Cybersecurity startup Watchtowr "was founded by hacker-turned-entrepreneur Benjamin Harris," according to a recent press release touting their Fortune 500 customers and $29 million investments from venture capital firms. ("If there's a way to compromise your organization, watchTowr will find it," Harris says in the announcement.) This week they shared their own research on a Fortinet FortiGate SSLVPN appliance vulnerability (discovered in February by Gwendal Guégniaud of the Fortinet Product Security team — presumably in a static analysis for format string vulnerabilities). "It affected (before patching) all currently-maintained branches, and recently was highlighted by CISA as being exploited-in-the-wild... It's a Format String vulnerability [that] quickly leads to Remote Code Execution via one of many well-studied mechanisms, which we won't reproduce here..." "Tl;dr SSLVPN appliances are still sUpEr sEcurE," their post begains — but the details are interesting. When trying to test an exploit, Watchtowr discovered instead that FortiGate always closed the connection early, thanks to an exploit mitigation in glibc "intended to hinder clean exploitation of exactly this vulnerability class." Watchtowr hoped to "use this to very easily check if a device is patched — we can simply send a %n, and if the connection aborts, the device is vulnerable. If the connection does not abort, then we know the device has been patched... " But then they discovered "Fortinet added some kind of certificate validation logic in the 7.4 series, meaning that we can't even connect to it (let alone send our payload) without being explicitly permitted by a device administrator." We also checked the 7.0 branch, and here we found things even more interesting, as an unpatched instance would allow us to connect with a self-signed certificate, while a patched machine requires a certificate signed by a configured CA. We did some reversing and determined that the certificate must be explicitly configured by the administrator of the device, which limits exploitation of these machines to the managing FortiManager instance (which already has superuser permissions on the device) or the other component of a high-availability pair. It is not sufficient to present a certificate signed by a public CA, for example... Fortinet's advice here is simply to update, which is always sound advice, but doesn't really communicate the nuance of this vulnerability... Assuming an organisation is unable to apply the supplied workaround, the urgency of upgrade is largely dictated by the willingness of the target to accept a self-signed certificate. Targets that will do so are open to attack by any host that can access them, while those devices that require a certificate signed by a trusted root are rendered unexploitable in all but the narrowest of cases (because the TLS/SSL ecosystem is just so solid, as we recently demonstrated)... While it's always a good idea to update to the latest version, the life of a sysadmin is filled with cost-to-benefit analysis, juggling the needs of users with their best interests.... [I]t is somewhat troubling when third parties need to reverse patches to uncover such details. Thanks to Slashdot reader Mirnotoriety for sharing the article.

Read more of this story at Slashdot.

For the first time in 50 years, humans will walk on the moon again. Currently planned for as soon as 2026, the Artemis III mission "will be one of the most complex undertakings of engineering and human ingenuity in the history of deep space exploration..." writes NASA. "Two crew members will descend to the surface and spend approximately a week near the South Pole of the Moon conducting new science before returning to lunar orbit..." And they'll be wearing Prada, according to a Space News report from Milan: At a briefing at the International Astronautical Congress here October 16, Axiom and Prada revealed details about the Axiom Extravehicular Mobility Unit (AxEMU) suit that Axiom is creating for use by NASA on lunar landing missions starting with Artemis 3... Axiom emphasized the advanced capabilities in the suit, particularly when compared to the suits worn by the Apollo astronauts on moonwalks more than a half-century ago [including greater redundancy and healthy monitoring systems not available in Apollo-era suits]... The unveiling came just over a year after Axiom announced it was working with luxury goods company Prada, an unconventional partnership intended to leverage Prada's expertise in materials and design... [Axiom's executive VP of extravehicular activity Russell Ralston] said Axiom has leveraged Prada's expertise in fabrics and garment design in helping create the outer layer of the suit, which reflects sunlight and keeps dust from getting into interior layers... "If you look across all the different technologies that are needed within the suit, the uniqueness of those technologies and their application, the supply chain has tended to be pretty unstable," he said. "So, one of the things that Prada has really helped us with is bringing stability to that base, especially on the fabric side...." Not surprisingly, Prada also contributed to the appearance of the suit. "One of the things that was important to us was the appeal of the suit, the look of the suit," Ralston said. "Something that Prada brought to the table was helping with the general aesthetic of the suit." One design aspect that brought the two companies together was a prominent red stripe on the suit. Ralston noted that was a nod to a NASA tradition where the mission commander's suit would have that red stripe to distinguish them from another spacewalker... While the current focus of the suit is for walking on the moon, Ralston said the suit can be easily adapted for applications in low Earth orbit, such as spacewalks from the International Space Station or Axiom's future commercial space station. The article adds that 30 people worked on the suit (full- or part-time). "These suits will give the astronauts increased range of motion and flexibility to explore more of the landscape than on previous lunar missions," according to NASA. With "the ability to send high quality images and video to the ground with advanced communication technology, they will be sharing a unique new human experience with the world." Thanks to long-time Slashdot reader schwit1 for sharing the news.

Read more of this story at Slashdot.

