Security

Spyware Maker LetMeSpy Shuts Down After Hacker Deletes Server Data (techcrunch.com) 20

An anonymous reader quotes a report from TechCrunch: Poland-based spyware LetMeSpy is no longer operational and said it will shut down after a June data breach wiped out its servers, including its huge trove of data stolen from thousands of victims' phones. In a notice on its website in both English and Polish, LetMeSpy confirmed the "permanent shutdown" of the spyware service and that it would cease operations by the end of August. The notice said LetMeSpy is blocking users from logging in or signing up with new accounts. A separate notice on LetMeSpy's former login page, which no longer functions, confirmed earlier reports that the hacker who breached the spyware operation also deleted the data on its servers. "The breach consisted of unauthorized access to the LetMeSpy website's database, downloading and at the same time deleting data from the website by the author of the attack," the notice reads. LetMeSpy's app no longer functions, a network traffic analysis by TechCrunch shows, and the spyware maker's website no longer provides the spyware app for download.

LetMeSpy was an Android phone monitoring app that was purposefully designed to stay hidden on a victim's phone home screen, making the app difficult to detect and remove. When planted on a person's phone -- often by someone with knowledge of their phone passcode -- apps like LetMeSpy continually steal that person's messages, call logs and real-time location data. A copy of the database was obtained by nonprofit transparency collective DDoSecrets, which indexes leaked datasets in the public interest, and shared with TechCrunch for analysis. The data showed that LetMeSpy, until recently, had been used to steal data from more than 13,000 compromised Android devices worldwide, though LetMeSpy's website claimed prior to the breach that it controlled more than 236,000 devices. The database also contained information that shows the spyware was developed by a Krakow-based tech company called Radeal, whose chief executive Rafal Lidwin did not respond to a request for comment.

Communications

FCC Prepares $75 Monthly Broadband Subsidies For 'High-Cost' Areas (arstechnica.com) 41

The Federal Communications Commission is paving the way for $75 monthly subsidies to make broadband service more affordable for low-income households in certain "high-cost" areas. From a report: The $75 subsidy will be part of the Affordable Connectivity Program (ACP) that generally offers $30 monthly discounts to people with low incomes. The ACP was created by Congress in late 2021 and implemented by the FCC to replace a previous pandemic-related subsidy program. The ACP already provides $75 monthly subsidies for homes on tribal lands, but not in other areas. The US law that created the ACP lets the FCC make $75 subsidies available in areas where the costs of building broadband networks are higher than average.

That's what the FCC did in its action announced yesterday. "The Infrastructure Act specified that the $75 monthly benefit would support providers that can demonstrate that the standard $30 monthly benefit would cause them to experience 'particularized economic hardship' such that they would be unable to maintain part or all of their broadband network in a high-cost area," the FCC said. ACP subsidies are distributed to Internet service providers that enroll in the program and give customers discounts. Comcast, Charter Spectrum, AT&T, Verizon, and other ISPs last year agreed to make $30 plans with download speeds of at least 100Mbps available to eligible low-income households, essentially making the Internet service free when the $30 subsidy is applied.

ISS

SpaceX Studies Use of Starship as a Space Station (arstechnica.com) 18

Recently Ars Technica reported on "another application for SpaceX's Starship architecture that the company is studying," adding that NASA "is on board to lend expertise.

"Though still in a nascent phase of tech development, the effort could result in repurposing Starship into a commercial space station, something NASA has a keen interest in because there are no plans for a government-owned research lab in low-Earth orbit after the International Space Station is decommissioned after 2030." NASA announced last month a new round of agreements with seven commercial companies, including SpaceX. The Collaborations for Commercial Space Capabilities (CCSC) program is an effort established to advance private sector development of emerging products and services that could be available to customers — including NASA — in approximately five to seven years... NASA passed over SpaceX's bid for a funded space station development agreement in 2021, identifying concerns about SpaceX's plans for scaling its life-support system to enable long-duration missions and SpaceX's plan for a single docking port, among other issues. The space agency isn't providing any funding for the new CCSC effort, which includes the Starship space station concept, but the government will support the industry with technical expertise, including expert assessments, lessons learned, technologies, and data.

