Researchers at the United States Geological Survey and the Arkansas government announced on Monday that they had found a trove of lithium, a critical raw material for electric vehicle batteries, in an underground brine reservoir in Arkansas. From a report: With the help of water testing and machine learning, the researchers determined that there might be five million to 19 million tons of lithium -- more than enough to meet all of the world's demand for the metal -- in a geological area known as the Smackover Formation. Several companies, including Exxon Mobil, are developing projects in Arkansas to produce lithium, which is dissolved in underground brine. Energy and mining companies have long produced oil, gas and other natural resources in the Smackover, which extends from Texas to Florida. And the federal and state researchers said lithium could be extracted from the waste stream of the brines from which companies extracted other forms of energy and elements. The energy industry, with the Biden administration's encouragement, has been increasingly working to produce the raw materials needed for the lithium-ion batteries in the United States. A few projects have started recently, and many more are in various stages of study and development across the country. Most of the world's lithium is produced in Australia and South America. A large majority of it is then processed in China, which also dominates the manufacturing of electric vehicle batteries. "The potential for increased U.S. production to replace imports has implications for employment, manufacturing and supply chain resilience," David Applegate, the director of the United States Geological Survey, said in a statement announcing the study. "This study illustrates the value of science in addressing economically important issues."

Read more of this story at Slashdot.

Apple CEO Tim Cook has acknowledged the company's late entry into AI, stating, "We weren't the first to do intelligence." Despite this admission, Cook defended Apple's approach, claiming it will be "the best for the customer." The tech giant plans to roll out initial AI features on October 28, with more advanced capabilities expected in 2025. However, internal studies suggest Apple's AI lags behind competitors, with Siri reportedly 25% less accurate than ChatGPT. Cook remains optimistic, asserting that AI will make users' time on iPhones "profoundly different."

Read more of this story at Slashdot.

Actor Nicolas Cage warned young performers about the dangers of AI in film production during his speech at the Newport Beach Film Festival on Sunday. Cage urged actors to protect their craft from employment-based digital replica (EBDR) technology, which allows studios to manipulate performances post-filming. "This technology wants to take your instrument," Cage said. He explained that EBDR enables studios to alter actors' faces, voices, and body language after shooting, potentially compromising artistic integrity. Cage cited his cameo in "The Flash" as an example of EBDR use. He advised actors to consider their rights when approached with contracts permitting EBDR, coining the phrase "MVMFMBMI: my voice, my face, my body, my imagination."

Read more of this story at Slashdot.

Apple's latest iOS update has removed the "C" button from its Calculator app, replacing it with a backspace function. The change, part of iOS 18, has sparked debate among users accustomed to the traditional clear function. The removal of the "C" button represents a significant departure from decades-old calculator design conventions, The Atlantic writes. From the story: The "C" button's function is vestigial. Back when calculators were commercialized, starting in the mid-1960s, their electronics were designed to operate as efficiently as possible. If you opened up a desktop calculator in 1967, you might have found a dozen individual circuit boards to run and display its four basic mathematical functions. Among these would have been an input buffer or temporary register that could store an input value for calculation and display. The "C" button, which was sometimes labeled "CE" (Clear Entry) or "CI" (Clear Input), provided a direct interface to zero out -- or "clear" -- such a register. A second button, "AC" (All Clear), did the same thing, but for other parts of the circuit, including previously stored operations and pending calculations. (A traditional calculator's memory buttons -- "M+," "M-," "MC" -- would perform simple operations on a register.) By 1971, Mostech and Texas Instruments had developed a "calculator on a chip," which condensed all of that into a single integrated circuit. Those chips retained the functions of their predecessors, including the ones that were engaged by "C" and "AC" buttons. And this design continued on into the era of pocket calculators, financial calculators, and even scientific calculators such as the ones you may have used in school. Some of the latter were, in essence, programmable pocket computers themselves, and they could have been configured with a backspace key. They were not.

Read more of this story at Slashdot.

Baidu CEO Robin Li has proclaimed that hallucinations produced by large language models are no longer a problem, and predicted a massive wipeout of AI startups when the "bubble" bursts. From a report: "The most significant change we're seeing over the past 18 to 20 months is the accuracy of those answers from the large language models," gushed the CEO at last week's Harvard Business Review Future of Business Conference. "I think over the past 18 months, that problem has pretty much been solved â" meaning when you talk to a chatbot, a frontier model-based chatbot, you can basically trust the answer," he added. Li also described the AI sector as in an "inevitable bubble," similar to the dot-com bubble in the '90s. "Probably one percent of the companies will stand out and become huge and will create a lot of value or will create tremendous value for the people, for the society. And I think we are just going through this kind of process," stated Li. The CEO also guesstimated it will be another 10 to 30 years before human jobs are displaced by the technology. "Companies, organizations, governments and ordinary people all need to prepare for that kind of paradigm shift," he warned.