A post shared Saturday on social media acknowledges those admins and developers at the Internet Archive working "literally round the clock... They have taken no days off this past week. They are taking none this weekend... they are working with all of their energy and considerable talent." It describes people "working so incredibly hard... putting their all in," with a top priority of "getting the site back secure and safe". But there's new and continuing problems, reports The Verge's weekend editor: Early this morning, I received an email from "The Internet Archive Team," replying to a message I'd sent on October 9th. Except its author doesn't seem to have been the digital archivists' support team — it was apparently written by the hackers who breached the site earlier this month and who evidently maintain some level of access to its systems. I'm not alone. Users on the Internet Archive subreddit are reporting getting the replies, as well. Here is the message I received: It's dispiriting to see that even after being made aware of the breach 2 weeks ago, IA has still not done the due diligence of rotating many of the API keys that were exposed in their gitlab secrets. As demonstrated by this message, this includes a Zendesk token with perms to access 800K+ support tickets sent to info@archive.org since 2018. Whether you were trying to ask a general question, or requesting the removal of your site from the Wayback Machine — your data is now in the hands of some random guy. If not me, it'd be someone else. The site BleepingComputer believes they know the larger context, starting with the fact that they've also "received numerous messages from people who received replies to their old Internet Archive removal requests... The email headers in these emails also pass all DKIM, DMARC, and SPF authentication checks, proving they were sent by an authorized Zendesk server." BleepingComputer also writes that they'd "repeatedly tried to warn the Internet Archive that their source code was stolen through a GitLab authentication token that was exposed online for almost two years." And that "the threat actor behind the actual data breach, who contacted BleepingComputer through an intermediary to claim credit for the attack," has been frustrated by misreporting. (Specifically, they insist there were two separate attacks last week — a DDoS attack and a separate data breach for a 6.4-gigabyte database which includes email addresses for the site's 33 million users.) The threat actor told BleepingComputer that the initial breach of Internet Archive started with them finding an exposed GitLab configuration file on one of the organization's development servers, services-hls.dev.archive.org. BleepingComputer was able to confirm that this token has been exposed since at least December 2022, with it rotating multiple times since then. The threat actor says this GitLab configuration file contained an authentication token allowing them to download the Internet Archive source code. The hacker say that this source code contained additional credentials and authentication tokens, including the credentials to Internet Archive's database management system. This allowed the threat actor to download the organization's user database, further source code, and modify the site. The threat actor claimed to have stolen 7TB of data from the Internet Archive but would not share any samples as proof. However, now we know that the stolen data also included the API access tokens for Internet Archive's Zendesk support system. BleepingComputer attempted contact the Internet Archive numerous times, as recently as on Friday, offering to share what we knew about how the breach occurred and why it was done, but we never received a response. "The Internet Archive was not breached for political or monetary reasons," they conclude, "but simply because the threat actor could... "While no one has publicly claimed this breach, BleepingComputer was told it was done while the threat actor was in a group chat with others, with many receiving some of the stolen data. This database is now likely being traded amongst other people in the data breach community, and we will likely see it leaked for free in the future on hacking forums like Breached."

Read more of this story at Slashdot.

That massive geothermal energy project in Utah gets a closer look from the Washington Post, which calls it "a significant advance for a climate-friendly technology that is gaining momentum in the United States." Once fully operational, the project could generate up to 2 gigawatts of electricity — enough to power more than 2 million homes. In addition, the BLM proposed Thursday to speed up the permitting process for geothermal projects on public lands across the country. Earlier this month, the agency also hosted the biggest lease sale for geothermal developers in more than 15 years... White House national climate adviser Ali Zaidi said in an interview Thursday, "Enhanced geothermal technology has the opportunity to deliver something in the range of 65 million homes' worth of clean power — power that can be generated without putting any pollution in the sky. So we see it as a really meaningful contributor to our technology tool kit...." The developments Thursday come as tech companies race to find new sources of zero-emission power for data centers that can use as much energy as entire cities. With major backing from Google parent Alphabet, Fervo recently got its first project up and running in the northern Nevada desert... The advanced geothermal technology that Fervo is trying to scale up is an attractive option for tech firms. Enhanced geothermal plants do not pose all the safety concerns that come with nuclear power, but they have the potential to provide the round-the-clock energy that data centers need. The challenge Fervo faces is whether it can bring this technology online quickly enough. Fervo (a seven-year-old start-up) was co-founded by Tim Latimer, who previously worked as a drilling engineer, according to the article. But "Early in my career I got passionate about climate change. I started looking at where could a drilling engineer from the oil and gas industry make a difference," Latimer said during a Washington Post Live event in September. "And I realized that geothermal had been so overlooked ... even though the primary technical challenge to making geothermal work is dropping drilling costs."

Read more of this story at Slashdot.

Libreboot is a distribution of coreboot "aimed at replacing the proprietary BIOS firmware contained by most computers." So then what exactly is GNU Boot? Its home page explains... In November 2022, Libreboot began to include non-libre code. We have made repeated efforts to continue collaboration with those developers to help their version of Libreboot remain libre, but that was not successful. Now we've stepped forward to stand up for freedom, ours and that of the wider community, by maintaining our own version — a genuinely libre Libreboot, that after some hurdles gave birth to this project: GNU Boot. But today, Phoronix writes: While priding itself on being "100% free", last December [GNU Boot] had to drop some motherboard support and CPU code after discovering they were shipping some files that are non-free by their free software standards. Today they announced another mistake in having inadvertently been shipping additional non-free code. GNU Boot discovered an issue with non-free code affecting not only them but also some of the Linux distributions that pride themselves on being fully free software / 100% open-source. This latest snafu they say is "more problematic" than their prior non-free code discover due to impacting the free software Linux distributions too. The issue at hand though comes down to test data contained within the archive and that containing non-free code in the form of microcode, BIOS bits, and Intel Management Engine firmware. "We also contacted Replicant..." according to the announcement, "a free Android distro that also ships vboot source code." And in addition, "We had to re-release all the affected tarballs." (Which at this point is three release candidates...)

