The YubiKey 5, the most widely used hardware token for two-factor authentication based on the FIDO standard, contains a cryptographic flaw that makes the finger-size device vulnerable to cloning when an attacker gains brief physical access to it, researchers said Tuesday. ArsTechnica: The cryptographic flaw, known as a side channel, resides in a small microcontroller that's used in a vast number of other authentication devices, including smartcards used in banking, electronic passports, and the accessing of secure areas. While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven't tested other devices using the microcontroller, which is SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contain the same vulnerability. YubiKey-maker Yubico issued an advisory in coordination with a detailed disclosure report from NinjaLab, the security firm that reverse-engineered the YubiKey 5 series and devised the cloning attack. All YubiKeys running firmware prior to version 5.7 -- which was released in May and replaces the Infineon cryptolibrary with a custom one -- are vulnerable. Updating key firmware on the YubiKey isn't possible. That leaves all affected YubiKeys permanently vulnerable.

Read more of this story at Slashdot.

U.S. oilfield services firm Halliburton said on Tuesday an unauthorized third party had accessed and removed data from its systems, providing details regarding the cyberattack in August. From a report: The company said it is evaluating the nature and scope of information that was removed, but added that the incident is not reasonably likely to have a material impact. Halliburton declined to comment in response to Reuters' requests for additional information on the nature of data removed and expenses incurred due to the cyber incident. It also did not immediately confirm whether it had been contacted by the hackers. U.S energy firms have suffered multiple cyberattacks, including ransomware attacks, in recent years. In 2021, Colonial Pipeline was forced to pay $4.4 million in ransom as its executives were not sure about the severity of the breach.

Read more of this story at Slashdot.

Intel launched its new Core Ultra 200V-series processors on Tuesday, promising significant improvements in power efficiency, performance, and battery life over competitors and previous generations. The company claims the chips offer "historic x86 power efficiency" and the "world's fastest mobile CPU cores." The processors, available for pre-order in OEM systems and shipping September 24, feature four Lion Cove P-cores and four Skymont E-cores with boost speeds up to 5.1 GHz. Intel says the chips deliver up to 20.1 hours of battery life, Tom's Hardware reports, outperforming Qualcomm's Snapdragon X Elite by nearly two hours and AMD's chips by almost four hours. Intel asserts a 30% faster gaming performance than competing processors and highlighted compatibility issues with Qualcomm's chips, noting that nearly two dozen games used for benchmarking failed to run on X Elite chips. The company claims up to 64% advantage in single-threaded performance over Qualcomm Snapdragon X Elite and up to 33% over AMD Strix Point HX370.

Read more of this story at Slashdot.

Mobile phones are not linked to brain and head cancers, a comprehensive review of the highest quality evidence available commissioned by the World Health Organization has found. From a report: Led by the Australian Radiation Protection and Nuclear Safety Agency (Arpansa), the systematic review examined more than 5,000 studies from which the most scientifically rigorous were identified and weak studies were excluded. The final analysis included 63 observational studies in humans published between 1994 and 2022, making it "the most comprehensive review to date," the review lead author, associate prof Ken Karipidis, said. "We concluded the evidence does not show a link between mobile phones and brain cancer or other head and neck cancers." Published on Wednesday, the review focused on cancers of the central nervous system (including brain, meninges, pituitary gland and ear), salivary gland tumours and brain tumours. The review found no overall association between mobile phone use and cancer, no association with prolonged use (if people use their mobile phones for 10 years or more), and no association with the amount of mobile phone use (the number of calls made or the time spent on the phone).

Read more of this story at Slashdot.