Read more of this story at Slashdot.

Intel and Boeing, once exemplars of American manufacturing prowess, now face existential crises. Their market values have plummeted, jeopardizing not just shareholder wealth but national security. The U.S. is losing its edge in manufacturing high-tech products, crucial in its geopolitical contest with China, a story on WSJ argues. Unlike past manufacturing declines, Intel and Boeing's woes stem from internal missteps, prioritizing financial performance over engineering excellence. Their potential demise threatens America's semiconductor and commercial aircraft industries, with far-reaching consequences for the nation's technological ecosystem. While government intervention is controversial, national security concerns may necessitate support. WSJ adds: So, much as national leaders would like to ignore these companies' woes, they can't. National security dictates the U.S. maintain some know-how in making aircraft and semiconductors. Certainly other countries feel that way: European governments heavily subsidized Airbus. China is pursuing dominance in key technologies regardless of the cost. Its so-called Big Fund has sunk roughly $100 billion into semiconductors while aid to Comac had reached $72 billion in 2020, according to the Center for Strategic and International Studies. "Until Comac succeeds in gaining significant global market share, it will continue to run big losses and be bailed out by the Chinese government," said Atkinson, whose organization gets support from Boeing. Both political parties have bought into the idea that manufacturing is special and thus deserving of public support. That raises the question: which manufacturing, and what kind of support? The goal of manufacturing strategy shouldn't be just producing jobs but great, world-beating products. [...]

Read more of this story at Slashdot.

News Corp's Dow Jones & Co., publisher of the Wall Street Journal, and the New York Post have sued Perplexity, a startup that calls itself an "AI-powered Swiss Army Knife for information discovery and curiosity," alleging copyright infringement. From a report: "Perplexity is a generative artificial intelligence company that claims to provide its users accurate and up-to-date news and information in a platform that, in Perplexity's own words, allows users to 'Skip the Links' to original publishers' websites," the companies said in the federal lawsuit, filed Monday. "Perplexity attempts to accomplish this by engaging in a massive amount of illegal copying of publishers' copyrighted works and diverting customers and critical revenues away from those copyright holders. This suit is brought by news publishers who seek redress for Perplexity's brazen scheme to compete for readers while simultaneously freeriding on the valuable content the publishers produce."

Read more of this story at Slashdot.

jd writes: Linus Torvalds is not a happy camper and is condemning hardware vendors for poor security and the plethora of actual and theoretical attacks, especially as some of the new features being added impact the workarounds. These workarounds are now getting very expensive, CPU-wise. TFA quotes Linus Torvalds: "Honestly, I'm pretty damn fed up with buggy hardware and completely theoretical attacks that have never actually shown themselves to be used in practice. "So I think this time we push back on the hardware people and tell them it's *THEIR* damn problem, and if they can't even be bothered to say yay-or-nay, we just sit tight. Because dammit, let's put the onus on where the blame lies, and not just take any random shit from bad hardware and say 'oh, but it *might* be a problem.'"

Read more of this story at Slashdot.

chalsall writes: After more than six years of work since the last discovery, the Great Internet Mersenne Prime Search (GIMPS) has found the 52nd known Mersenne Prime number. This is also the largest prime number known to humans. The number is 2^136,279,841-1, which is 41,024,320 decimal digits long. Luke Durant, a researcher from San Jose, CA, found it after contributing a fantastic amount of compute to the GIMPS project.

Read more of this story at Slashdot.

Egypt was declared malaria-free by the World Health Organization, after nearly a century of work to eradicate the disease in the country. From a report: Egypt saw 3 million cases a year in the 1940s, and the Aswan Dam's development in the 1960s created new bodies of standing water for the mosquitoes to breed in, but by 2001 the disease was "firmly under control," according to the WHO. "The disease that plagued pharaohs now belongs to [Egypt's] history," the WHO's chief said. It's the 44th country to be certified, but the wider battle against malaria goes on: The mosquito-borne disease still kills around 600,000 people a year, the large majority of them children in sub-Saharan Africa.

Read more of this story at Slashdot.