Read more of this story at Slashdot.

Neal Stephenson is a sci-fi writer "of exuberant prose who revels in embracing big ideas," according to the New York Times. "With Polostan he enters the realm of the spy novel..." Or, as the Washington Post puts it, Stephenson "drops readers into a bloody, inspiring, conflict-ridden and pivotal period of the early 20th century." With its flair for characterization, precision of language, witty apercus and fecundity of events, the novel delivers what we've come to cherish from the author of such fantastical classics as "The Diamond Age," "Snow Crash" and "Cryptonomicon." But the book is also utterly unlike the majority of Stephenson's work. For one thing, it's short — a far cry from the maximalist "systems novels" that cram in entire worlds with complex interacting power structures, both explicit and hidden. "Polostan" is also devoid of fantastical elements and farcical "hysterical realism," which comes as a bit of a shock given that this is the writer who invented Mafia pizza-delivery guys and cybernetic children's primers. The structure of the book is, likewise, unusually straightforward: a mainly linear narrative dispersed along two timelines... These observations aren't quibbles so much as alerts to the reader that this is new territory for Stephenson — and good for him! Though, because Polostan is the first novel in a planned historical series titled Bomb Light, which aims to capture the excitement and intrigue of the nuclear arms race, we cannot rule out any Stephenson freakiness down the line... Assuming the subsequent books are as good as this one, Stephenson might end up with a series that rivals Michael Moorcock's Pyat Quartet and Edward Whittemore's Jerusalem Quartet as a vivid and canny dissection of a century unlike any other. "Much of the next volume is already written," Stephenson says on Substack, calling it "a project that has been in the works for over ten years". (He also notes that among his novels, "even the stuff that's branded as science fiction tends to contain a lot of history.") Meanwhile in August, Stephenson's blockchain-tech startup Lamina1 announced a collaboration with special effects company Weta Workshop (from "The Lord of the Rings" film franchise) on a "participatory worldbuilding" experience. Variety reports: The experience is expected to offer "a new blueprint for IP expansion through immersive experiences that incorporate fan action and input." Per Lamina1's description for the project, "Stephenson and the Weta team will begin engaging a global community of creators and fans on the Lamina1 platform this fall, inviting them to unravel the lore behind a mysterious set of 'Artefacts' that will build upon the themes and lore from Stephenson's critically-acclaimed catalog of work. Next, the superfan will take on the new role of creator, utilizing their discoveries to contribute directly to the expansion of the universe." "Artefact" will serve as the flagship project in the Lamina1-Weta partnership and first major multimedia property launching on Lamina1's blockchain infrastructure and tooling. Neal Stephenson answered questions from Slashdot's readers in 2004. Now to promote his new novel Polostan, Stephenson will be making several personal appearances this week: At the Wisconsin Book Festival in Madison (Sunday at noon)Chicago's Book Stall (Monday at 7 p.m.)A Cary, North Carolina Barnes & Noble (Tuesday at 6 p.m.)New York City's Strand (Wednesday at 7 p.m.)At the Midtown Scholar Bookstore in Harrisburg, Pennsylvania (Thursday at 7 p.m.)Ames, Iowa at Dog Eared Books (Sunday at 6 p.m.)

Read more of this story at Slashdot.

"A technology pioneered by Benjamin Franklin is being revived to build more efficient electric motors," reports the Wall Street Journal, "an effort in its nascent stage that has the potential to be massive." A handful of scientists and engineers — armed with materials and techniques unimaginable in the 1700s — are creating modern versions of Franklin's "electrostatic motor," that are on the cusp of commercialization... Franklin's "electrostatic motor" uses alternating positive and negative charges — the same kind that make your socks stick together after they come out of the dryer — to spin an axle, and doesn't rely on a flow of current like conventional electric motors. Every few years, an eager Ph.D. student or engineer rediscovers this historical curiosity. But other than applications in tiny pumps and actuators etched on microchips, where this technology has been in use for decades, their work hasn't made it out of the lab. Electrostatic motors have several potentially huge advantages over regular motors. They are up to 80% more efficient than conventional motors after all the dependencies of regular electric motors are added in. They could also allow new kinds of control and precision in robots, where they could function more like our muscles. And they don't use rare-earth elements because they don't have permanent magnets, and require as little as 5% as much copper as a conventional motor. Both materials have become increasingly scarce and expensive over the past decade, and supply chains for them are dominated by China. "It's reminiscent of the early 1990s, when Sony began to produce and sell the first rechargeable lithium-ion batteries, a breakthrough that's now ubiquitous..." according to the article. "These motors could lead to more efficient air-conditioning systems, factories, logistics hubs and data centers, and — since they can double as generators — better ways of generating renewable energy. They might even show up in tiny surveillance drones." And the article points out that C-Motive Technologies, a 16-person startup in Wisconsin, is already "reaching out to companies, hoping to get their motors out into the real world." ("So far, FedEx and Rockwell Automation, the century-old supplier of automation to factories, are among those testing their motors.") C-Motive's founders discovered that a number of technologies had matured enough that, when combined, could yield electrostatic motors competitive with conventional ones. These enabling technologies include super fast-switching power electronics — like those in modern electric vehicles — that can toggle elements of the motor between states of positive and negative charge very quickly... Dogged exploration of combinations of various readily available industrial organic fluids led to a proprietary mix that can both multiply the strength of the electric field and insulate the motor's spinning parts from each other — all without adding too much friction — says C-Motive Chief Executive Matt Maroon.

