An anonymous reader quotes a report from ZDNet: French authorities have arrested five men who stole over 120,000 liters (26,400 gallons) of fuel from gas stations around Paris by unlocking gas pumps using a special remote. The five-man team operated with the help of a special remote they bought online and which could unlock a particular brand of gas pumps installed at Total gas stations. The hack was possible because some gas station managers didn't change the gas pump's default lock code from the standard 0000. Hackers would use this simple PIN code to reset fuel prices and remove any fill-up limits.

Crooks would operate in small teams of two to three individuals who visited gas stations at night using two vehicles. A man in a first car would use the remote to unlock the gas station, and then a second car, usually a van, would come along seconds later to fill a giant tanker installed in the back of the vehicle with as much as 2,000 or 3,000 liters in one go. The group advertised the fuel they stole on social media, providing a time and place where customers could come and refuel their vehicles or pick up orders for gasoline and diesel at smaller prices. Police uncovered the scheme in April 2018, when they arrested a suspect in possession of a remote used in the hack. "Five men, part of the same gang, were arrested on Monday, according to Le Parisien, who first reported the scheme last November," the report adds.

A new report from the open source security company WhiteSource asks the question, "Is one programming language more secure than the rest?"

An anonymous reader quotes TechRepublic: To answer this question, the report compiled information from WhiteSource's database, which aggregates information on open source vulnerabilities from sources including the National Vulnerability Database, security advisories, GitHub issue trackers, and popular open source projects issue trackers. Researchers focused in on open source security vulnerabilities in the seven most widely-used languages of the past 10 years to learn which are most secure, and which vulnerability types are most common in each...

The most common vulnerabilities across most of these languages are Cross-SiteScripting (XSS); Input Validation; Permissions, Privileges, and Access Control; and Information Leak / Disclosure, according to the report.
Across the seven most widely-used programming languages, here's how the vulnerabilities were distributed:

• C (47%)
• PHP (17%)
• Java (11%)
• JavaScript (10%)
• Python (5%)
• C++ (5%)
• Ruby (4%)

But the results are full of disclaimers -- for example, that C tops the list because it's the oldest language with "the highest volume of written code" and "is also one of the languages behind major infrastructure like Open SSL and the Linux kernel."

The report also notes a "substantial rise" across all languages for known open source security vulnerabilities over the last two years, attributing this to more awareness about vulnerable components -- thanks to more research, automated security tools, and "the growing investment in bug bounty programs" -- as well as the increasing popularity of open source software. And it also reports a drop in the percentage of critical vulnerabilities for most languages -- except JavaScript and PHP.

The report then concludes that "the Winner Of Most Secure Programming Language is...no one and everyone...! It is not about the language itself that makes it any more or less secure, but how you use it. If you are mitigating your vulnerabilities throughout the software development lifecycle with the proper management approach, then you are far more likely to stay secure."

Coincidentally, WhiteSource sells software which monitors open source components throughout the software development lifecycle to provide alerts about security (and licensing) issues.

After being delayed for the better part of one month, LLVM 8.0 officially is finally available. From a report: LLVM release manager Hans Wennborg announced the release a few minutes ago and summed up this half-year update to LLVM and its sub-project as: "speculative load hardening, concurrent compilation in the ORC JIT API, no longer experimental WebAssembly target, a Clang option to initialize automatic variables, improved pre-compiled header support in clang-cl, the /Zc:dllexportInlines- flag, RISC-V support in lld. And as usual, many bug fixes, optimization and diagnostics improvements, etc."

An anonymous reader quotes a report from ZDNet: A hacker set off the tornado emergency sirens in the middle of the night last week across two North Texas towns. Following the unauthorized intrusion, city authorities had to shut down their emergency warning system a day before major storms and potential tornados were set to hit the area. The false alarm caused quite the panic in the two towns, as locals were already on the edge of their seats regarding incoming storms. The city had run tests of the tornado alarm sirens a week before, but the tests were set during the middle of the day and had long concluded. The two hacked systems were taken offline the next morning, and remained offline ever since.