Apart from the SpaceX agreement, NASA said it will provide non-financial support to Blue Origin's initiative to develop a crew spacecraft for orbital missions that would launch on the company's New Glenn rocket. The agency also supports Northrop Grumman's development of a human-tended research platform in low-Earth orbit to work alongside the company's planned space station. The other companies NASA picked for unfunded agreements were: Sierra Space's proposal for a crewed version of its Dream Chaser spacecraft, Vast's concept for a privately owned space station, ThinkOrbital's plan to develop welding, cutting, inspection, and additive manufacturing technology for construction work in space, and Special Aerospace Services for collaboration on an autonomous maneuvering unit to assist, or potentially replace, spacewalkers working outside a space station.

Despite the lack of NASA funding, the new collaboration announcement with SpaceX laid out — in broad strokes, at least — one of the directions SpaceX may want to take Starship. NASA said it will work with SpaceX on an "integrated low-Earth orbit architecture" that includes the Starship vehicle and other SpaceX programs, including the Dragon crew capsule and Starlink broadband network.

The artice links to a recent NASA document detailing SpaceX's space station concept. Phil McAlister, who heads NASA's commercial spaceflight division, says its size and reduced cost "could have a far-reaching impact on the sustainable development of the low-Earth orbit) economy...

"Adding increased confidence is the company's plan to self-fund Starship development from its launch and satellite enterprises."

Thanks to long-time Slashdot reader Amiga Trombone for sharing the article.
Space

NASA Finally Restores Communication with Voyager 2 After Two Weeks (apnews.com) 47

"NASA has reestablished full communications with Voyager 2," according to a mission update posted Friday: The agency's Deep Space Network facility in Canberra, Australia, sent the equivalent of an interstellar "shout" more than 12.3 billion miles (19.9 billion kilometers) to Voyager 2, instructing the spacecraft to reorient itself and turn its antenna back to Earth. With a one-way light time of 18.5 hours for the command to reach Voyager, it took 37 hours for mission controllers to learn whether the command worked. At 12:29 a.m. EDT on Aug. 4, the spacecraft began returning science and telemetry data, indicating it is operating normally and that it remains on its expected trajectory.
"Had the Earth-based signals not reached Voyager 2, the spacecraft is already programmed to reorient itself multiple times a year to keep its antenna pointing in our planet's direction," CNN points out. "The next reset was already scheduled for October 15. But the team didn't want to wait that long..."

After controllers sent the wrong command to the 46-year-old spacecraft, Voyager 2's antenna needed to be shifted "a mere 2 degrees," notes The Associated Press:

Voyager 2 has been hurtling through space since its launch in 1977 to explore the outer solar system. Launched two weeks later, its twin, Voyager 1, is now the most distant spacecraft — 15 billion miles (24 billion kilometers) away — and still in contact. As long as their plutonium power holds, the Voyagers may be alive and well for the 50th anniversary of their launch in 2027, according to Dodd. Among the scientific tidbits they've beamed back in recent years include details about the interstellar magnetic field and the abundance of cosmic rays.
Power

MIT Boffins Build Battery Alternative Out of Cement, Carbon Black, and Water (theregister.com) 78

Long-time Slashdot reader KindMind shares a report from The Register: Researchers at MIT claim to have found a novel new way to store energy using nothing but cement, a bit of water, and powdered carbon black -- a crystalline form of the element. The materials can be cleverly combined to create supercapacitors, which could in turn be used to build power-storing foundations of houses, roadways that could wirelessly charge vehicles, and serve as the foundation of wind turbines and other renewable energy systems -- all while holding a surprising amount of energy, the team claims. According to a paper published in the Proceedings of the National Academy of Sciences, 45 cubic meters of the carbon-black-doped cement could have enough capacity to store 10 kilowatt-hours of energy -- roughly the amount an average household uses in a day. A block of cement that size would measure about 3.5 meters per side and, depending on the size of the house, the block could theoretically store all the energy an off-grid home using renewables would need." [...]

Just three percent of the mixture has to be carbon black for the hardened cement to act as a supercapacitor, but the researchers found that a 10 percent carbon black mixture appears to be ideal. Beyond that ratio, the cement becomes less stable -- not something you want in a building or foundation. The team notes that non-structural use could allow higher concentrations of carbon black, and thus higher energy storage capacity. The team has only built a tiny one-volt test platform using its carbon black mix, but has plans to scale up to supercapacitors the same size as a 12-volt automobile battery -- and eventually to the 45 cubic meter block. Along with being used for energy storage, the mix could also be used to provide heat -- by applying electricity to the conductive carbon network encased in the cement, MIT noted.