Read more of this story at Slashdot.

It connects people, data, and money, Bill Gates wrote this week on his personal blog. But digital public infrastructure is also "revolutionizing the way entire nations serve their people, respond to crises, and grow their economies" — and the Gates Foundation sees it "as an important part of our efforts to help save lives and fight poverty in poor countries." Digital public infrastructure [or "DPI"]: digital ID systems that securely prove who you are, payment systems that move money instantly and cheaply, and data exchange platforms that allow different services to work together seamlessly... [W]ith the right investments, countries can use DPI to bypass outdated and inefficient systems, immediately adopt cutting-edge digital solutions, and leapfrog traditional development trajectories — potentially accelerating their progress by more than a decade. Countries without extensive branch banking can move straight to mobile banking, reaching far more people at a fraction of the cost. Similarly, digital ID systems can provide legal identity to millions who previously lacked official documentation, giving them access to a wide range of services — from buying a SIM card to opening a bank account to receiving social benefits like pensions. I've heard concerns about DPI — here's how I think about them. Many people worry digital systems are a tool for government surveillance. But properly designed DPI includes safeguards against misuse and even enhances privacy... These systems also reduce the need for physical document copies that can be lost or stolen, and even create audit trails that make it easier to detect and prevent unauthorized access. The goal is to empower people, not restrict them. Then there's the fear that DPI will disenfranchise vulnerable populations like rural communities, the elderly, or those with limited digital literacy. But when it's properly designed and thoughtfully implemented, DPI actually increases inclusion — like in India, where millions of previously unbanked people now have access to financial services, and where biometric exceptions or assisted enrollment exist for people with physical disabilities or no fixed address. Meanwhile, countries can use open-source tools — like MOSIP for digital identity and Mojaloop for payments — to build DPI that fosters competition and promotes innovation locally. By providing a common digital framework, they allow smaller companies and start-ups to build services without requiring them to create the underlying systems from scratch. Even more important, they empower countries to seek out services that address their own unique needs and challenges without forcing them to rely on proprietary systems. "Digital public infrastructure is key to making progress on many of the issues we work on at the Gates Foundation," Bill writes, "including protecting children from preventable diseases, strengthening healthcare systems, improving the lives and livelihoods of farmers, and empowering women to control their financial futures. "That's why we're so committed to DPI — and why we've committed $200 million over five years to supporting DPI initiatives around the world... The future is digital. Let's make sure it's a future that benefits everyone."

Read more of this story at Slashdot.

A California oil refinery that produces 8% of the state's gasoline is shutting down late next year — a decision the Los Angeles Times says is "driven by climate change, the transition to electric vehicles and demands for cleaner air." "There's no question we are going to lose refineries over time, because demand is going to go down as we transition to electric vehicles, but I did not expect to see any of them exiting this quickly," said Severin Borenstein, faculty director of the Energy Institute at UC Berkeley's Haas School of Business. California "over the medium term" will have to rely more on imports, he said. "I think part of the response the state's going to need to consider is how to make sure that we can import sufficient gasoline to meet our needs...." David Hackett, chairman of Stillwater Associates, an Irvine oil consultancy, said he was contacted by Phillips just before the announcement, and was told the closure was a business decision. He said that although the timing was somewhat surprising, the closure wasn't, given the age of the refineries, their relatively small size and the inefficient layout that connects them by a pipeline. "That plant has been for sale for years. It hasn't found any buyers and I think that this has been an economic decision on their part. They looked at the profitability of the place and compared it with the other businesses that they have, and it didn't make the cut," he said. "The closure is likely to increase California's already high prices at the gas pump, given that much of the replacement gasoline will be shipped in by ocean vessel, analysts say..." according to another article from the Los Angeles Times. "Environmentalists and community activists cheered the news, however, saying it will mean cleaner air for the thousands who live in the area and that the state must continue the transition away from its dependence on fossil fuels."

Read more of this story at Slashdot.

Tom's Hardware reports on some interesting hardware history being shared on X.com: AMD engineer Phil Park identified a curious nugget of PC architectural history from, of all places, a year-old Quora answer posted by former Intel engineer [and Pentium Pro architect] Robert Colwell. The nugget indicates that Intel could have beaten AMD to the x86-64 punch if the former wasn't dead-set on the x64-only Itanium line of CPUs. Colwell had responded on Quora to the question "Shouldn't Intel with its vast resources have been able to develop both architectures?" This was a marketing decision by Intel — they believed, probably rightly, that bringing out a new 64-bit feature in the x86 would be perceived as betting against their own native-64-bit Itanium, and might well severely damage Itanium's chances. I was told, not once, but twice, that if I "didn't stop yammering about the need to go 64-bits in x86 I'd be fired on the spot" and was directly ordered to take out that 64-bit stuff. I decided to split the difference, by leaving in the gates but fusing off the functionality. That way, if I was right about Itanium and what AMD would do, Intel could very quickly get back in the game with x86. As far as I'm concerned, that's exactly what did happen. Phil Park continued the discussion on X.com. "He didn't quite get what he wanted, but he got close since they had x86-64 support in subsequent products when Intel made their comeback." (So, Park posted later in the thread, "I think he won the long game.") Park also shared a post from Nicholas Wilt (NVIDIA CUDA designer who earlier did GPU computing work at Microsoft and built the prototype for Windows Desktop Manager): I have an x86-64 story of my own. I pressed a friend at AMD to develop an alternative to Itanium. "For all the talk about Wintel," I told him, "these companies bear no love for one another. If you guys developed a 64-bit extension of x86, Microsoft would support it...." Interesting coda: When it became clear that x86-64 was beating Itanium in the market, Intel reportedly petitioned Microsoft to change the architecture and Microsoft told Intel to pound sand.