Bad weather, including storms and potential tornadoes, was announced for all last week in the North Texas area. A severe thunderstorm hit the two cities the following night, on March 13. Thunderstorms are known to produce brief tornadoes, but luck had it that no tornado formed and hit the towns that day. Tornadoes are frequent in Texas, as the state is located in Tornado Alley, and tornado season, a period of the year between March and May when most tornadoes happen, had officially begun. Nevertheless, a tornado didn't form on March 13, and, luckily, the sirens weren't needed.

An anonymous reader quotes a report from Motherboard: Now, for Pi Day (March 14), music software programmer Canton Becker has crafted a million-hour song based on Pi that unfolds generatively on a virtual tape deck. Titled "Shepard's Pi," the song combines two of Becker's favorite infinities: Pi, and an auditory illusion called a Shepard tone, which he describes as an "unsettling sonic illusion of a pitch that climbs or descends forever, never reaching a top or a bottom." Found at PiSongs.com, users can tune into "Shepard's Pi" in real time with a custom virtual tape deck. The track itself evolves moment to moment, but the synthesized and sampled tones will be familiar to anyone who has ever listened to the electronic music of Kraftwerk, Tangerine Dream, Aphex Twin, and Global Communication. Far from being a mere gimmick, it is a highly evocative and transporting piece of electronic music, alternately ambient, glitchy, and interestingly rhythmic. The 58,999 GB MP3 file needed to be distributed via a webpage or app, so Becker "started hacking away at the basic algorithm in the programming languages PHP and Javascript," reports Motherboard. "In between coding marathons, Becker composed and recorded the loops and samples that would form the basis of the song. He experimented with sounds that would work well together regardless of being stacked one upon the other."

"When users hit 'play' on the virtual tape deck, the algorithm actually 'performs' the piece," the report says. "This way, the 114-year song can fit in just one gigabyte of space, which is mostly comprised of the digits of Pi. The virtual tape deck was also a solution to a built-in quirk of browsers such as Chrome, Safari, and Firefox -- users must click on a webpage to trigger a sound." From start to finish, the song lasts 999,999 hours, "a limitation imposed by only considering the first one billion digits of Pi."

Scientists have developed an "acoustic meta-material" that can catch certain frequencies passing through the air and reflect them back toward their source. When a loudspeaker was placed into one end of a PVC pipe with a 3D-printed ring of the metamaterial, the ring "cut 94% of the sound blasting from the speaker, enough to make it inaudible to the human ear," reports Fast Company. From the report: Typical acoustic paneling works differently, absorbing sound and turning the vibrations into heat. But what's particularly trippy is that this muffler is completely open. Air and light can travel through it -- just sound cannot. The implications for architecture and interior design are remarkable, because these metamaterials could be applied to the built environment in many different ways. For instance, they could be stacked to build soundproof yet transparent walls. Cubicles will never be the same.

The researchers also believe that HVAC systems could be fitted with these silencers, and drones could have their turbines muted with such rings. Even in MRI machines, which can be harrowingly loud for patients trapped in a small space, could be quieted. There's really no limit to the possibilities, but it does sound like these silencers will need to be tailored to circumstance. "The idea is that we can now mathematically design an object that can blocks the sounds of anything," says Boston University professor Xin Zhang, in a press release. You can see a demo of the noise cancellation device here.

Last month, the U.S. Army asked private companies for ideas about how to improve its planned semi-autonomous, AI-driven targeting system for tanks. "In its request, the Army asked for help enabling the Advanced Targeting and Lethality Automated System (ATLAS) to 'acquire, identify, and engage targets at least 3X faster than the current manual process,'" reports Gizmodo. "But that language apparently scared some people who are worried about the rise of AI-powered killing machines. And with good reason." Slashdot reader darth_borehd summarizes the U.S. Army's response: Robot (or more accurately, drone) tanks will always have a human "in the loop" just like the drone plane program, according to the U.S. Army. The new robot tanks, officially called the Multi Utility Tactical Transport (MUTT), will use the Advanced Targeting and Lethality Automated System (ATLAS). The Department of Defense assures everyone that they will adhere to "ethical standards." Here's the language the Defense Department used: "All development and use of autonomous and semi-autonomous functions in weapon systems, including manned and unmanned platforms, remain subject to the guidelines in the Department of Defense (DoD) Directive 3000.09, which was updated in 2017. Nothing in this notice should be understood to represent a change in DoD policy towards autonomy in weapon systems. All uses of machine learning and artificial intelligence in this program will be evaluated to ensure that they are consistent with DoD legal and ethical standards."