Japan has recorded its hottest summer on record after a sweltering three months marked by thousands of instances of "extreme heat," with meteorologists warning that unseasonably high temperatures will continue through the autumn. From a report: The average temperature in June, July and August was 1.76C higher than the average recorded between 1991 and 2020, the Japan meteorological agency said, according to Kyodo news agency. It was the hottest summer since comparable records were first kept in 1898 and tied the record set in 2023, the agency said. Japan has recorded 8,821 instances of "extreme heat" -- a temperature of 35C or higher -- so far this year, easily beating the previous record of 6,692 set in 2023, it added. The brutal heat was not confined to Japan. Swathes of China logged the hottest August on record, the weather service said. The hot weather prompted delays to the start of the new school year in some Chinese cities. State media reported on Tuesday that some schools and universities in Jiangxi, Chongqing, and Sichuan provinces had pushed the return to school out to 9 September, citing high temperatures. China Daily said Chongqing authorities had extended school holidays for all kindergarten, primary and secondary schools, and at least a dozen colleges and universities, "to ensure the safety and health of teachers and students amid the extreme heat."

Read more of this story at Slashdot.

Nvidia dominates the chips at the center of the AI boom. It wants to conquer almost everything else that makes those chips tick, too. From a report: Chief Executive Jensen Huang is increasingly broadening his company's focus -- and seeking to widen its advantage over competitors -- by offering software, data-center design services and networking technology in addition to its powerful silicon brains. More than a supplier of a valuable hardware component, he is trying to build Nvidia into a one-stop shop for all the key elements in the data centers where tools like OpenAI's ChatGPT are created and deployed -- or what he calls "AI factories." Huang emphasized Nvidia's growing prowess at data-center design following an earnings report Wednesday that exceeded Wall Street forecasts. The report came days after rival AMD agreed to pay nearly $5 billion to buy data-center design and manufacturing company ZT Systems to try to gain ground on Nvidia. "We have the ability fairly uniquely to integrate to design an AI factory because we have all the parts," Huang said in a call with analysts. "It's not possible to come up with a new AI factory every year unless you have all the parts." It is a strategy designed to extend the business success that has made Nvidia one of the world's most valuable companies -- and to insulate it from rivals eager to eat into its AI-chip market share, estimated at more than 80%. Gobbling up more of the value in AI data centers both adds revenue and makes its offerings stickier for customers. [...] Nvidia is building on the effectiveness of its 17-year-old proprietary software, called CUDA, which enables programmers to use its chips. More recently, Huang has been pushing resources into a superfast networking protocol called InfiniBand, after acquiring the technology's main equipment maker, Mellanox Technologies, five years ago for nearly $7 billion. Analysts estimate that InfiniBand is used in most AI-training deployments. Nvidia is also building a business that supplies AI-optimized Ethernet, a form of networking widely used in traditional data centers. The Ethernet business is expected to generate billions of dollars in revenue within a year, Chief Financial Officer Colette Kress said Wednesday. More broadly, Nvidia sells products including central processors and networking chips for a range of other data-center equipment that is fine-tuned to work seamlessly together.

Read more of this story at Slashdot.

Scientists have finally solved a long-standing mystery about the geologic process behind these large pieces of gold found in quartz rock. From a report: Gold has always been a hot commodity. But these days, finding a nugget isn't too tricky: Much of the world's gold is mined from natural veins of quartz, a glassy mineral that streaks through large chunks of Earth's squashed-up crust. But the geologic process that put gold nuggets there in the first place was a mystery. Now, a new study published today in Nature Geoscience has come up with a convincing, and surprising, answer: electricity, and earthquakes -- lots of them. Those nuggets owe their existence to the strange electrical properties of common quartz. When squished or jiggled, the mineral generates electricity. That drags gold particles out of fluid in Earth's crust. The particles crystallize out as grains of gold -- and, over time, with enough electrical stimulation, those grains bloom into nuggets. "If you shake quartz, it makes electricity. If you make electricity, gold comes out," says Christopher Voisey, a geologist at Monash University in Australia and the lead author of the new paper. Earthquakes are the most likely natural source of that shaking, and the team's lab experiments show that earthquakes can make gold nuggets. The idea that gold nuggets appear because of electricity instead of a more conventional geologic process is, at first, a peculiar thought. But "it makes complete sense," says Thomas Gernon, a geoscientist at the University of Southampton in England and who was not involved with the new work. Quartz veins host a disproportionate number of gold nuggets and their environments experience plenty of earthquakes.

