your great power that I’m concerned when I see this headline: “Facebook has gotten too big for Mark Zuckerberg” “Mark Zuckerberg is not comfortable with the enormous influence he has over the world.” — CNN Money Yo, Mark. Here’s the deal, you’re leading one of the largest companies in the world. You’re impacting the lives of all 2 billion users. You’ve risen to the highest ranks of power in the world, and you have a huge responsibility to use that power nobly and honestly. So far your company has failed to do so, it has repeatedly mislead people to believe that the information your company gathers is to help make the product better for them. However, after recent news it appears that Facebook is focused on making the product more profitable for itself. Facebook Leading Facebook Users, To Where? Your position, as CEO of Facebook, is like being the leader of a global superpower, spread over the world, spread across demographics, economic situations, and geographic locations. You are leading your followers (or Facebook friends), but where are you taking them? Right now both you and they are unsure of where the platform is headed. You’ve betrayed your by allowing their data to be compromised on Facebook. What are you doing to regain their trust? Fortunately for you, users have been given so little power to this point, that they can’t switch up their use of Facebook to benefit them. This means that in order to assure their data’s privacy and security, they need to delete their accounts and completely leave your social . Most people aren’t willing to do this, because Facebook has become something they use every day. friends, network When there were concerns about Fake News and propaganda being spread on Facebook, you said that you were going to make Facebook more about our family and friends sharing content we’re actually interested in. Now you’re saying that you want to “give people a better idea of ” Unfortunately, I don’t think that’s what people want. We already know that we can read your privacy policy and see what information is being gathered and used. Regardless of what it says, users have little to no control of the information is used. We want control. We want to know that Facebook is a platform for the user, for us, the people. Until now it hasn’t been. It’s been about profits for Facebook. While the social networking that Facebook offers is awesome, it’s completely unfair that you use all of our data in ways that make us uncomfortable. You, after all, are the one getting the last laugh. how their data are being used. if Privacy, For Big Companies Is Possible! Apple, a company that has consistently been big on privacy, is outspoken about the importance of privacy. Could Apple be more profitable if they opted to collect and use its users’ data for advertising and other purposes? Most certainly. “Privacy means people know what they’re signing up for, in plain English, and repeatedly” according to , in this 2010 interview. Steve Jobs There is great value in privacy, both for the company and the consumer. Apple hasn’t gone through this negative media frenzy that Facebook is seeing right now. They have actually seen the opposite, privacy advocates supported Apple for and refusing to crack an iPhone involved in a terrorism case. standing up to the FBI Of course, Facebook runs on a completely different business model than Apple. It’s completely naive to assume that Facebook could exist in its current form without collecting user data, and Facebook is certainly not the only . Facebook collects all kinds of information, but it has a very important portion of our data, that very few companies have access to: privacy villain on the internet our relationships. According to , Mark Zuckerberg thinks we’re idiots. I’m not sure that the case, but the world’s relationship with the King of Social Media needs to change. Jean-Louis Gassée _by Jean-Louis Gassée_mondaynote.com Mark Zuckerberg Thinks We’re Idiots. Zuck, Lead Us Into the Glorious Future, Where Facebook Keeps our Information Private on the biggest social network in the world is not just possible, it’s essential for its survival. People will trust it, and keep using it. Otherwise, Facebook may be in for a long, brutal downfall. Privacy Your Friend, Christian Stewart Continue Reading… _Facebook is getting battered for recent news involving Cambridge Analytica’s use of Facebook user data. The company’s…_choosetoencrypt.com Facebook is Not The Internet’s Only Privacy Villain — Choose To Encrypt _Facebook's house of cards has taken yet another tumble today after Ars Technica revealed that Facebook tracks call and…_choosetoencrypt.com Facebook May Have Consent, But Not Approval - Choose To Encrypt