Directive 3000.09 requires that humans be able to "exercise appropriate levels of human judgement over the use of force," which is sometimes called being "in the loop," as mentioned by above.

Linux 5.1 continues the massive undertaking in preparing the kernel for the Year 2038 problem. Phoronix: The Linux kernel has been seeing "Y2038" work for years and the effort is far from over. Thomas Gleixner (a Linux kernel developer who serves as a member of the technical advisory board at The Linux Foundation) sent in the latest Y2038 work for the Linux 5.1 kernel, which after a lot of ground work in previous kernels has introduced the first set of syscalls that are Year 2038 safe.

An anonymous reader writes: Linus Torvalds has released Linux 5.0 in kicking off the kernel's 28th year of development. Linux 5.0 features include AMD FreeSync support, open-source NVIDIA Turing GPU support, Intel Icelake graphics, Intel VT-d scalable mode, NXP PowerPC processors are now mitigated for Spectre Variant Two, and countless other additions. eWeek adds: Among the new features that have landed in Linux 5.0 is support for the Adiantum encryption system, developed by Google for low power devices. Google's Android mobile operating system and ChromeOS desktop operating system both rely on the Linux kernel. "Storage encryption protects your data if your phone falls into someone else's hands," Paul Crowley and Eric Biggers, Android Security and Privacy Team at Google wrote in a blog post. "Adiantum is an innovation in cryptography designed to make storage encryption more efficient for devices without cryptographic acceleration, to ensure that all devices can be encrypted. Memory management in Linux also gets a boost in the 5.0 kernel with a series of improvements designed to help prevent memory fragmentation, which can reduce performance.

We've all heard the studies. AmiMoJo quotes the health and science editor of Slashgear: A new study has found that listening to music may have a negative impact on creativity. This is contrary to the popular idea that music and creativity often go hand in hand. According to the researchers, the negative impact was found even in cases where the music had a positive impact on mood and was liked by the person listening to it. However, background noise didn't have the same effect...

Unlike music, the noise in a library provided a "steady state" environment, which had less of a disruptive effect on participants. Though studying with background music may not completely obliterate someone's ability to think creatively, the research indicates that you may do your best work without it.
But what do Slashdot's readers think? Do you listen to music when you're working -- or do you prefer the steady sounds of silence? Share your own experiences in the comments.

Does listening to music have a negative impact on creativity?

An anonymous reader quotes the San Francisco Chronicle: Tristan O'Tierney, a co-founder of San Francisco payments company Square, died Feb. 23 in Ocala, Fla., of causes related to addiction, his family said. He was 35...

His family is awaiting an official cause of death from officials. "I do know that it was in relation to his addiction," [his mother] Pamela Tierney said. "I know he got to the hospital, he couldn't breathe and they couldn't revive him." O'Tierney was in a three-month rehabilitation program in Ocala and had been battling addiction for three years, Tierney said. O'Tierney openly discussed his struggles with addiction on social media. "As some of you may know, I've been battling with addiction for these past few years," he wrote in September in a now-deleted Instagram post that he also shared on Twitter. "With some success. A lot of failure too though."
Bloomberg remembers him as a former engineer at Yahoo and Apple who was hired to develop Square's original mobile payment app in 2009, then stayed on until 2013.

"In addition to his parents, O'Tierney is survived by his three-old-year daughter, according to an obituary on the website for the funeral home."

fstack writes: Intel is still a year out from releasing their first discrete graphics processors, but the company has begun publishing their open-source Linux GPU driver code. This week they began by publishing patches on top of their existing Intel Linux driver for supporting device local memory for dedicated video memory as part of their restructuring effort to support discrete graphics cards. Intel later confirmed this is the start of their open-source driver support for discrete graphics solutions. They have also begun working on Linux driver support for Adaptive-Sync and better reset recovery.