Read more of this story at Slashdot.

Canva, a popular online design platform, plans to significantly increase prices for some of its business subscriptions next year, citing the addition of generative AI features. The company's Teams subscription, which supports multiple users, will see price hikes of up to 300% in some regions. From a report: Subscribers to Canva Teams, which is targeted at businesses with several users, were emailed late last week to notify them of the price increase, which amounts to a three-times jump. A spokesperson for Canva said the price rise was due in part to the introduction of a number of new features on the Canva platform, including many powered by AI and generative AI.

Read more of this story at Slashdot.

Kotaku reviews Star Wars Outlaws, Ubisoft's latest AAA title: I was staring at a wall. It was an early mission in Ubisoft's latest behemothic RPG, Star Wars Outlaws, in which I was charged with infiltrating an Empire base to recover some information from a computer, and this wall really caught my attention. It was a perfect wall. It absolutely captured that late-70s sci-fi aesthetic of dark gray cladding broken up by utilitarian-gray panels covered in dull blinking lights, and I stopped to think about how much work must have gone into that wall. Looking elsewhere on the screen, I was then overwhelmed. This wall was the most bland thing in a vast hanger, where TIE Fighters hung from the ceiling, Stormtroopers wandered in groups below, and even the little white sign with the yellow arrow looked like it was a decade old, meticulously crafted to fit into this universe. I felt sheer astonishment at the achievement of this. Ubisoft, via multiple studios across the whole world, and the work of thousands of deeply talented people, had built this impossibly perfect area for one momentary scene that I was intended to run straight past. Except I ran past it three times, because the AI kept fucking up and I was restarted at a checkpoint right before that gray wall over and over. I'm struggling to capture the dissonance of this moment. This sense of absolute awe, almost unbelieving admiration that it's even possible to build games at this scale and at this detail, slapped hard around the face by the bewilderingly bad decisions that take place within it all. Brokerage firm UBS said in a note to clients: Based on the 621 ratings thus far the game has received a score of 4.8 (out of 10). This tracks behind previous blockbuster releases by Ubisoft in Assassin's Creed and Far Cry, behind competing open world games released in 2024 and behind other major recent Star Wars Games released by EA in 2019 and 2023. The user ratings, which are generally unfavourable lag its generally favourable critic reviews (game received a score of 76 by critics). Early user ratings suggest downside risk to our 10m units forecast for the game: While we previously felt the largely positive critic reviews made our 10m units sold look achievable (a component upon which we forecast +4% FY25 net bookings growth), the user ratings now suggest downside risk to our estimates. Previous Ubisoft games in Assassin's Creed and Far Cry which sold 10m+ units in their first fiscal year all received higher user ratings and were instalments of well entrenched franchises.

Read more of this story at Slashdot.

Children under the age of two should not be exposed to any screens whatsoever and teenagers should have no more than three hours of screen time a day, according to guidelines announced by health authorities in Sweden. From a report: Parents and guardians should think about how they use screens with their children and tell them what they are doing on their phones when they use them in their presence, the advice says. The guidelines, announced on Monday, mark the first time that Folkhalsomyndigheten, Sweden's public health authority, has stipulated how parents should regulate screen time. Screen use among two- to five-year-olds should be limited to a maximum of one hour, while children aged between six and 12 should not use screens for more than two hours. Among 13- to 18-year-olds, the limit is three hours. This is a sharp reduction on the current average screen time figures among Swedish children and young people, which is estimated to be four hours a day for nine- to 12-year-olds and more than seven hours a day -- not including schoolwork -- for 17- and 18-year-olds.

Read more of this story at Slashdot.