Dear Mark Zuckerberg,

How Meltdown and Spectre are Breaching Device Security At , we’ve been discussing the newly disclosed Meltdown and Spectre flaws and their impact on . Our CTO, Richard Taylor, wrote a giving a nice overview of the exploits. It’s a clear explanation and goes a little deeper than most, so I have included his thoughts below to help get the word out. CriticalBlue device security blog post There is much to discuss in the wake of the security news flow last week. It was dominated by the CPU bug announcements — 2018 has certainly got off to an interesting start. In part one of this two part blog I will look at these bugs from a high level. In part two I shine the spotlight on the implications for mobile security, and for Android in particular. Meltdown and Spectre Although patches for these bugs have been in the works for some time, the announcements have been rushed out and it has showed at times. However and amongst others have provided some excellent coverage which I won’t repeat again here. The Register Ars Technica Cache side channel attacks are but until now many of those attacks have been somewhat contrived. For the attack to work, there needs to be a strong signal coming from the victim application you are trying to eavesdrop upon and locating this has been the biggest challenge for the attacker. In this context a strong signal means a cache line access pattern that itself reveals some secret data. In other words the data has to influence the memory access pattern in a particularly convenient way. Some key piece of data you are trying to steal needs to be used to calculate addresses that conveniently span lots of cache lines to give you some good cache side channel information to spy on later. Furthermore you need that cache layout to remain intact long enough that your eavesdropping code can observe it. Often, the cache layout information is quickly degraded by other operations being performed by the code under attack. These requirements don’t occur very frequently in reality, so although there are some nice demos of side channel communication the opportunities of finding a good signal generator in the code you want to attack is actually rather slim. not new Meltdown and Spectre change the game fundamentally. You get to make your own signal generating code that you can then eavesdrop upon yourself. Very convenient. This is much more generic and much more powerful. The key insight here is the use of speculative execution to do this for you. To maintain decent performance, CPUs execute speculatively quite a lot of the time. In particular they predict which way branches are likely to take and as it turns out they effectively predict that, sure, you are definitely allowed to access that memory location you just read from. First let us deal with Meltdown, which effectively only impacts Intel CPUs. Formally this is Rogue Data Cache Load ( ), a rather clever abuse of the out of order speculative nature of CPUs. The first thing you do is you load from a memory location that are not meant to have permission to read. When you do this your code is going to get an exception and it is going to stop, and certainly not tell you directly what was held in that memory location. But, as it turns out, it doesn’t do that right away because it deals with the exception as a separate sub-operation to the load itself. So if you cleverly construct your code you can actually take the data load and transform it into an address and then load from that location. Now when the exception finally catches up with you all the register state you got from the original load gets rolled back. Washed away as if it never happened. However, the fact that you read from that data dependent address is still left in the cache state. It isn’t washed away. This vestige remains and with careful measurement of the cache state from another thread in your code you can infer what the data was. This is very bad news. Now you can effectively read any memory you want to, albeit a little statistically and very indirectly. The really terrible news is that by default Linux and Windows make all of the machine’s memory accessible in the process address space. So all the secret data, passwords and other useful nuggets are potentially accessible to your attack code. If you can get your code running on the target machine then you can read anything you want in theory. A pretty devastating oversight in the security isolation of CPUs. It is truly remarkable that this hasn’t been obvious before now. Speculative execution has been around for many years. It is one of those insights which results in a collective sigh of “of course, why did nobody think of that before” once you realise its implication. Patches to fix Meltdown have been in the works for a while and are ready to roll out soon. Basically the fix is to make sure the only pages that are MMU mapped for a process are ones that it should be able to read anyway or are otherwise not very interesting. This is termed Kernel Page Table Isolation ( ) for Linux, and there is a similar fix for Windows arriving soon. This has a performance impact though. There were good reasons to make the rest of the kernel pages quickly accessible. Even though systems will see a drop in performance, we will be safe from Meltdown. So although much of the initial hysteria has been around the impact of Meltdown, especially in multi-tenant cloud environments such as AWS, it seems that the patch