Read more of this story at Slashdot.

The Miami Herald reports: Cuba's electrical grid shut down again early Saturday, leaving the island without electricity after authorities tried but failed to restore power following an earlier nationwide blackout on Friday. The island's Electric Union reported a second "total outage" at 6:15 a.m., just hours after officials reported they had restored power in a few "microsystems" all over the island... The country has been going through its worst economic crisis since the fall of the Soviet Union, and the government lacks money to buy oil in the international market to meet domestic demand. Cubans irked by the daily blackouts defied the country's Draconian laws punishing criticism of the government and left several comments in official news outlets calling for government officials to resign. The second outage will likely exacerbate public frustration as food begins to spoil because of the lack of refrigeration. Two hours ago, Reuters reported that Cuba's government "said on Saturday it had made some progress in gradually re-establishing electrical service across the island, including to hospitals and parts of the capital Havana..." "Most of Cuba's 10 million people, however, remained without electricity on Saturday afternoon." Traffic lights were dark at intersections throughout Havana, and most commerce was halted... Cuban officials have said even if the immediate grid collapse is resolved, the electricity crisis will continue. Cuba produces little of its own crude oil, and fuel deliveries to the island have dropped significantly this year, as Venezuela, Russia and Mexico, once important suppliers, have reduced their exports to Cuba. Mexico experienced a historic drop in production, according to the New York Times, while Venezuela is selling its oil to foreign companies to ease its own economic crisis: The experts had warned for years: Cuba's power grid was on the verge of collapse, relying on plants nearly a half-century old and importing fuel that the cash strapped Communist government could barely afford... Cuban economists and foreign analysts blamed the crisis on several factors: the government's failure to tackle the island's aging infrastructure; the decline in fuel supplies from Venezuela, Mexico and Russia; and a lack of capital investment in badly needed renewable systems, such as wind and solar. Jorge Piñon, a Cuban-born energy expert at the University of Texas at Austin, highlighted that Cuba's electricity grid relies on eight very large power plants that are close to 50 years old. "They have not received any operational maintenance much less capital maintenance in the last 12 to 15 years," he said, adding that they have a lifetime of only 25-30 years. "So, number one, it's a structural problem, they are breaking down all the time and that has a domino effect," he said. Compounding the problems, Cuba burns crude oil as a fuel for its plants. Experts said Cuba's own crude oil production is very heavy in sulfur and metals that can impair the thermoelectric combustion process. "So they have to be constantly repairing them, and they're repairing them with Band-Aids," said Mr. Piñon... "If they can't turn these plants back on there is a concern that this could turn into another mass exodus," said Ricardo Herrero, the director of the Cuba Study Group in Washington. "They are really short on options," he added.

Read more of this story at Slashdot.

An anonymous readed shared this report from CNN: [U.S. army boats] are poorly maintained and largely unprepared to meet the military's growing mission in the Pacific, a new government oversight report said this week. The Government Accountability Office released a report on Wednesday that concluded there are "wide-ranging" issues facing Army watercraft, which limit the Army's ability "to meet mission requirements in the Indo-Pacific theater where the need for Army watercraft is most pronounced." Despite Army policy requiring the vessels to be at least at a 90% mission capable rate — meaning the vessels are ready to perform their mission — the boats currently have a less than 40% capable rate this year. Overall, the fleet of watercraft has dropped by nearly half since 2018, going from 134 vessels to 70 as of May this year, in part due to divestment of vessels in 2018 and 2019... "Army boats have not been ready, capable, or in a mindset they'll have to do something dangerous or in the real world ... for decades now," a retired warrant officer and former chief engineer on Army watercraft told CNN at the time... [Army spokeswoman Cynthia Smith] said that the Army is "actively" working to address gaps in the watercraft's capability as a whole, and prioritizing improving the current fleet while also "investing in a modernized fleet to meet the needs of the 2040 force." Col. Dave Butler, a spokesman for Army Chief of Staff Gen. Randy George, told CNN that the Army is also looking at possibly replacing the existing fleet of Army watercraft with autonomous vessels in the future. "What we see is the oil industry and other shipping industries are doing this already, we see that happening all around the world," Butler said. "There's no reason the Army shouldn't be thinking that way ... leaders from down at ship level all the way to the Pentagon are looking at this and determining the best way to deploy our forces... "Maybe the future fleet is all autonomous, we just don't know," he said. "This is all stuff we're looking at in terms of trying to modernize the way we move people, weapons, and equipment." CNN notes that the report "also said the Army is considering leasing civilian watercraft to bolster its existing fleet and moving all of its watercraft to the Pacific." The report also included a response from Army Secretary Wormuth, who said the Army is "actively pursuing a holistic approach to mitigate the gaps in Army watercraft capability and capacity."

Read more of this story at Slashdot.