As Science magazine puts it, "Tesla's Powerwall, a boxy, wall-mounted, lithium-ion battery, can power your home for half a day or so. But what if your home was the battery?"
Piracy

Z-Library Rolls Out Browser Extensions In Anticipation of Domain Name Troubles (torrentfreak.com) 15

Pirate eBook repository Z-Library has launched browser extensions that should make it easier for users to find the site if its current domains are seized in the future. While the site doesn't explicitly mention the U.S. Government crackdown, it likely plays a key role in the decision to make these extensions available. TorrentFreak reports: Since the shadow library is now well aware that its domain names could be taken away at any moment, numerous precautions are being taken to mitigate the risks. A few weeks ago, Z-Library released a dedicated desktop application that should make it easier to access the site. The software has the ability to redirect users to working domains and whenever necessary, connect over the Tor network, which also helps to evade blocking efforts. In an announcement this week, the operators of the shadow library unveiled new precautionary tools to redirect users to working domains, including any new ones, should they be needed.

The new browser extensions are available for both Chrome and Firefox and promise 'seamless access' to alternative domains in the event that existing ones run into trouble. "Say goodbye to searching for available domains, as this handy extension takes care of everything for you. Simplify your online library experience and enjoy seamless access to a world of knowledge, right at your fingertips. "After launching the extension, the process of searching for an available domain will begin. Within some seconds when the domain is found, you will be redirected to the library homepage," Z-Library explains.

While installing browser extensions should always happen with caution, in just a few hours thousands of Z-Library users have already installed the new software. According to the Chrome store, the Z-Library Finder currently has over 7,000 users. These extensions may indeed help to point users to new domain names, but the solution isn't bulletproof. The authorities may attempt to remove the listings from the Chrome and Firefox extension libraries, for example. Even if Z-Library decides to self-host these tools, they still rely on technical infrastructure that could be targeted in the future. That being said, the releases are still notable; it's rare to a service going full steam ahead in the face of an active criminal case.

Security

A Cyberattack Has Disrupted Hospitals and Health Care in Several States (apnews.com) 20

A cyberattack has disrupted hospital computer systems in several states, forcing some emergency rooms to close and ambulances to be diverted, and many primary care services remained closed on Friday as security experts worked to determine the extent of the problem and resolve it. From a report: The "data security incident" began Thursday at facilities operated by Prospect Medical Holdings, which is based in California and has hospitals and clinics there and in Texas, Connecticut, Rhode Island and Pennsylvania. "Upon learning of this, we took our systems offline to protect them and launched an investigation with the help of third-party cybersecurity specialists," the company said in a statement Friday. "While our investigation continues, we are focused on addressing the pressing needs of our patients as we work diligently to return to normal operations as quickly as possible." In Connecticut, the emergency departments at Manchester Memorial and Rockville General hospital were closed for much of Thursday and patients were diverted to other nearby medical centers.

[...] The FBI in Connecticut issued a statement saying it is working with "law enforcement partners and the victim entities" but could not comment further on an ongoing investigation. Elective surgeries, outpatient appointments, blood drives and other services were suspended, and while the emergency departments reopened late Thursday, many primary care services were closed on Friday, according to the Eastern Connecticut Health Network, which runs the facilities. Patients were being contacted individually, according to the network's website. Similar disruptions also were reported at other facilities system-wide.

Transportation

The Boring Company Will Dig a 68-Mile Tunnel Network Under Las Vegas (arstechnica.com) 142

An anonymous reader quotes a report from Ars Technica: Elon Musk's tunneling company has permission to significantly expand its operations under the city of Las Vegas. Last month, the Las Vegas City Council voted unanimously to approve the Boring Company's plan to dig more tunnels under the city, following in the steps of Clark County, which in May gave a similar thumbs-up to the tunneling concern. The company's plan calls for 68 miles of tunnels and 81 stations, served by a fleet of Tesla electric vehicles, each able to carry three passengers at a time.

Despite the unanimous approval, Mayor Carolyn Goldman had a litany of concerns, including safety, low throughput of passengers, and a lack of accessibility. However, she said that "hotels are begging for transportation options." [...] Should the Boring Company see this project through to completion, 60 of the stations would be in Clark County, mostly concentrated down the Strip and the major casinos, with the remaining 21 in the city of Las Vegas.

It's funny.  Laugh.