cycle should catch up soon and Meltdown will then likely drop out of the headlines. Although the main Meltdown bug does not impact ARM CPUs, they define a special whereby certain system register contents can be leaked to ordinary processes but overall this seems less serious than the Intel variety. A PoC on ARM hardware is already . CVE-2017–5754 KPTI variant 3a running I suspect that Spectre will be the bug that keeps on giving. It will certainly haunt us for years to come as been pointed out by the researchers who found this vulnerability. Its implications are deeper and are more difficult to mitigate. Unlike Meltdown, Spectre equally impacts ARM and AMD devices. This means that phones and tablets are in the frame too for Spectre related data leaks. There are two variants of Spectre. The first is termed Bounds Check Bypass ( ). Basically this requires a rather particular sequence of code including a range check of a conditional value. It uses the branch prediction to execute a block of code that shouldn’t be executed. The idea is to train the branch predictor to execute some conditional code and then pass in a value that means it shouldn’t. However the conditional check needs to be carefully constructed so that it can’t be evaluated straight away. Thus, rather than wait and waste time, the CPU will go ahead and execute the conditional code just like it did last time. What’s the harm, right? There is nothing better for it to do. The conditional code is constructed to load data from an arbitrary, attacker controlled, memory location and then use that data as an address to load from memory again. There are obvious similarities with Meltdown here. That second load leaves its impact in the cache layout even after the processor catches up with itself and realises it should have never executed that code path after all. So basically you can read any piece of memory that the process can read. You also need a relatively contrived code sequence to do it, one that is less likely to occur naturally so you really need to be able to generate that code yourself. The bug allows you to effectively load from memory that the process can load from anyway. What’s the big deal you might ask. Well the big deal is JIT and user generated code that is running in the context of a process. Memory bound checks will typically ensure that such code cannot just read arbitrary memory, only the parts it is allowed to in its little sandbox. This Spectre variant allows escape from the sandbox. The disclosure shows how Javascript can be constructed that is then JITted to generate the exact sequence to exploit this bug. Now Javascript running in a web page can potentially access all of the browser process memory. This might include all sorts of passwords, credentials, cookies and other useful confidential tidbits that should not be accessible to whatever rogue Javascript running advert wants to steal your data. The fact that many browsers run each tab in a separate process doesn’t seem quite like the act of extreme tin-foil hatted-ness that I thought it once was. Suddenly it seems awfully prescient. The other thing I discovered yesterday for the first time is that even the Linux kernel has a JIT! Apparently there is a thing called that can be exploited to leak arbitrary kernel data. Needless to say that fixes are in the pipeline for all these things, but they are more complex and require different code sequences to be generated with special fence instructions to ensure that bad speculations cannot leak confidential data in this way. The wider, longer term implication of all this is you can’t trust user code that you allow to run in the context of your process unless you really think about it. Even if you sandbox that code so you limit what it can access that won’t necessarily be sufficient. Suddenly we have to realise programs live in a strange quantum like world, and can actually take code paths that they never should. The veil of abstraction over speculation execution has been breached. CVE-2017–5753 eBPF Now we come to the second variant of Spectre, Branch Target Injection ( ). This one seems the most bizarre of them all. Again this is related to branch prediction, but this time to indirect branches. Indirect branches happen reasonably frequently, especially in object oriented languages that allow polymorphic method overrides. So it is quite important to speed them up, otherwise they would be rather slow. This is because the CPU can’t even start filling its pipeline until it knows what instruction to go to next, and modern CPUs have rather long pipelines to be filled. As it turns out, where a particular indirect branch went last time is a rather excellent predictor of where it will go next time. So again, in the absence of anything better to do, a typical CPU will do exactly that and execute speculatively to the last target. To support this there is a table in the CPU called the Branch Target Buffer (BTB) that records a mapping from an instruction address to where that instruction will likely go to if it is an indirect branch. So this gets updated when the determination is made to predict for next time. Of course this table can’t be infinitely big and there are some collisions between the entries but most frequently executed instructions will be retained. It acts just like a cache of recent indirect branches and in some architectures is called a Branch Target Address Cache (BTAC). The BTB content is retained if