"The foundation behind the Gnome desktop environment is having to go through some serious belt-tightening..." writes Linux Magazine. From an October 7th announcement by The Gnome Foundation: Our plan for the previous financial year was to operate a break-even budget. We raised less than expected last year, due to a very challenging fundraising environment for nonprofits, on top of internal changes such as the departure of our previous Executive Director, Holly Million. The Foundation has a reserves policy which requires us to keep a certain amount of money in the bank account, to preserve core operations in the event of interruptions to our income. In order to meet our reserves policy, this year's budget had to reduce our expenditure to below expected income, and generate a small surplus to reinstate the Foundation's financial reserves to the necessary level... We're asking for your support in several ways: - Look out for opportunities to volunteer your time and skills in areas where we've had to reduce staff involvement. - Share ideas on how to organize and improve our activities in this new context. - Consider making donations to support the GNOME Foundation's core priorities, if you're able... Through these difficult decisions, the GNOME Foundation is able to meet its reserves policy, ensuring sufficient funds for the coming year. Our budget for the new financial year is realistic and supports four full time staff, who are able to support key operations like finance, infrastructure and events. We are additionally contracting a number of other individuals on a short term or part time basis, to help with fund raising, websites and delivering on our project commitments. We are going to be looking to the GNOME community to help with the areas that are most affected by our reduced staffing. If you would like to help GNOME with its events, marketing, or fundraising, we would love to hear from you. In their new budget, "expenses have been greatly reduced," according to an October 10 update: We are also very relieved to be able to provide a surplus budget for the first time in many years, and doing so while still being able to support the community: events, infrastructure, internships, travel funding, and meeting our commitment to donors for work done in some parts of the stack, e.g.: Flathub, parental controls and GNOME Software.

Read more of this story at Slashdot.

MIT engineers have built a solar-powered desalination system that "ramps up its desalting process and automatically adjusts to any sudden variation in sunlight, for example by dialing down in response to a passing cloud or revving up as the skies clear." While traditional reverse osmosis systems typically require steady power levels, "the MIT system requires no extra batteries for energy storage, nor a supplemental power supply, such as from the grid." And their results were pretty impressive: The engineers tested a community-scale prototype on groundwater wells in New Mexico over six months, working in variable weather conditions and water types. The system harnessed on average over 94 percent of the electrical energy generated from the system's solar panels to produce up to 5,000 liters of water per day despite large swings in weather and available sunlight... "Being able to make drinking water with renewables, without requiring battery storage, is a massive grand challenge," says Amos Winter, the Germeshausen Professor of Mechanical Engineering and director of the K. Lisa Yang Global Engineering and Research Center at MIT. "And we've done it." The system is geared toward desalinating brackish groundwater — a salty source of water that is found in underground reservoirs and is more prevalent than fresh groundwater resources. The researchers see brackish groundwater as a huge untapped source of potential drinking water, particularly as reserves of fresh water are stressed in parts of the world. They envision that the new renewable, battery-free system could provide much-needed drinking water at low costs, especially for inland communities where access to seawater and grid power are limited... The researchers' report details the new system in a paper appearing in Nature Water. The study's co-authors are Bessette, Winter, and staff engineer Shane Pratt... "Our focus now is on testing, maximizing reliability, and building out a product line that can provide desalinated water using renewables to multiple markets around the world," Pratt adds. The team will be launching a company based on their technology in the coming months. This research was supported in part by the National Science Foundation, the Julia Burke Foundation, and the MIT Morningside Academy of Design. This work was additionally supported in-kind by Veolia Water Technologies and Solutions and Xylem Goulds. Thanks to long-time Slashdot reader schwit1 for sharing the news.

Read more of this story at Slashdot.

An anonymous reader shared this report from Forbes: Recent headlines have proclaimed that Chinese scientists have hacked "military-grade encryption" using quantum computers, sparking concern and speculation about the future of cybersecurity. The claims, largely stemming from a recent South China Morning Post article about a Chinese academic paper published in May, was picked up by many more serious publications. However, a closer examination reveals that while Chinese researchers have made incremental advances in quantum computing, the news reports are a huge overstatement. "Factoring a 50-bit number using a hybrid quantum-classical approach is a far cry from breaking 'military-grade encryption'," said Dr. Erik Garcell, Head of Technical Marketing at Classiq, a quantum algorithm design company. While advancements have indeed been made, the progress represents incremental steps rather than a paradigm-shifting breakthrough that renders current cryptographic systems obsolete. "This kind of overstatement does more harm than good," Dr. Garcell said. "Misrepresenting current capabilities as 'breaking military-grade encryption' is not just inaccurate — it's potentially damaging to the field's credibility...." In fact, the Chinese paper in question, titled Quantum Annealing Public Key Cryptographic Attack Algorithm Based on D-Wave Advantage, does not mention military-grade encryption, which typically involves algorithms like the Advanced Encryption Standard (AES). Instead, the paper is about attacking RSA encryption (RSA stands for Rivest-Shamir-Adleman, named after its creators)... While factoring a 50-bit integer is an impressive technical achievement, it's important to note that RSA encryption commonly uses key sizes of 2048 bits or higher. The difficulty of factoring increases exponentially with the size of the number, meaning that the gap between 50-bit and 2048-bit integers is astronomically large. Moreover, the methods used involve a hybrid approach that combines quantum annealing with classical computation. This means that the quantum annealer handles part of the problem, but significant processing is still performed by classical algorithms. The advances do not equate to a scalable method for breaking RSA encryption as it is used in practical applications today. Duncan Jones, Head of Cybersecurity at Quantinuum, tells Forbes that if China had actually broken AES — they'd be keeping it secret (rather than publicizing it in newspapers).