Excel's Esports Revolution is Coming Back To ESPN This Week (theverge.com) 24

The Excel World Championship is coming back to ESPN this week. On Friday morning at 7AM ET, as part of ESPN's annual "The Ocho" event, a few of the world's foremost Excel experts will battle to solve puzzles on the biggest stage in sports. From a report: The Ocho is an ESPN event designed to show off otherwise un-televised sports -- Excel is on the docket alongside "2023 Slippery Stairs," the "Pillow Fight Championship," and competitions in everything from belt-sanding to sign spinning -- but it's still a big deal. When competitive Excel showed up on the network last year, the sport found a whole new audience. More than 800,000 people have since watched the full 2.5-hour competition on YouTube (ESPN showed a 30-minute edit of the battle), and the folks who started the World Championship say it changed the event's trajectory forever.
Australia

Australians Fight for the Right To Work From Home Permanently (reuters.com) 75

As corporate leaders call for an end to pandemic-era remote work arrangements, unions in Australia are setting a precedent and fighting back, taking to court the country's biggest bank and wrangling with the federal government to demand WFH, as it is known, to become the norm. From a report: "All the deep changes in the Australian labour market have come out of crises. When you have a jolt, you never return to the way the world was," said John Buchanan, head of the University of Sydney's Health and Work Research Network. "We're always ahead of the pack in the English-speaking world, say compared to the UK, US, New Zealand." Empowered by the lowest unemployment rate in half a century, staff at Commonwealth Bank of Australia took the A$170 billion ($114 billion) lender to the industrial tribunal to challenge a directive to work from the office half of the time.
Printer

Canon Warns Printer Users To Manually Wipe Wi-Fi Settings Before Discarding 37

Printer manufacturer Canon is warning that sensitive Wi-Fi settings don't automatically get wiped during resets, so customers should manually delete them before selling, discarding, or getting them repaired to prevent the settings from falling into the wrong hands. From a report: "Sensitive information on the Wi-Fi connection settings stored in the memories of inkjet printers (home and office/large format) may not be deleted by the usual initialization process," company officials wrote in an advisory on Monday. They went on to say that manual wiping should occur "when your printer may be in the hand of any third party, such as when repairing, lending or disposing the printer."

Like many printers these days, those from Canon connect to networks over Wi-Fi. To do this, users must provide the SSID name, the password preventing unauthorized access to the network, and in some cases, additional information such as Wi-Fi network type, the local network IP address, the MAC address, and network profile. It would be reasonable to assume that performing a simple factory reset that returns all settings to their defaults would be enough to remove these settings, but Monday's advisory indicated that isn't necessarily the case. In the event this information is exposed, malicious actors could use them to gain unauthorized access to a network hosting a Canon printer.
Encryption

Cult of Dead Cow Hacktivists Design Encryption System for Mobile Apps (washingtonpost.com) 22

Once known for distributing hacking tools and shaming software companies into improving their security, a famed group of technology activists is now working to develop a system that will allow the creation of messaging and social networking apps that won't keep hold of users' personal data. From a report: The group, Cult of the Dead Cow, has developed a coding framework that can be used by app developers who are willing to embrace strong encryption and forsake revenue from advertising that is targeted to individuals based on detailed profiles gleaned from the data most apps now routinely collect. The team is building on the work of such free products as Signal, which offers strong encryption for text messages and voice calls, and Tor, which offers anonymous web surfing by routing traffic through a series of servers to disguise the location of the person conducting the search.

The latest effort, to be detailed at the massive annual Def Con hacking conference in Las Vegas next week, seeks to provide a foundation for messaging, file sharing and even social networking apps without harvesting any data, all secured by the kind of end-to-end encryption that makes interception hard even for governments. Called Veilid, and pronounced vay-lid, the code can be used by developers to build applications for mobile devices or the web. Those apps will pass fully encrypted content to one another using the Veilid protocol, its developers say. As with the file-sharing software BitTorrent, which distributes different pieces of the same content simultaneously, the network will get faster as more devices join and share the load, the developers say. In such decentralized "peer-to-peer" networks, users download data from each other instead of from a central machine.