your code stops executing and then passes to the kernel and then perhaps on to some other process running on the same core. It makes sense to keep the entries because some of the valid ones might still be there by the time it is your code’s turn to execute again. There is no point in throwing away potentially useful information that speeds up execution and what is the harm? If the target address was wrong then the CPU didn’t have anything better to do anyway, and the incorrect execution can just be rolled back as if it never happened and then the correct destination can be branched to. Well I’m sure you can see where this is going. As we know already, speculative execution is not without side effects as it turns out and these can be exploited. CVE-2017–5715 The really clever trick with Spectre Branch Target Injection is that an attacker can get to choose what code is speculatively executed. If the attacker knows the address of a particular indirect branch then they can train the BTB to point to where they want it to. That needs to be code that is already in the process being attacked, but let’s presume that the attacker knows what and where that code is. The code doesn’t need to execute cleanly, it just needs to execute long enough that it is going to leak something useful into the cache state to examine later. This code is speculative, and it will be the wrong prediction anyway, so will be rolled back. So basically if the attacker wants to know the value of a particular register at an indirect branch call site then they need to find some code that uses that register in an address calculation and memory load that will leave a distinctive enough trace in the cache state. There is an extremely strong parallel here with ROP gadgets. These are short sequences of existing code that an attacker can cobble together to do something useful if they can cause a buffer overflow in a process that allows them to control a target address, but can’t inject new code. Buffer overflows and ROP gadget chains are the scourge of application security. What we have in the Spectre case are speculation gadgets. We can choose just the right existing code sequence in the existing code that will give us the leakage signature that we want. Unlike ROP gadgets though we don’t need an existing vulnerability like a buffer overflow to exploit them. We just need to have run earlier and have set our trap in the BTB to force another process’s code to incorrectly speculate and leave us some useful state in the cache that we can examine later. Of course in practice this is hard to setup and seems to be much easier to leak small blobs of information (such as individual bytes or words) rather than data blocks since our poisonous BTB training is soon undone and we have limited capacity for transmitting data through the cache state. It seems to me that the most obvious use for such an attack is for software key logging. Potentially every register that is live at an indirect branch site is susceptible to leakage. We just need to find one that, for instance, holds the value of the last key press on a system. This may of course be part of a password or confidential message. Not good. Note that in order to exploit this Spectre variant it is necessary to know the exact code layout of the process you are trying to attack. You need to know this so you can set your BTB trap correctly for the indirect branch that is being subverted. Since Address Space Layout Randomization ( ) is widely used nowadays, as a defence against ROP Gadget attacks, this is not necessarily straightforward. There are various techniques around to try and infer the code addresses but this does add another layer of complication in the already byzantine causal chain required to make this attack actually work. ASLR Fixes are also in the works for this flaw. In particular the approach relies on BTB training existing beyond the boundary of a context switch. Intel have a coming that will disable the retention of the entries across the boundary, effectively rendering this bug unexploitable. ARM have similar patches available that can disable or clear the BTB across context switch boundaries. At this stage it is unclear what the performance impact of this is going to be. There is definitely going to be some. The BTB content is traditionally retained for good performance reasons. Compiler patches are also coming in the form of the new “ ” feature. This allows an application to be recompiled so that it is no longer susceptible, or indeed the kernel can be recompiled with this feature on. This is particularly for cases where an application might be run in an unpatched environment. Retpolines seem rather ugly but fix the issue. They basically cause the compiler to replace indirect branches and calls with a more complicated and slower sequence that abuses the return instruction to do the same thing. This is much slower but not susceptible to Spectre as returns don’t use the BTB for prediction. It is unclear when and if similar Retpoline fixes will come for other compiled and JITted languages such as Java, C#, Python or Go.In part two I discuss what this all means for mobile security. These bugs are definitely not restricted to Intel devices only. microcode update retpoline Thanks for reading! For more information on mobile API security, check out . www.approov.io I’d really appreciate it if you recommend this post (by clicking the 👏 button) so other people can find it.