An anonymous reader shares a report: Fans of literature most likely know Kurt Vonnegut for the novel Slaughterhouse-Five. The staunchly anti-war book first resonated with readers during the Vietnam War era, later becoming a staple in high school curricula the world over. When Vonnegut died in 2007 at the age of 84, he was widely recognized as one of the greatest American novelists of all time. But would you believe that he was also an accomplished game designer? In 1956, following the lukewarm reception of his first novel, Player Piano, Vonnegut was one of the 16 million other World War II veterans struggling to put food on the table. His moneymaking solution at the time was a board game called GHQ, which leveraged his understanding of modern combined arms warfare and distilled it into a simple game played on an eight-by-eight grid. Vonnegut pitched the game relentlessly to publishers all year long according to game designer and NYU faculty member Geoff Engelstein, who recently found those letters sitting in the archives at Indiana University. But the real treasure was an original set of typewritten rules, complete with Vonnegut's own notes in the margins. With the permission of the Vonnegut estate, Engelstein tells Polygon that he cleaned the original rules up just a little bit, buffed out the dents in GHQ's endgame, and spun up some decent art and graphic design. Now you can purchase the final product, titled Kurt Vonnegut's GHQ: The Lost Board Game, at your local Barnes & Noble -- nearly 70 years after it was created.

Read more of this story at Slashdot.

Intuit, the maker of TurboTax software, asked technology news outlet The Verge to delete part of a podcast interview with CEO Sasan Goodarzi, The Verge reported on Monday. The request came after Goodarzi was questioned about Intuit's lobbying efforts against free government tax filing options, a topic that has drawn scrutiny from regulators and lawmakers. The Verge said it declined to remove the segment, instead choosing to highlight the exchange by playing it at the beginning of the episode. In the interview, Goodarzi disputed claims that Intuit lobbies against free tax filing, stating the company spends "a couple of million dollars fighting for simplified taxes." However, The Verge's editor Nilay Patel pressed Goodarzi on reports of Intuit's lobbying against government-provided tax returns. Patel adds: I got a note from Rick Heineman, the chief communications officer at Intuit, who called the line of questioning and my tone "inappropriate," "egregious," and "disappointing" and demanded that we delete that entire section of the recording. I mean, literally -- he wrote a long email that ended with "at the very least the end portion of your interview should be deleted."

Read more of this story at Slashdot.

Though Sam Altman once called OpenAI's partnership with Microsoft "the best bromance in tech," now "ties between the companies have started to fray" reports the New York Times — citing interviews with 19 people "familiar with the relationship". [Alternate URL here.] Among other things, Satya Nadella "has said privately that Altman's firing in November shocked and concerned him, according to five people with knowledge of his comments. Since then, Microsoft has started to hedge its bet on OpenAI," and reconsidered new investments beyond its initial $13 billion — even as OpenAI expects to lose $5 billion this year That tension demonstrates a key challenge for AI startups: They are dependent on the world's tech giants for money and computing power because those big companies control the massive cloud computing systems the small outfits need to develop AI... Over the past year, OpenAI has been trying to renegotiate the deal to help it secure more computing power and reduce crushing expenses while Microsoft executives have grown concerned that their AI work is too dependent on OpenAI... [I]n March, Microsoft paid at least $650 million to hire most of the staff from Inflection, an OpenAI competitor... In June, Microsoft agreed to an exception in [OpenAI's] contract, six people with knowledge of the change said. That allowed OpenAI to sign a roughly $10 billion computing deal with Oracle for additional computing resources, according to two people familiar with the deal. Oracle is providing computers packed with chips suited to building AI, while Microsoft provides the software that drives the hardware... While it was looking for computer power alternatives, OpenAI also raced to broaden its investors, according to two people familiar with the company's plan. Part of the plan was to secure strategic investments from organizations that could bolster OpenAI's prospects in ways beyond throwing around money. Those organizations included Apple, chipmaker Nvidia, and MGX, a tech investment firm controlled by the United Arab Emirates... Earlier this month, OpenAI closed a $6.6 billion funding round led by Thrive Capital, with additional participation from Nvidia, MGX and others. Apple did not invest, but Microsoft also participated in the funding round. OpenAI expected to spend at least $5.4 billion in computing costs through the end of 2024, according to documents reviewed by The New York Times. That amount was expected to skyrocket over the next five years as OpenAI expanded, soaring to an estimated $37.5 billion in annual computing costs by 2029, the documents showed... Still, OpenAI employees complain that Microsoft is not providing enough computing power, according to three people familiar with the relationship. And some have complained that if another company beat it to the creation of AI that matches the human brain, Microsoft will be to blame because it hasn't given OpenAI the computing power it needs, according to two people familiar with the complaints. Oddly, that could be the key to getting out from under its contract with Microsoft. The contract contains a clause that says that if OpenAI builds artificial general intelligence, or AGI — roughly speaking, a machine that matches the power of the human brain — Microsoft loses access to OpenAI's technologies.