Piracy

Reddit Beats Film Industry, Won't Have To Identify Users Who Admitted Torrenting (arstechnica.com) 55

An anonymous reader quotes a report from Ars Technica: Film companies lost another attempt to force Reddit to identify anonymous users who discussed piracy. A federal court on Saturday quashed a subpoena (PDF) demanding users' names and other identifying details, agreeing with Reddit's argument that the film companies' demands violate the First Amendment. The plaintiffs are 20 producers of popular movies who are trying to prove that Internet service provider Grande is liable for its subscribers' copyright infringement because the ISP allegedly ignores piracy on its network. Reddit isn't directly involved in the copyright case. But the film companies filed a motion to compel Reddit to respond to a subpoena demanding "basic account information including IP address registration and logs from 1/1/2016 to present, name, email address and other account registration information" for six users who wrote comments on Reddit threads in 2011 and 2018.

"The issue is whether that discovery is permissible despite the users' right to speak anonymously under the First Amendment," US Magistrate Judge Laurel Beeler wrote in her ruling against the film copyright holders. "The court denies the motion because the plaintiffs have not demonstrated a compelling need for the discovery that outweighs the users' First Amendment right to anonymous speech." The film companies seeking Reddit users' identities include After II Movie LLC, Bodyguard Productions, Hitman 2 Productions, Millennium Funding, Nikola Productions, Rambo V Productions, and Dallas Buyers Club LLC. As Beeler's ruling on Saturday noted, they sought the identities of two users who wrote about torrenting on Grande's network in 2018 [...]. The companies also sought identities of four users who commented in a 2011 thread. "I have grande. No issues with torrent or bandwidth caps," one user comment said. Another Reddit user wrote, "I have torrented like a motherfucker all over grande and have never seen anything." Reddit's filing (PDF) pointed out that the statute of limitations for copyright infringement is three years. The film companies said (PDF) the statute of limitations is irrelevant to whether the comments can provide evidence in the case against Grande.

XBox (Games)

Microsoft Now Offers Xbox Wireless Controller Replacement Parts For DIY Repairs (neowin.net) 28

Microsoft is extending the repairability program it introduced for its Surface PC products to include replacement parts for its Xbox Wireless Controller and Xbox Elite Controller Series 2 products. Neowin reports: The page on the Microsoft Store site shows that replacement parts are available for the top case for both versions of the controller, along with replacement buttons. In addition, Microsoft is selling Replacement Input PCBA boards for those Xbox controllers, along with the Replacement PCBA and Motor Assembly parts as well. The parts do come with a one-year warranty.

In a new support page, Microsoft makes it clear that these parts should only be purchased and used for Xbox controllers that are out of their normal warranty period. On another support page, the company adds: "These types of repairs require moderate technical skill, and are suited for enthusiasts, professionals, or those with prior experience in electronic disassembly. If this is your first attempt at performing a repair, use caution and follow our safety recommendations and step-by-step instructions."

Microsoft also says that certain tools, which are not directly sold by the company, will be needed to replace and repair the controllers. They include a plastic pry tool, TR8 and T5 Torx screwdriver bits and plastic tweezers. Microsoft does offer PDF files (PDF) and even offers YouTube video tutorials for repairing the Xbox Wireless Controller and the Xbox Elite Wireless Controller Series 2.

The Internet

AWS To Start Charging For Public IPv4 Addresses (theregister.com) 140

Long-time Slashdot reader nairnr shares a report from The Register: Cloud giant AWS will start charging customers for public IPv4 addresses from next year, claiming it is forced to do this because of the increasing scarcity of these and to encourage the use of IPv6 instead. It is now four years since we officially ran out of IPv4 ranges to allocate, and since then, those wanting a new public IPv4 address have had to rely on address ranges being recovered, either from from organizations that close down or those that return addresses they no longer require as they migrate to IPv6.

If Amazon's cloud division is to be believed, the difficulty in obtaining public IPv4 addresses has seen the cost of acquiring a single address rise by more than 300 percent over the past five years, and as we all know, the business is a little short of cash at the moment, so is having to pass these costs on to users. "This change reflects our own costs and is also intended to encourage you to be a bit more frugal with your use of public IPv4 addresses and to think about accelerating your adoption of IPv6 as a modernization and conservation measure,' writes AWS Chief Evangelist Jeff Barr, on the company news blog.