Read more of this story at Slashdot.

"Getting sick feels bad in the moment," reports the Washington Post, "and may affect your brain in the longer term." A new study published in Nature Aging adds to growing evidence that severe infections, including flu, herpes and respiratory tract infections, are linked to accelerated brain atrophy and increased risk of dementia years later. It also hints at the biological drivers that may contribute to neurodegenerative disease. The current research is a "leap beyond previous studies that had already associated infection with susceptibility to Alzheimer's disease" and provides a "useful dataset," said Rudy Tanzi, a professor of neurology at Harvard Medical School and the director of the McCance Center for Brain Health at Massachusetts General Hospital. Other recent studies have found that the flu shot and the shingles vaccine reduce the risk of subsequent dementia in those who get them. Severe infections have also been linked to subsequent strokes and heart attacks. "Big infection, big immune response — not good for the brain," said one of the study's co-authors (Keenan Walker, a tenure-track investigator and the director of the Multimodal Imaging of Neurodegenerative Disease Unit at the National Institute on Aging). And the article also includes this quote from Kristen Funk, an assistant professor of biological sciences at the University of North Carolina at Charlotte (who studies neuroinflammation in neuroinfectious and neurodegenerative diseases). "They really found that there's a range of infections that are associated with this brain atrophy, associated with this cognitive decline." In turn, most of these infections associated with brain atrophy seem to be risk factors for dementia, according to the researchers' analyses of the UK Biobank data of 495,896 subjects and a Finnish dataset of 273,132 subjects. They found that having a history of infections was associated with an increased risk for Alzheimer's disease years later. The increased risk was even higher for vascular dementia, which is the second-most-common dementia diagnosis after Alzheimer's disease and caused by restriction of blood to the brain... More-minor infections are not cause for alarm since the data was drawn from patients who had a hospital record of their infections, indicating more-severe cases, experts say. And speaking of infections, the Post also published an interesting guest column by Dr. Mikkael A. Sekeres, division chief for hematology and medicine professor at the University of Miami's cancer center: A recent report from the American Association for Cancer Research attributed 13 percent of cancer cases worldwide to infections. Some estimates run as high as 20 percent, with particularly high rates of infection-related cancers in developing countries. Infectious agents linked to cancer include bacteria, such as Helicobacter pylori (H. pylori), and viruses, such as human papillomavirus (HPV), Epstein-Barr virus (EBV), and hepatitis B and C. But keep in mind that an exceedingly small percentage of infected people develop cancer...

Read more of this story at Slashdot.

"Six years after the Spectre transient execution processor design flaws were disclosed, efforts to patch the problem continue to fall short," writes the Register: Johannes Wikner and Kaveh Razavi of Swiss University ETH Zurich on Friday published details about a cross-process Spectre attack that derandomizes Address Space Layout Randomization and leaks the hash of the root password from the Set User ID (suid) process on recent Intel processors. The researchers claim they successfully conducted such an attack.... [Read their upcomong paper here.] The indirect branch predictor barrier (IBPB) was intended as a defense against Spectre v2 (CVE-2017-5715) attacks on x86 Intel and AMD chips. IBPB is designed to prevent forwarding of previously learned indirect branch target predictions for speculative execution. Evidently, the barrier wasn't implemented properly. "We found a microcode bug in the recent Intel microarchitectures — like Golden Cove and Raptor Cove, found in the 12th, 13th and 14th generations of Intel Core processors, and the 5th and 6th generations of Xeon processors — which retains branch predictions such that they may still be used after IBPB should have invalidated them," explained Wikner. "Such post-barrier speculation allows an attacker to bypass security boundaries imposed by process contexts and virtual machines." Wikner and Razavi also managed to leak arbitrary kernel memory from an unprivileged process on AMD silicon built with its Zen 2 architecture. Videos of the Intel and AMD attacks have been posted, with all the cinematic dynamism one might expect from command line interaction. Intel chips — including Intel Core 12th, 13th, and 14th generation and Xeon 5th and 6th — may be vulnerable. On AMD Zen 1(+) and Zen 2 hardware, the issue potentially affects Linux users. The relevant details were disclosed in June 2024, but Intel and AMD found the problem independently. Intel fixed the issue in a microcode patch (INTEL-SA-00982) released in March, 2024. Nonetheless, some Intel hardware may not have received that microcode update. In their technical summary, Wikner and Razavi observe: "This microcode update was, however, not available in Ubuntu repositories at the time of writing this paper." It appears Ubuntu has subsequently dealt with the issue. AMD issued its own advisory in November 2022, in security bulletin AMD-SB-1040. The firm notes that hypervisor and/or operating system vendors have work to do on their own mitigations. "Because AMD's issue was previously known and tracked under AMD-SB-1040, AMD considers the issue a software bug," the researchers explain. "We are currently working with the Linux kernel maintainers to merge our proposed software patch." BleepingComputer adds that the ETH Zurich team "is working with Linux kernel maintainers to develop a patch for AMD processors, which will be available here when ready."

Read more of this story at Slashdot.