You Just Need to Speculate to Exfiltrate

My New Year’s Day ritual has been the same for nearly 10 years now: a late breakfast, a cup of strong coffee and a scan of security blogs and news for two things that always make me chuckle: cyber predictions for the new year, and a retrospective that declares the past year the “Year of the Data Breach.” perfectly and I actually thought we might go a year without the latter, until I found this headline on Bloomberg news in which : Kelly Shortridge parodied the former 2017 is named the Year of the Data Breach Source: Bloomberg; https://www.bna.com/2017-year-data-b73014473359/ If you are wondering to yourself, It’s nearly 10 of the last 12 years, to be exact. where have I seen this before…? every year. Here’s a retrospective on the last 12 years and a glimpse into 2018’s prospects. 2005 2005 was the first year ever to be declared “The Year of the Data Breach” by many media outlets, such as . The phrase “data breach” entered into everyday usage in 2005 as well, due to data breach notification laws being enacted, litigation as well as , and all disclosing incidents. InfoWorld increased data breach Ameritrade CitiGroup CardSystems 2006 2006 was a big year for data breaches — it featured the and the breach. It caused and one to dub 2006 the year of the data breach. AOL search data leak scandal US Department of Veterans Affairs one blogger security vendor 2007 , the and the Canadian Federal Privacy Commissioner in a all declared 2007 “the year of the data breach.” I remember 2007 for two things: and the . Attrition.org Identify Theft Resource Center letter to Parliament Britney Spears’ sad meltdown TJ Maxx data breach 2008 Nothing! 2008 is not the year of the data breach! Good job, 2008. 2009 If 2005, 2006 and 2007 were all the year of the data breach, 2009 is the year of the MEGA DATA BREACH, and . It was a big one, primarily due to the Heartland Payment Systems which was a compromise of 130 million records. according to Forbes a security vendor data breach 2010 After the MEGA year of 2009, we all decided to take a break. 2011 After 2008 and 2010 were the year of the data breach, it was as if security journalists, vendors and cyber experts all stood up and shouted, in unison, “NEVER AGAIN! There shall never be a year that is the Year of the Data Breach!” not not And a good year it was. Trend Micro and Brian Krebs, among many others . The most notable incident was the Sony Playstation Network . called it referenced it suffering a prolonged service outage and data breach 2012 A small security vendor, , named 2012 the “Year of the Data Breach,” with breaches at , and several high-profile incidents in the government sector dominating the news. It was also the “Year of the Data Breach in New Zealand,” . in a year end retrospective Yahoo Zappos according to the country’s privacy commissioner 2013 2009 wants its adjective back. Symantec, , dubbed 2013 the “Year of the Mega Data Breach,” citing attacks on small and medium-sized businesses and the government sector. the “Year of the Retailer Breach” due to incidents at and . in the 2013 Internet Security Threat Report Others called it Target Adobe 2014 Assuming we could only have one “Year of the Data Breach,” 2014 would have to be the strongest contender. There were a in 2014: UPS, Michael’s, Home Depot, Jimmy John’s, Staples and JP Morgan Chase. The aforementioned are all eclipsed by, (according to Fortune): the Sony Pictures Entertainment hack. massive amount of incidents The Hack of the Century Most media outlets dubbed 2014 the “Year of the Data Breach,” as well as , and Tripwire’s . Advisen Trend Micro State of Security 2015 I declare 2015 the “Year of Superlatives.” Here is how the year was reported: Fortune reported 2015 as the “ Year of Data Breach Litigation.” Security vendor IDM365 called it the “ ” Year of the Super Mega Breach Trend Micro just called it the plain old “ .” However, Trend Micro also the Year of the Data Breach. Year of the Data Breach declared 2014 Vice.com called 2015 the “ ” Year of the Healthcare Breach Hacked.com called it the “ ” Year of the Personal Data Breach GovTech.com settled on “ ” The Year Data Breaches Became Intimate HIPAA Journal called 2015 the “ ” Year of the Mega Healthcare Data Breach Many Americans were affected by data breaches in 2015, with the most notable incidents occurring at , , and the . Ashley Madison OPM Anthem IRS 2016 After 2014 and 2015, one would think it would be time to retire the phrase “Year of the…” and think of something else. Nope. A , , and a named 2016 the “Year of the Data Breach.” small law firm specializing in data privacy SecureWorld radio host In a completely perplexing statement, Ars Technica recognized 2014 and 2015 as the “Year of the Data Breach” and also : issued a challenge [I]f pundits don’t label [2016] ‘the year of the data breach’ — like a one-phase Chinese zodiac for the 21st century — they’re not doing their jobs at all. 2017 Bloomberg the “Year of the Data Breach,” citing incidents at , and . Experian also . declared 2017 Equifax Yahoo Uber jumped on the bandwagon 2018: a cyber prediction Combining my two favorite things: cyber predictions and “year of the data breach” declarations, the non-profit (ISF) Information Security Forum stated that 2018 will be the “year of the data breach.” Conclusion Much has been written about . I have no doubt that breach fatigue is real and headlines like this, year over year, contribute to it. When headlines about cybersecurity cross the line into hyperbole, it’s time to re-think how we present the industry’s most pressing problems to the rest of the world. As it stands now, declaring a year the “year of the data breach” has become virtually meaningless. We know that data breaches are going to occur every year. Perhaps, starting this year, we can pull out the one notable data breach as the “Data Breach of the Year,” instead of naming the whole year the “Year of the Data Breach.” consumer data breach fatigue