The update will come into effect on February 1, 2024, when AWS customers will see a charge of $0.005 (half a cent) per IP address per hour for all public IPv4 addresses. These charges will apparently apply whether the address is attached to a service or not, and like many AWS charges, appear inconsequential at first glance but can mount up over time if a customer is using many of them. These charges will apply to all AWS services including EC2, Relational Database Service (RDS) database instances, Elastic Kubernetes Service (EKS) nodes, and will apply across all AWS regions, the company said. However, customers will not be charged for IP addresses that they own and bring to AWS using Amazon's BYOIP feature. AWS offers a free tier for EC2, and this will include 750 hours of public IPv4 address usage per month for the first 12 months, starting from the same date the charges do.

Businesses

Amazon Achieved Its 'Fastest Prime Speeds Ever' Last Quarter (techcrunch.com) 45

An anonymous reader quotes a report from TechCrunch: Amazon achieved its "fastest Prime speeds ever" last quarter, the online retail giant announced on Monday. The company says it has delivered more than 1.8 billion units to U.S. Prime members so far this year, nearly four times what it delivered at those speeds by this point in 2019. Across the top 60 largest U.S. metro areas, more than half of Prime member orders arrived the same or next day. Same-day delivery is currently available on millions of items for customers across more than 90 U.S. metro areas, and Amazon plans to double the number of delivery sites in the coming years.

Amazon notes that the average time from picking a customer's items to positioning the customer's package on the outbound dock is 11 minutes in same-day facilities, more than an hour faster than its traditional fulfillment centers. For context, same-day facilities are stocked with what customers in those areas are purchasing, while traditional facilities are larger and include a more vast assortment of items. "As we make these changes, we are seeing that they have the added benefit of reducing costs, too," Doug Herrington, CEO of Worldwide Amazon Stores, wrote in a blog post. "Regionalizing our network reduces miles traveled and handoffs. Since the beginning of this year alone, the distance between our sites and the customer decreased by 15%, with 12% fewer touchpoints within our middle mile network. Improved product placement gets items even closer to customers, making our delivery system more efficient. And our Same-Day Delivery network is not only our fastest way to get products to customers, it is also one of our lowest cost ways."

Power

Seven Major Automakers Plan 30,000 More High-Speed Chargers in North America by 2030 (theverge.com) 72

"A new group of automotive super friends is banding together," reports the Verge, "promising to build the next big North American electric vehicle charging network." These worldwide automakers — BMW, General Motors, Honda, Hyundai, Kia, Mercedes-Benz, and Stellantis — announced a planned joint venture Wednesday to erect easy-to-activate DC fast chargers along US and Canadian highways and in urban environments.

The grand plan for the currently unnamed partnership is to install "at least" 30,000 high-speed EV chargers by 2030, with the first ones to open summer 2024 in the US. The collective plans to leverage National Electric Vehicle Infrastructure (NEVI) funding in the US and will also use other private and public funding from state and federal sources to build out the network... The new stations will connect and charge EV models made by the partnered automakers without having to fumble with another charging station app. The companies also plan to integrate the developing "Plug and Charge" standard that the Federal Highway Administration is attempting to standardize... All stations will include the standardized Tesla North American Charging Standard (NACS) ports and also the current widely used Combined Charging System (CCS) plugs.

"The new joint venture is also planned to be entirely powered by renewable energy," the article adds.

But "It's not known if renewable energy will directly power them or if the companies plan to buy credits like Rivian announced Tuesday."
Red Hat Software

AlmaLinux Discovers Working with Red Hat (and CentOS Stream) Isn't Easy (zdnet.com) 73

After Red Hat's decision to only share RHEL source code with subscribers, AlmaLinux asked their bug report submitters to "attempt to test and replicate the problem in CentOS Stream as well, so we can focus our energy on correcting it in the right place."

Red Hat told Ars Technica they are "eager to collaborate" on their CentOS Stream distro, "even if we ultimately compete in a business sense. Differentiated competition is a sign of a healthy ecosystem."

But Red Hat still managed to ruffled some feathers, reports ZDNet: AlmaLinux Infrastructure Team Leader Jonathan Wright recently posted a CentOS Stream fix for CVE-2023-38403, a memory overflow problem in iperf3. Iperf3 is a popular open-source network performance test. This security hole is an important one, but not a huge problem.

Still, it's better by far to fix it than let it linger and see it eventually used to crash a server. That's what I and others felt anyway. But, then, a senior Red Hat software engineer replied, "Thanks for the contribution. At this time, we don't plan to address this in RHEL, but we will keep it open for evaluation based on customer feedback."

That went over like a lead balloon.

The GitLab conversation proceeded:

AlmaLinux: "Is customer demand really necessary to fix CVEs?"