Night trains are experiencing a resurgence across Europe as travelers seek more environmentally friendly alternatives to flying. European Sleeper, a Dutch cooperative, recently launched a new overnight route from Brussels to Prague, extending its existing service to Berlin. The 13-hour journey traverses Germany in refurbished 1970s-era carriages, accommodating up to 600 passengers. Bart Poels, head of service, reports high demand with most routes fully booked through September. Passengers are citing various reasons for choosing night trains, including reduced carbon footprint, city center-to-center convenience, and cost savings on hotel accommodations, El Pais reports. The diverse clientele includes executives, families, and retirees. This revival comes after years of decline in night train services. Austrian railway OBB's Nightjet brand, launched in 2016, has also sparked renewed interest in overnight rail travel. The COVID-19 pandemic further accelerated the trend as travelers sought alternatives to flying. European officials are supporting the expansion of cross-border rail connections. The European Commission has backed pilot projects for more frequent and affordable services, while the European Investment Bank has provided loans for new equipment purchases.

Read more of this story at Slashdot.

Stefan S has recently joined the ranks of software developers, having taken on his first job as a junior developer. After a few months of on-boarding with Terry, another new developer, they're now both actually getting assigned real work on tickets that deliver new functionality.

Stefan proudly pushed his first feature, complete with plenty of unit, functional, and end-to-end tests. After a little brushing up during code-review, it was merged along with a few "atta boys", and Stefan was feeling pretty good about himself.

A few days later, he pulled the latest changes, and ran the test suite. And all of the tests he wrote suddenly failed. Stefan's stomach dropped into his shoes, and he struggled to think: "How did I mess up this badly?"

Except Stefan didn't mess up that badly. A quick check on source control history showed that Terry had added some new commits- one of which "optimized" Stefan's code by adding a NullPointerException.

Stefan was relieved, but annoyed. He opted to, in his mind, "be a bro", and not open a ticket that the rest of the team could see, and instead messaged Terry directly. "Your changes have broken functionality. You need to fix it."

At 5:05PM, Terry pushed a fix, and messaged Stefan, "Tests don't fail anymore," then left for the weekend. Terry was correct, the tests stopped failing.

(Names anonymized by Stefan)

public class MyPerfectlyDoneTestClassNotReadyToHaveTheHunsReleasesUponItself { @Test public void addition_isCorrect() { assertEquals(4, 2 + 2); } @Test public void test(){ try { // lots of logic and setup 20+ lines } catch (Throwable throwable) { assertTrue(true); } } @Test public void test2(){ // different logic assertTrue(true); } @Test public void test3(){ try { // yet more well thought out logic. Since there was setUp to these tests // he had to move the setUp to the actual methods and since they throw he had to put them in try catch } catch () { assertFalse(false); } } @Test public void test40Plus(){ // I give up assertTrue(true); } }

So, yes. Terry just asserted true on any test that threw an exception. Or, asserted false. He also stripped out the set-up methods for the test suite and copy/pasted the setup code into methods. This massive change to the test suite was quite a bit of work- quite a bit more than just fixing the bug with the null pointer.

The lesson here, for Stefan, is that "being a bro" isn't a great idea. Opening a ticket and creating visibility isn't throwing Terry under the bus- Terry's a junior and these kinds of mistakes are still likely to happen, and any healthy organization will be willing to allow growth. When we see mistakes, we can correct them.

The additional visibility also helps the organization spot the deeper WTF: Terry's code should never have ended up in a branch anyone else was touching. CI and code review should have stopped Terry from breaking code in a way that impacted anyone else.

[Advertisement] Keep the plebs out of prod. Restrict NuGet feed privileges with ProGet. Learn more.

Elastic, creator of popular search engine Elasticsearch and visualization tool Kibana, plans to introduce the AGPL open-source license alongside its existing licenses. The move comes three years after Elastic ditched the Apache 2.0 license, sparking controversy in the tech community. Founder Shay Banon says the change aims to clarify Elastic's market position following AWS's creation of OpenSearch, a fork of Elasticsearch. Despite initial friction, Banon claims Elastic's relationship with AWS has improved, citing growth in Elastic Cloud revenue and customer base.

Read more of this story at Slashdot.