Read more of this story at Slashdot.

"Several of Europe's biggest carmakers unveiled low-cost electric vehicles at the Paris Motor Show this week," reports CNBC. The automakers are "seeking to jump-start a demand slump and recapture some of the market share now held by Chinese brands." "It feels like Europe is fighting back," Julia Poliscanova, senior director for vehicles and e-mobility supply chains at the Transport & Environment campaign group, told CNBC at the Paris Motor Show. "There are so many new models on show, and what is really great is that there are a lot of launches that are more affordable. So, Citroen, Peugeot [and] Renault, they are all showing some smaller affordable models," Poliscanova said. "This is exactly what we need for the mass market, for people to buy those vehicles more, and this is also where the competition from the Chinese is also the hardest," she added... "The storytelling is that people have cooled off on EVs and there is no consumer demand, [but] this is really not true," Transport & Environment's Poliscanova said. "This year in Europe, we did not have affordable models, so people are not buying those overpriced premium vehicles. However, as soon as vehicles come in the right price range next year ... people will flock to buy them." Poliscanova said the launch of several low-cost EVs means electric car sales could account for up to a 24% market share next year, up from 14% this year. Chinese-made EVs typically cost less than half the prices seen in Europe and the U.S. last year, according to figures published by data firm JATO, underscoring the challenge for Western automakers to keep pace with Beijing... Pere Brugal, president and managing director of GM Europe, said that the challenges facing Europe's auto industry should be seen as a transitional phase — and not evidence of a crisis. "The adoption of new technologies and new behaviors is never a linear growth story, but the end is full-electric [vehicles]," Brugal told CNBC at the Paris Motor Show. Meanwhile, GM's CEO "says it will start making money on battery-powered models by the end of the year — becoming the only U.S. automaker aside from Tesla to achieve that feat," reports the New York Times (adding that sales are increasing "and the company just introduced a model that sells for less than $30,000 after a federal tax credit.") And GM "is still committed to doing away with combustion engine cars in the United States by 2035."

Read more of this story at Slashdot.

"Millions of Cubans remained without power for a third day in a row Sunday," reports CNN, "after fresh attempts to restore electricity failed overnight and the power grid collapsed for the fourth time — all before the arrival of Hurricane Oscar." A report from Reuters notes it was the fourth power grid failure in 48 hours. "On the forecast track, the center of Oscar is expected to continue moving across eastern Cuba tonight and Monday, then emerge off the northern coast of Cuba late Monday and cross the central Bahamas on Tuesday," the U.S. National Hurricane Center said. The Communist-run government canceled school through Wednesday — a near unprecedented move in Cuba — citing the hurricane and the ongoing energy crisis... Cuba had restored power to 160,000 clients in Havana just prior to the grid's Sunday collapse, giving some residents a glimmer of hope... Energy and mines minister Vicente de la O Levy told reporters earlier on Sunday he expected the grid to be fully functional by Monday or Tuesday but warned residents not to expect dramatic improvements. It was not immediately clear how much the latest setback would delay the government's efforts.

Read more of this story at Slashdot.

An anonymous reader shared this report from ComicBook.com: On Saturday, 20th Century Studios announced that the latest entry in the Alien sci-fi horror franchise will get a limited-edition VHS release on December 3 — just in time for the holidays. The VHS release of Alien: Romulus is the first such release from a major studio since 2006... a major win for fans of physical media. In recent months, there has been a great bit of conversation surrounding the so-called death of physical media with the rise of digital and streaming with some retailers even having previously announced that they have or will be stopping sales of physical media. But with streaming platforms removing content for various reasons, there's been a rise in appreciation for physical media which has, in turn, resulted in increased sales, particularly when it comes to limited edition items such as Steelbooks [collectible steel-case disc releases]... Given that the Alien: Romulus VHS release is part of an overall celebration of the franchise for its 45th anniversary year, leaning into that nostalgia for feels pretty spot on. The release will present the movie "in a 4:3 aspect ratio," writes the Verge, "hopefully with well-done pan-and-scan..." (Their post includes a promotional picture showing the "slick, vintage-style" box-cover art.) "The tape has only the film," notes Gizmodo, "and no special featurette attached at the end, like some used to back in the day." Gizmodo also reminds readers of Hulu's 2025 series Alien: Earth and an upcoming videogame sequel to 2014's Alien: Isolation.