Will the Real “Year of the Data Breach” Please Stand Up?

Determining ‘right’ and ‘wrong’ for subjective crowd input using a global expertise bank and expertise-weighted reviews In my last article, I wrote about — using human intelligence and experience to answer questions that and AI cannot answer. the need for Social Search Google For a social search platform like (or any system that relies on crowd intelligence) to work and to offer high quality responses**,** there needs to exist — for categorizing answers as better or worse, right or wrong. Without a mechanism to measure ‘correctness’ of an answer, there would be no way to rank or filter the answer space. Furthermore, in a crowdsourcing platform that offers rewards or penalties to encourage responders to participate, there’d be no way to determine which responders to reward, which responders to penalize, and by how much. Proffer a reliable system for evaluating crowd-provided answers (subjecting an answer to the scrutiny of other experts in the same field) is the traditional approach for assessing crowd inputs. It’s a powerful idea and widely practiced in academia and online communities, but suffers from political manipulation, a lack of granularity/specificity in the measurement of expertise, an ability for reviewers to falsely accumulate expertise, and an unnatural constraint whereby votes from skilled and unskilled reviewers have equal impact on the outcome. Peer review In building Proffer, we sought to create a protocol for decentralized peer review that avoids the pitfalls of traditional peer review and runs on the , adapting to cover future crowdsourcing and social search use cases on a global scale. blockchain Don’t want to read? Go through the slides for a protocol overview and example. This article is structured as follows: Problems with peer review as implemented today Solution and Key Features: a novel peer review platform built on the concept of , where reviews are weighted by the reviewers’ expertise, where ‘correctness’ of answers is based on cumulative skill of its supporters minus that of its detractors, and where expertise for all reviewers for all topics is stored and updated on the ( ). self-optimizing expert networks blockchain global expertise bank Walkthrough of crowdsourced peer review on Proffer, a Physics Q&A use case. Bootstrapping a global expertise bank (what happens at t=0) Problems with Traditional Peer-Review It puts significant power in the hands of a few without offering the necessary checks and balances, or the necessary incentives to encourage unbiased, thoughtful reviews. Just ask the academic community — e.g. in , Chris Lee describes academic peer review as “utter randomness,” citing the undue influence that reviewers’ “mood, medication, and memory” play on the outcome. He proposes a decentralized peer review process for academic publications that opens up each review to a crowd of 100+ panelists and significantly improves upon the quality and efficiency of traditional peer review. Peer Review is politically influenced: this Ars Technica article For example, anyone can endorse anyone for any skill on LinkedIn. Reddit users can accumulate ‘karma’ from one subreddit (e.g. ) to qualify them to post on a completely unrelated subreddit (e.g. ). It’s hard for our computational systems to identify true expertise, and such systems can be fooled. Expertise should be measured based on actions and outcomes, not on self- or crowd-reported inputs with a single data point. Expertise is arbitrary, inaccurate, and easily manufactured. /r/dogs /r/ethereum across apps, i.e. Reddit “karma” for blockchain topics doesn’t carry any weight on Stack Exchange or Quora blockchain topics. A ‘top writer’ for Artificial Intelligence on a Medium blog will see no benefits of that reputation when posting on an AI thread on Reddit. Users are forced to re-create their reputation on each new platform or app they join, and must maintain this reputation separately cross the various platforms, leading to a missed opportunity for effects and usage driven by shared reputation across apps. Expertise is fragmented network Crowdsourced Peer Review: Key Features : stores every user’s in every topic on a common decentralized ledger. It is ‘global’ as opposed to ‘fragmented’ because all dApps read/write expertise to this bank rather than maintaining their own application-specific skill stores. A global expertise bank benefits from and creates shared network effects across multiple applications — a user can switch from one math tutoring dApp to another while retaining his/her expertise in topic ‘Math’. Global expertise bank skill A mechanism to objectively determine correctness of a subjective answer by the cumulative expertise of those who answered or upvoted it minus those who downvoted it. This allows more skillful responders to have a greater influence on the correctness of a response than less skillful responders. Skill-weighted peer reviews: A network of experts where expertise can be gained or lost by any individual, pushing the network closer to ground-truth over time. i.e. false expertise gets filtered out as incorrect responders lose skill, and true experts rise to the top as they provide correct responses repeatedly. Self-optimizing expert network: Crowdsourced peer review on Proffer: a Physics Q&A example Step 1: Receive a question from Seeker, broadcast to qualified responders Seeker asks a question that he/she wants crowd input on, e.g. “Why is the sky blue?” Seeker optionally backs the question with money ( ) that will be distributed among correct responders. This seeds an incentive pool called . A new token backing pool is created question that is asked on the platform. SeekerStake SeekerStake Token Backing Pool for each Step 2: Start peer review process. Receive answers and votes from responders Responders a.k.a peer reviewers see the question and by other responders. Counterintuitively, responders must also contribute a stake ( ) to the as an expression of their confidence in their response; this stake is returned to them unless their answer is deemed incorrect (explained below) by the peer review protocol. The requirement of a dis-incentivizes spam and puts responders’ skin in the game. can either respond with a new answer, or upvote/downvote answers previously submitted ResponderStake Token Backing Pool ResponderStake Step 3: Compute the net ‘skill’ supporting each submitted answer The protocol keeps track of the “net skill” backing each answer that is added to the answer space. The for an answer is equal to the skill of the responder who first proposed it (+) skill of all responders who upvoted it (-) the skill of all responders who downvoted it. is a skill-weighted measure of the correctness of an answer at any given point in time. SkillBacking plus minus SkillBacking “Skill” here refers to the very specific / granular skill of the user in the topic being addressed in the question, which in this case can be ‘Physics’ or ‘Optical Phenomenon’. The skill is read from the and written back to it each time it’s updated. Global Expertise Bank Shown above, five different responders (Joe / Sam / Jenny / Andrea / Brett) contribute five new answers to the question “Why is the sky blue?”, paying into the for each answer. Answer Stake Token Backing Pool Shown below, 15 different responders, named P1 thru P15, choose to upvote or downvote the five answers already in the Answer Space, paying into the for each vote. Note that each vote updates the net skill backing of each answer: an upvote adds the upvoter’s skill and downvote reduces net skill by the downvoter’s skill. Vote Stake Token Backing Pool Step 4: Use net ‘Skill Backing’ to determine which answers are Correct/Incorrect and accordingly compute payouts for each responder After P1 thru P15 have submitted their votes, the answer space has five answers, each with a net skill backing. At this point, we can either use a heuristic such as “net skill backing is > zero” to determine which answers are correct, or we can present all options to the Seeker who initially asked the question and allow him / her to choose what is the correct answer. The best way to determine ‘correctness’ will depend on use case, so our protocol provides two configurable parameters rather than prescribing the judge of correctness/incorrectness: Let’s assume for this example that = ‘seeker’ and = ‘peers’. This means that we can determine incorrect answers based on net skill backing. Answer 3, which received a net skill backing of -70, and Answer 5 with net skill backing of -15 are therefore . Judge of Correctness Judge of Incorrectness Incorrect Answer 2 is deemed because we make the assumption that the Seeker will select Answer 2 as the best answer since it has the highest net skill backing. Answers that are neither Correct nor Incorrect are labeled . Correct undecided We now use the following guidelines to compute two types of payouts — financial and skill — for each responder: Guidelines for