Hewlett Packard Enterprise has confirmed it will push ahead with a high court lawsuit against the estate of the deceased tech tycoon Mike Lynch in which it is seeking damages of up to $4 billion. From a report: The US company said in a statement it would follow the legal proceedings "through to their conclusion" despite Lynch's death last month when his yacht sank off the coast of Italy. HPE won a civil claim against Lynch in the English high court in 2022, after accusing him and his former finance director Sushovan Hussain of fraud over its $11 billion takeover of his software company Autonomy in 2011. A ruling on damages is expected soon, although the judge presiding over the case, Mr Justice Hildyard, wrote in 2022 that he expected final damages to be "substantially less than is claimed." Lynch, 59, who was cleared in a separate criminal fraud trial over the Autonomy deal in the US in June, and his 18-year-old daughter Hannah, were among seven people who died after the Bayesian superyacht sank off the coast of Sicily last month.

Read more of this story at Slashdot.

An anonymous reader shares a report: While the latest update to Windows 11 makes it look like the upcoming Recall feature can be easily removed by users, Microsoft tells us it's just a bug and a fix is coming. Deskmodder spotted the change last week in the latest 24H2 version of Windows 11, with KB5041865 seemingly delivering the ability to uninstall Recall from the Windows Features section. "We are aware of an issue where Recall is incorrectly listed as an option under the 'Turn Windows features on or off' dialog in Control Panel," says Windows senior product manager Brandon LeBlanc in a statement to The Verge. "This will be fixed in an upcoming update."

Read more of this story at Slashdot.

A former executive of smartphone startup OSOM Products has filed a lawsuit alleging the company's founder misused funds for personal expenses, including two Lamborghinis and a lavish lifestyle. Mary Ross, OSOM's ex-Chief Privacy Officer, is seeking access to company records in a Delaware court filing. OSOM, founded in 2020 by former Essential employees, launched two products: the Solana-backed Saga smartphone and a privacy cable. Android founder Andy Rubin founded Essential, which sought to compete with Apple and Android-makers on a smartphone, but later shutdown after not find many takers for its phone. The lawsuit claims OSOM founder Jason Keats used company money for racing hobbies, first-class travel, and mortgage payments.

Read more of this story at Slashdot.

Efforts to add Rust code to the Linux kernel has suffered a setback as one of the maintainers of the Rust for Linux project has stepped down -- citing frustration with "nontechnical nonsense." The Register: Wedson Almeida Filho, a software engineer at Microsoft who has overseen the Rust for Linux project, announced his resignation in a message to the Linux kernel development mailing list. "I am retiring from the project," Filho declared. "After almost four years, I find myself lacking the energy and enthusiasm I once had to respond to some of the nontechnical nonsense, so it's best to leave it up to those who still have it in them." [...] Memory safety bugs are regularly cited as the major source of serious software vulnerabilities by organizations overseeing large projects written in C and C++. So in recent years there's been a concerted push from large developers like Microsoft and Google, and well as from government entities like the US Cybersecurity and Infrastructure Security Agency, to use memory-safe programming languages -- among them Rust. Discussions about adding Rust to Linux date back to 2020 and were realized in late 2022 with the release of Linux 6.1. "I truly believe the future of kernels is with memory-safe languages," Filho's note continued. "I am no visionary but if Linux doesn't internalize this, I'm afraid some other kernel will do to it what it did to Unix."

Read more of this story at Slashdot.