An anonymous reader quotes a report from Gamasutra: In the wake of Activision Blizzard's massive layoff wave, a move that was announced in the same call as the company's record quarter, the union federation AFL-CIO has published an open letter to game developers urging members of the industry to organize. The AFL-CIO itself is the largest labor organization in the United States and counts 55 individual unions (and more than 12.5 million workers) among its affiliates. The letter, readable in full on Kotaku, calls out many of the issues that have prompted conversations about unionization in just recent years like excessive crunch, toxic work conditions, inadequate pay, and job instability. The industry, points out AFL-CIO's secretary-treasurer Liz Shuler, boasted sales 3.6 times greater than those of the film industry in 2018, yet much of that financial success isn't felt by the developers working on the games that generate those billions. "Executives are always quick to brag about your work. It's the talk of every industry corner office and boardroom. They pay tribute to the games that capture our imaginations and seem to defy economic gravity. They talk up the latest innovations in virtual reality and celebrate record-smashing releases, as your creations reach unparalleled new heights," says Shuler.

"My question is this: what have you gotten in return? They get rich. They get notoriety. They get to be crowned visionaries and regarded as pioneers. What do you get? Outrageous hours and inadequate paychecks. Stressful, toxic work conditions that push you to your physical and mental limits. The fear that asking for better means risking your dream job. [...] Change will happen when you gain leverage by joining together in a strong union. And, it will happen when you use your collective voice to bargain for a fair share of the wealth you create every day. No matter where you work, bosses will only offer fair treatment when you stand together and demand it."

jrepin writes: Today, KDE launched Plasma 5.15, the first stable release of the popular desktop environment in 2019. For this release the Plasma team has focused on hunting down and removing all the paper cuts that slow you down. Plasma 5.15 brings a number of changes to the configuration interfaces, including more options for complex network configurations. Many icons have been added or redesigned to make them clearer. Integration with third-party technologies like GTK and Firefox has been improved substantially. Discover, Plasma's software and add-on installer, has received tons of improvements to help you stay up-to-date and find the tools you need to get your tasks done. For a more detailed list of features/changes, you can browse the full Plasma 5.15 changelog.

theodp writes: Commenting on reports that Amazon is reconsidering its plan to bring 25,000 jobs to a new campus in New York City following a wave of political and community opposition, Amazon issued the following statement: "We're focused on engaging with our new neighbors -- small business owners, educators, and community leaders. Whether it's building a pipeline of local jobs through workforce training or funding computer science classes for thousands of New York City students, we are working hard to demonstrate what kind of neighbor we will be." Yep, it'd be a shame if something happened. The Washington Post earlier reported that New York State Sen. Michael Gianaris, a strong opponent of the Amazon HQ2 deal, described the possibility that Amazon would pull out of the deal -- which totals up to $3 billion in state and city incentives -- as akin to blackmail. "Amazon has extorted New York from the start, and this seems to be their next effort to do just that," he said. "If their view is, 'We won't come unless we get three billion of your dollars,' then they shouldn't come." Over at Vice, Ankita Rao examines what Amazon infiltrating America's school system might look like.

McGruber shares a report from The San Francisco Chronicle: The Department of Homeland Security announced a rule change Wednesday that will transform the lottery that decides who gets the 85,000 H-1B visas granted to for-profit companies every year. Previously, an initial lottery granted 20,000 visas only to those holding advanced degrees granted by U.S. institutions -- master's degrees or doctorates -- and then a general lottery granted 65,000 visas to all qualified applicants. The Department of Homeland Security switched the order of these lotteries, it said in a notice of the final rule change, which will bolster the odds for highly educated foreign nationals. The change reduces the likelihood that people with just a bachelor's degree will win in the general lottery, said Lisa Spiegel, an attorney at Duane Morris in San Francisco and head of the firm's immigration group. The program shift could hurt technology staffing companies, also known as outsourcers, who have a reputation for flooding the lottery with applications. Three Indian firms -- Tata Consultancy Services, Infosys and Wipro -- often account for a majority of the H-1B applications, an analysis of government data shows.