financial and skill payouts for each responder Skill is an open/indefinite quantity. It can be given freely and taken freely. Performing skill payouts is therefore as easy as increasing or decreasing the responder’s skill on the Global Reputation Bank for the topic at hand. Skill updates after Answers 3 and 5 determined to be and Answer 2 to be . Incorrect Correct Money / tokens on the other hand are a closed / zero-sum quantity. They are re-distributed, not created, from incorrect responders to correct responders. The protocol first returns the money that responders with Correct responses and undecided responses had put into the at the start of the process. Token Backing Pool The remainder in the pool after these stakes have been returned consists of the original SeekerStake, and the AnswerStake(s) and VoteStake(s) of incorrect responders. Finally, this amount can be distributed across correct responders as their reward for answering or voting correctly. Possible outcomes in crowdsourced peer review. Incorrect responders lose what they had put in. Correct responders recover what they had put in AND get an additional reward. Bootstrapping the Global Expertise Bank: getting it right at t=0 In steady state, the self-optimizing expert network described above updates the expertise of each responder over time based on his/her current expertise, his/her response, the crowd’s current expertise, and the crowd’s responses. Expertise of person ‘p’ at time ‘t+1’ is a function of that same person’s expertise and response at time ‘t’, and the crowd’s expertise and response at time ‘t’ As long as expertise in the system is a reliable metric at time , we can rest assured that it will be reliable at time , getting closer to ground truth / ‘actual’ expertise of all users with time. t t+1 Our peer review protocol and the global expertise bank are capable of working out of the box, with all responders starting off with Skill = zero across all topics. The law of large numbers will ensure that with enough iterations, responders who started off with no skill will have won or lost skill based on the crowd’s voting for or against them, equilibrating somewhere close to their actual skill relative to their peers. However, to improve the rate at which this skill equilibrium is reached, and to provide the highest quality answers right from , particularly for industry topics that require specialized knowledge or certification, , both online and offline, formal and informal. t=0 we propose bootstrapping the expert network by manually selecting and on-boarding experts from pre-existing networks For example, in the field of healthcare, one could onboard physician networks and initialize skill for each physician in their respective practice (‘Cardiology’, ‘General Medicine’, etc.) based on a combination of past experience and in-person interviews. The same can be done with practicing lawyers for topics concerning the Law, with school teachers for topics in k-12 education, with land developers and construction teams for topics concerning real estate, etc. Seeding an expert network through a manual process would be neither trivial nor quick, but in a world where the nature of work is already tending towards ad-hoc gigs that allow workers to monetize their free time, an expert network on the blockchain with frictionless reward payments for experts who answer correctly could be an exciting platform to be a part of. This would be especially true for Proffer’s global expertise bank, as experts would be able to leverage reputation accumulated answering questions on Proffer while using other dApps built on the same global expertise bank. If you’re curious to learn more about Proffer, the social search protocol we’re building on top of crowdsourced peer review and self-optimizing expert networks, check out our tech spec here , and the 5 apps we’ve published to showcase five different use cases for Proffer on our website here .

ARS TECHNICA

arstechnica.com

51-200 employees

Since 1998

COMPANY RANKING

ARS TECHNICA

EVERGREEN INDEX #1544

Representing this company? Click here to claim and customize this page!

Ars Technica WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

ARS TECHNICA

arstechnica.com

51-200 employees

Since 1998

COMPANY RANKING

ARS TECHNICA

EVERGREEN INDEX #1544

RELATED COMPANIESRANK

STORIES ABOUT ARS TECHNICA

Representing this company? Click here to claim and customize this page!

Ars Technica WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!