Notorious for a hardworking culture, Japan launched an initiative to help people cut back. But three years into the effort, the country is having a hard time coaxing people to take a four-day workweek. From a report: Japanese lawmakers first proposed a shorter work week in 2021. The guidelines aimed to encourage staff retention and cut the number of workers falling ill or dying from overwork in an economy already suffering from a huge labor shortage. The guidelines also included overtime limits and paid annual leave. However, the initiative has had a slow start: According to the Ministry of Health, Labor, and Welfare, only about 8% of companies in Japan allow employees to take three or more days off a week. It's not just companies -- employees are hesitant, too. Electronics manufacturer Panasonic, one of Japan's largest companies, opted into the effort in early 2022. Over two years in, only 150 of its 63,000 eligible employees have chosen to take up four-day schedules, a representative of the company told the Associated Press. Other major companies to introduce a four-day workweek include Uniqlo parent Fast Retailing, electronics giant Hitachi, and financial firm Mizuho. About 85% of employers report giving workers the usual two days off a week. Much of the reluctance to take an extra day off boils down to a culture of workers putting companies before themselves, including pressure to appear like team players and hard workers. This intense culture stems from Japan's postwar era, where, in an effort to boost the economy, then-Prime Minister Shigeru Yoshida enlisted major corporations to offer their employees lifelong job security, asking only that workers repay them with loyalty.

Read more of this story at Slashdot.

Google executive James Manyika has warned that AI's impact on productivity is not guaranteed [Editor's note: the link may be paywalled], despite predictions of trillion-dollar economic potential. From the report: "Right now, everyone from my old colleagues at McKinsey Global Institute to Goldman Sachs are putting out these extraordinary economic potential numbers -- in the trillions -- [but] it's going to take a whole bunch of actions, innovations, investments, even enabling policy ...The productivity gains are not guaranteed. They're going to take a lot of work." In 1987 economist Robert Solow remarked that the computer age was visible everywhere except in the productivity statistics. "We could have a version of that -- where we see this technology everywhere, on our phones, in all these chatbots, but it's done nothing to transform the economy in that real fundamental way." The use of generative AI to draft software code is not enough. "In the US, the tech sector is about 4 per cent of the labour force. Even if the entire tech sector adopted it 100 per cent, it doesn't matter from a labour productivity standpoint." Instead the answer lies with "very large sectors" such as healthcare and retail. Former British prime minister Sir Tony Blair has said that people "will have an AI nurse, probably an AI doctor, just as you'll have an AI tutor." Manyika is less dramatic: "In most of those cases, those professions will be assisted by AI. I don't think any of those occupations are going to be replaced by AI, not in any conceivable future."

Read more of this story at Slashdot.

schwit1 shares a report: If you are reading this and live in America, or used to live in America, or maybe just went to America one time many years ago, then you are almost certainly performing unpaid labor for the U.S. government and have been for years. How? By storing some of the billions of pennies the U.S. Mint makes every year that virtually no one uses. Why are we still making tons (many thousands of tons) of pennies if no one uses them? That's a sensible question with a psychotic answer: We have to keep making all these pennies -- over $45 million worth last year -- because no one uses them. In fact, it could be very bad if we did. When you insert a quarter into a soda machine, that quarter eventually finds its way back to a bank, from which it can be redistributed to a store's cash register and handed out as change -- maybe even to you, who can put it into a soda machine again and start the whole process over. That's beautiful. (Please be mindful of your soft drink consumption.) But few of us ever spend pennies. We mostly just store them. The 1-cent coins are wherever you've left them: a glass jar, a winter purse, a RAV4 cup holder, a five-gallon water cooler dispenser, the couch. Many of them are simply on the ground. But take it from me, a former cashier: Cashiers don't have time to scrounge on the sidewalk every time they need to make change. That is where the Mint comes in. Every year it makes a few billion more pennies to replace the ones everyone is thoughtlessly, indefinitely storing and scatters them like kudzu seeds across the nation. You -- a scientist of some kind, possibly -- might think an obvious solution now presents itself: Why not encourage people to use the pennies they have lying around instead of manufacturing new ones every year? We can't! Or, anyway, we'd better not. According to a Mint report, if even a modest share of our neglected pennies suddenly returned to circulation, the result would be a "logistically unmanageable" dilemma for Earth's wealthiest nation. As in, the penny tsunami could overwhelm government vaults. That's not great, but at the end of the day we're talking only about pennies. How much could a penny cost to make? A penny? If only we lived in such a paradise. Unfortunately, one penny costs more than three pennies (3.07 cents at last count) to make and distribute! When I learned this, I lost my mind.

Read more of this story at Slashdot.