"The Wayback Machine, Archive-It, scanning, and national library crawls have resumed," announced the Internet Archive Thursday, "as well as email, blog, helpdesk, and social media communications. Our team is working around the clock across time zones to bring other services back online." Founder Brewster Kahle told The Washington Post it's the first time in its almost 30-year history that it's been down more than a few hours. But their article says the Archive is "fighting back." Kahle and his team see the mission of the Internet Archive as a noble one — to build a "library of everything" and ensure records are kept in an online environment where websites change and disappear by the day. "We're all dreamers," said Chris Freeland, the Internet Archive's director of library services. "We believe in the mission of the Internet Archive, and we believe in the promise of the internet." But the site has, at times, courted controversy. The Internet Archive faces lawsuits from book publishers and music labels brought in 2020 and 2023 for digitizing copyrighted books and music, which the organization has argued should be permissible for noncommercial, archival purposes. Kahle said the hundreds of millions of dollars in penalties from the lawsuits could sink the Internet Archive. Those lawsuits are ongoing. Now, the Internet Archive has also had to turn its attention to fending off cyberattacks. In May, the Internet Archive was hit with a distributed denial-of-service (DDoS) attack, a fairly common type of internet warfare that involves flooding a target site with fake traffic. The archive experienced intermittent outages as a result. Kahle said it was the first time the site had been targeted in its history... [After another attack October 9th], Kahle and his team have spent the week since racing to identify and fix the vulnerabilities that left the Internet Archive open to attack. The organization has "industry standard" security systems, Kahle said, but he added that, until this year, the group had largely stayed out of the crosshairs of cybercriminals. Kahle said he'd opted not to prioritize additional investments in cybersecurity out of the Internet Archive's limited budget of around $20 million to $30 million a year... [N]o one has reliably claimed the defacement and data breach that forced the Internet Archive to sequester itself, said [cybersecurity researcher] Scott Helmef. He added that the hackers' decision to alert the Internet Archive of their intrusion and send the stolen data to Have I Been Pwned, the monitoring service, could imply they didn't have further intentions with it.... Helme said the episode demonstrates the vulnerability of nonprofit services like the Internet Archive — and of the larger ecosystem of information online that depends on them. "Perhaps they'll find some more funding now that all of these headlines have happened," Helme said. "And people suddenly realize how bad it would be if they were gone." "Our priority is ensuring the Internet Archive comes online stronger and more secure," the archive said in Thursday's statement. And they noted other recent-past instances of other libraries also being attacked online: As a library community, we are seeing other cyber attacks — for instance the British Library, Seattle Public Library, Toronto Public Library, and now Calgary Public Library. We hope these attacks are not indicative of a trend." For the latest updates, please check this blog and our official social media accounts: X/Twitter, Bluesky and Mastodon. Thank you for your patience and ongoing support.

Read more of this story at Slashdot.

"Biden forgives more student loans," read Thursday's headline at CNBC. While this time it was $4.5 billion in student debt for over 60,000 public service workers, "The Biden-Harris Administration has approved $175 billion in student debt relief for nearly 5 million borrowers through various actions," according to an announcement from the White House on Thursday. (So the average amount received by each of the 5 million students is $35,000.) CNN calculates this eliminates roughly 11% of all outstanding U.S. federal student loan debt. This latest round of forgiveness fixed a loophole in a bipartisan program (passed during the Bush administration in 2007) called Public Service Loan Forgiveness: "For too long, the government failed to live up to its commitments, and only 7,000 people had ever received forgiveness under Public Service Loan Forgiveness before Vice President (Kamala) Harris and I took office," Biden said in a statement. "We vowed to fix that," he added... Thursday's announcement impacts about 60,000 borrowers who are now approved for approximately $4.5 billion in student debt relief under PSLF. CNN points out the total $175 billion in forgiven student debt is more than under any other president — though it's still "less than half of the $430 billion that would've been canceled under the president's one-time forgiveness plan, which was struck down by the Supreme Court last year." The Biden administration has made it easier for about 572,000 permanently disabled borrowers to receive the debt relief to which they are entitled. It also has granted student loan forgiveness to more than 1.6 million borrowers who were defrauded by their college... The Biden administration is conducting a one-time recount of borrowers' past payments and making adjustments if they had been counted incorrectly, bringing many people closer to debt relief.

Read more of this story at Slashdot.

Longtime Slashdot reader schwit1 shares an op-ed written by Michael R. Bloomberg, founder and majority owner of Bloomberg LP, the parent company of Bloomberg News, UN Special Envoy on Climate Ambition and Solutions, and chair of the Defense Innovation Board: There are government boondoggles, and then there's NASA's Artemis program. More than a half century after Neil Armstrong's giant leap for mankind, Artemis was intended to land astronauts back on the moon. It has so far spent nearly $100 billion without anyone getting off the ground, yet its complexity and outrageous waste are still spiraling upward. The next US president should rethink the program in its entirety. As someone who greatly respects science and strongly supports space exploration, the more I have learned about Artemis, the more it has become apparent that it is a colossal waste of taxpayer money. [...] A celestial irony is that none of this is necessary. A reusable SpaceX Starship will very likely be able to carry cargo and robots directly to the moon -- no SLS, Orion, Gateway, Block 1B or ML-2 required -- at a small fraction of the cost. Its successful landing of the Starship booster was a breakthrough that demonstrated how far beyond NASA it is moving. Meanwhile, NASA is canceling or postponing promising scientific programs -- including the Veritas mission to Venus; the Viper lunar rover; and the NEO Surveyor telescope, intended to scan the solar system for hazardous asteroids -- as Artemis consumes ever more of its budget. Taxpayers and Congress should be asking: What on Earth are we doing? And the next president should be held accountable for answers.

Read more of this story at Slashdot.