Read more of this story at Slashdot.

"After two years of being beaten with the memory-safety stick, the C++ community has published a proposal to help developers write less vulnerable code," reports the Register. "The Safe C++ Extensions proposal aims to address the vulnerable programming language's Achilles' heel, the challenge of ensuring that code is free of memory safety bugs..." Acknowledging the now deafening chorus of calls to adopt memory safe programming languages, developers Sean Baxter, creator of the Circle compiler, and Christian Mazakas, from the C++ Alliance, argue that while Rust is the only popular systems level programming language without garbage collection that provides rigorous memory safety, migrating C++ code to Rust poses problems. "Rust lacks function overloading, templates, inheritance and exceptions," they explain in the proposal. "C++ lacks traits, relocation and borrow checking. These discrepancies are responsible for an impedance mismatch when interfacing the two languages. Most code generators for inter-language bindings aren't able to represent features of one language in terms of the features of another." Though DARPA is trying to develop better automated C++ to Rust conversion tools, Baxter and Mazakas argue telling veteran C++ developers to learn Rust isn't an answer... The Safe C++ project adds new technology for ensuring memory safety, Baxter explained, and isn't just a reiteration of best practices. "Safe C++ prevents users from writing unsound code," he said. "This includes compile-time intelligence like borrow checking to prevent use-after-free bugs and initialization analysis for type safety." Baxter said that rewriting a project in a different programming language is costly, so the aim here is to make memory safety more accessible by providing the same soundness guarantees as Rust at a lower cost. "With Safe C++, existing code continues to work as always," he explained. "Stakeholders have more control for incrementally opting in to safety." The next step, Baxter said, involves greater participation from industry to help realize the Safe C++ project. "The foundations are in: We have fantastic borrow checking and initialization analysis which underpin the soundness guarantees," he said. "The next step is to comprehensively visit all of C++'s features and specify memory-safe versions of them. It's a big effort, but given the importance of reducing C++ security vulnerabilities, it's an effort worth making."

Read more of this story at Slashdot.

A principal security software engineer at Microsoft described how they use their Azure cloud platform "to hunt phishers at scale," in a talk at the information security conference BSides Exeter. Calling himself Microsoft's "Head of Deception." Ross Bevington described how they'd created a "hybrid high interaction honeypot" on the now retired code.microsoft.com "to collect threat intelligence on actors ranging from both less skilled cybercriminals to nation state groups targeting Microsoft infrastructure," according to a report by BleepingComputer: With the collected data, Microsoft can map malicious infrastructure, gain a deeper understanding of sophisticated phishing operations, disrupt campaigns at scale, identify cybercriminals, and significantly slow down their activity... Bevington and his team fight phishing by leveraging deception techniques using entire Microsoft tenant environments as honeypots with custom domain names, thousands of user accounts, and activity like internal communications and file-sharing... In his BSides Exeter presentation, the researcher says that the active approach consists in visiting active phishing sites identified by Defender and typing in the credentials from the honeypot tenants. Since the credentials are not protected by two-factor authentication and the tenants are populated with realistic-looking information, attackers have an easy way in and start wasting time looking for signs of a trap. Microsoft says it monitors roughly 25,000 phishing sites every day, feeding about 20% of them with the honeypot credentials; the rest are blocked by CAPTCHA or other anti-bot mechanisms. Once the attackers log into the fake tenants, which happens in 5% of the cases, it turns on detailed logging to track every action they take, thus learning the threat actors' tactics, techniques, and procedures. Intelligence collected includes IP addresses, browsers, location, behavioral patterns, whether they use VPNs or VPSs, and what phishing kits they rely on... The deception technology currently wastes an attacker 30 days before they realize they breached a fake environment. All along, Microsoft collects actionable data that can be used by other security teams to create more complex profiles and better defenses.

Read more of this story at Slashdot.