Red Hat: "We commit to addressing Red Hat defined Critical and Important security issues. Security vulnerabilities with Low or Moderate severity will be addressed on demand when [a] customer or other business requirements exist to do so."

AlmaLinux: "I can even understand that, but why reject the fix when the work is already done and just has to be merged?"

At this point, Mike McGrath, Red Hat's VP of Core Platforms, AKA RHEL, stepped in. He explained, "We should probably create a 'what to expect when you're submitting' doc. Getting the code written is only the first step in what Red Hat does with it. We'd have to make sure there aren't regressions, QA, etc. ... So thank you for the contribution, it looks like the Fedora side of it is going well, so it'll end up in RHEL at some point."

Things went downhill rapidly from there...

On Reddit, McGrath said, "I will admit that we did have a great opportunity for a good-faith gesture towards Alma here and fumbled."

Finally, though the Red Hat Product Security team rated the CVE as "'Important,' the patch was merged.

Coincidentally, last month AlmaLinux announced that its move away from 1:1 compatibility with RHEL meant "we can now accept bug fixes outside of Red Hat's release cycle."

This Thursday AlmaLinux also reiterated that they're "fully committed to delivering the best possible experience for the community, no matter where or what you run." And in an apparent move to beef up compatibility testing, they announced they'd be bringing openQA to the RHEL ecosystem. (They describe openQA as a tool using virtual machines that "simplifies automated testing of the whole installation process of an operating system in a wide combination of software and hardware configurations.")
Piracy

Italian Pirate IPTV Customers Risk a 5,000 Euro Fine Starting August 8, 2023 (torrentfreak.com) 45

An anonymous reader quotes a report from TorrentFreak: Italy's brand new anti-piracy law has just received full approval from telecoms regulator AGCOM. In a statement issued Thursday, AGCOM noted its position "at the forefront of the European scene in combating online piracy." The new law comes into force on August 8 and authorizes nationwide ISP blocking of live events and enables the state to issue fines of up to 5,000 euros to users of pirate streams .

In a statement published Thursday, AGCOM welcomed the amendments to Online Copyright Enforcement regulation 680/13/CONS, which concern measures to counter the illegal distribution of live sports streams, as laid out in Resolution 189/23/CONS. The new provisions grant AGCOM the power to issue "dynamic injunctions" against online service providers of all kinds, a privilege usually reserved for judges in Europe's highest courts. The aim is to streamline blocking measures against unlicensed IPTV services, with the goal of rendering them inaccessible across all of Italy.

"With such measures, it will be possible to disable access to pirated content in the first 30 minutes of the event broadcast by blocking DNS resolution of domain names and blocking the routing of network traffic to IP addresses uniquely intended for illicit activities," AGCOM says. "With this amendment, in perfect synchrony with the changes introduced by Parliament, AGCOM is once again at the forefront of the European scene in combating online piracy activity," says AGCOM Commissioner Massimiliano Capitanio.

NASA

NASA's Voyager 2 Is Experiencing an Unplanned 'Communications Pause' (gizmodo.com) 60

A routine sequence of commands has triggered a 2-degree change in Voyager 2's antenna orientation, preventing the iconic spacecraft from receiving commands or transmitting data back to Earth, NASA announced earlier today. Mission controllers transmitted the commands to Voyager 2 on July 21. Gizmodo reports: Voyager 2, one of two twin probes launched in the 1970s to explore planets in the outer solar system, is located some 12.4 billion miles (19.9 billion kilometers) from Earth and is continually moving deeper into interstellar space. The glitch has disrupted the probe's ability to communicate with ground antennas operated by the Deep Space Network (DSN), and it's unable to receive commands from the mission team on Earth, NASA explained.

The communications pause is expected to be just that -- a pause. Voyager 2 is "programmed to reset its orientation multiple times each year to keep its antenna pointing at Earth," the space agency says. This procedure should -- fingers crossed -- re-establish the lost connection and allow routine communications to resume. The next reset is scheduled for October 15, which is 79 days from now. Undoubtedly, this will be 79 agonizing days for NASA and the Voyager team. Despite the current communication hiatus, the mission team remains confident that Voyager 2 will stay on its planned trajectory. Voyager 1, situated nearly 15 billion miles (24 billion kilometers) away from Earth, "continues to operate normally," NASA added.

Slashdot Top Deals