"Who asked for any of this in the first place?" wonders a New York Times consumer-tech writer. (Alternate URL here.) "Judging from the feedback I get from readers, lots of people outside the tech industry remain uninterested in AI — and are increasingly frustrated with how difficult it has become to ignore." The companies rely on user activity to train and improve their AI systems, so they are testing this tech inside products we use every day. Typing a question such as "Is Jay-Z left-handed?" in Google will produce an AI-generated summary of the answer on top of the search results. And whenever you use the search tool inside Instagram, you may now be interacting with Meta's chatbot, Meta AI. In addition, when Apple's suite of AI tools, Apple Intelligence, arrives on iPhones and other Apple products through software updates this month, the tech will appear inside the buttons we use to edit text and photos. The proliferation of AI in consumer technology has significant implications for our data privacy, because companies are interested in stitching together and analyzing our digital activities, including details inside our photos, messages and web searches, to improve AI systems. For users, the tools can simply be an annoyance when they don't work well. "There's a genuine distrust in this stuff, but other than that, it's a design problem," said Thorin Klosowski, a privacy and security analyst at the Electronic Frontier Foundation, a digital rights nonprofit, and a former editor at Wirecutter, the reviews site owned by The New York Times. "It's just ugly and in the way." It helps to know how to opt out. After I contacted Microsoft, Meta, Apple and Google, they offered steps to turn off their AI tools or data collection, where possible. I'll walk you through the steps. The article suggests logged-in Google users can toggle settings at myactivity.google.com. (Some browsers also have extensions that force Google's search results to stop inserting an AI summary at the top.) And you can also tell Edge to remove Copilot from its sidebar at edge://settings. But "There is no way for users to turn off Meta AI, Meta said. Only in regions with stronger data protection laws, including the EU and Britain, can people deny Meta access to their personal information to build and train Meta's AI." On Instagram, for instance, people living in those places can click on "settings," then "about" and "privacy policy," which will lead to opt-out instructions. Everyone else, including users in the United States, can visit the Help Center on Facebook to ask Meta only to delete data used by third parties to develop its AI. By comparison, when Apple releases new AI services this month, users will have to opt in, according to the article. "If you change your mind and no longer want to use Apple Intelligence, you can go back into the settings and toggle the Apple Intelligence switch off, which makes the tools go away."

Read more of this story at Slashdot.

Cybersecurity startup Watchtowr "was founded by hacker-turned-entrepreneur Benjamin Harris," according to a recent press release touting their Fortune 500 customers and $29 million investments from venture capital firms. ("If there's a way to compromise your organization, watchTowr will find it," Harris says in the announcement.) This week they shared their own research on a Fortinet FortiGate SSLVPN appliance vulnerability (discovered in February by Gwendal Guégniaud of the Fortinet Product Security team — presumably in a static analysis for format string vulnerabilities). "It affected (before patching) all currently-maintained branches, and recently was highlighted by CISA as being exploited-in-the-wild... It's a Format String vulnerability [that] quickly leads to Remote Code Execution via one of many well-studied mechanisms, which we won't reproduce here..." "Tl;dr SSLVPN appliances are still sUpEr sEcurE," their post begains — but the details are interesting. When trying to test an exploit, Watchtowr discovered instead that FortiGate always closed the connection early, thanks to an exploit mitigation in glibc "intended to hinder clean exploitation of exactly this vulnerability class." Watchtowr hoped to "use this to very easily check if a device is patched — we can simply send a %n, and if the connection aborts, the device is vulnerable. If the connection does not abort, then we know the device has been patched... " But then they discovered "Fortinet added some kind of certificate validation logic in the 7.4 series, meaning that we can't even connect to it (let alone send our payload) without being explicitly permitted by a device administrator." We also checked the 7.0 branch, and here we found things even more interesting, as an unpatched instance would allow us to connect with a self-signed certificate, while a patched machine requires a certificate signed by a configured CA. We did some reversing and determined that the certificate must be explicitly configured by the administrator of the device, which limits exploitation of these machines to the managing FortiManager instance (which already has superuser permissions on the device) or the other component of a high-availability pair. It is not sufficient to present a certificate signed by a public CA, for example... Fortinet's advice here is simply to update, which is always sound advice, but doesn't really communicate the nuance of this vulnerability... Assuming an organisation is unable to apply the supplied workaround, the urgency of upgrade is largely dictated by the willingness of the target to accept a self-signed certificate. Targets that will do so are open to attack by any host that can access them, while those devices that require a certificate signed by a trusted root are rendered unexploitable in all but the narrowest of cases (because the TLS/SSL ecosystem is just so solid, as we recently demonstrated)... While it's always a good idea to update to the latest version, the life of a sysadmin is filled with cost-to-benefit analysis, juggling the needs of users with their best interests.... [I]t is somewhat troubling when third parties need to reverse patches to uncover such details. Thanks to Slashdot reader Mirnotoriety for sharing the article.

Read more of this story at Slashdot.