Columbia Engineering researchers have made a major advance in robotics by creating a robot that learns what it is, from scratch, with zero prior knowledge of physics, geometry, or motor dynamics. Initially the robot does not know if it is a spider, a snake, an arm -- it has no clue what its shape is. After a brief period of "babbling," and within about a day of intensive computing, their robot creates a self-simulation. The robot can then use that self-simulator internally to contemplate and adapt to different situations, handling new tasks as well as detecting and repairing damage in its own body. From a report: The work is published today in Science Robotics. To date, robots have operated by having a human explicitly model the robot. "But if we want robots to become independent, to adapt quickly to scenarios unforeseen by their creators, then it's essential that they learn to simulate themselves," says Hod Lipson, professor of mechanical engineering, and director of the Creative Machines lab, where the research was done.

For the study, Lipson and his PhD student Robert Kwiatkowski used a four-degree-of-freedom articulated robotic arm. Initially, the robot moved randomly and collected approximately one thousand trajectories, each comprising one hundred points. The robot then used deep learning, a modern machine learning technique, to create a self-model. The first self-models were quite inaccurate, and the robot did not know what it was, or how its joints were connected. But after less than 35 hours of training, the self-model became consistent with the physical robot to within about four centimeters. The self-model performed a pick-and-place task in a closed loop system that enabled the robot to recalibrate its original position between each step along the trajectory based entirely on the internal self-model. With the closed loop control, the robot was able to grasp objects at specific locations on the ground and deposit them into a receptacle with 100 percent success.

An anonymous reader quotes the Washington Post: Bill Gates thinks he has a key part of the answer for combating climate change: a return to nuclear power... Gates, who founded TerraPower in 2006, is telling lawmakers that he personally would invest $1 billion and raise $1 billion more in private capital to go along with federal funds for a pilot of his company's never-before-used technology, according to congressional staffers. "Nuclear is ideal for dealing with climate change, because it is the only carbon-free, scalable energy source that's available 24 hours a day," Gates said in his year-end public letter. "The problems with today's reactors, such as the risk of accidents, can be solved through innovation."

Gates's latest push comes at an important turn in climate politics. Nuclear power has united both unpopular industry executives and a growing number of people -- including some prominent Democrats -- alarmed about climate change. But many nuclear experts say that Gates's company is pursuing a flawed technology and that any new nuclear design is likely to come at a prohibitive economic cost and take decades to perfect, market and construct in any significant numbers... Edwin Lyman, a nuclear expert at the Union of Concerned Scientists, said TerraPower is one of many companies that is raising the public's hopes for advanced nuclear reactor designs even though they're still on the drawing boards and will remain unable to combat climate change for many years.
Jonah Goldman, of Gates Ventures, stressed to The Post that Gates was not advocating for TerraPower alone, according to GeekWire.

"Gates thinks the U.S. has 'the best minds, the best lab systems and entrepreneurs willing to take risk,' Goldman told the newspaper. 'But what we don't have is a commitment on Congress' part.'"

"Time and again, security experts and vendors alike will recommend to organizations and end users to keep software and systems updated with the latest patches," reports eWeek. "But what happens when the application infrastructure that is supposed to deliver those patches itself is at risk?" That's what open-source and Linux users were faced with this past week with a pair of projects reporting vulnerabilities. On January 22, the Debian Linux distribution reported a vulnerability in its APT package manager that is used by end users and organizations to get application updates. That disclosure was followed a day later, on January 23, with the PHP PEAR (PHP Extension and Application Repository) shutting down its primary website, warning that it was the victim of a data breach. PHP PEAR is a package manager that is included with many Linux distributions as part of the open-source PHP programming language binaries....

In the Debian APT case, a security researcher found a flaw, reported it, and the open-source project community responded rapidly, fixing the issue. With PHP PEAR issue, researchers with the Paranoids FIRE (Forensics, Incident Response and Engineering) Team reported that they discovered a tainted file on the primary PEAR website... Both PHP PEAR and Debian have issued updates fixing their respective issues. While both projects are undoubtably redoubling their efforts now with different security technologies and techniques, the simple fact is that the two issues highlight a risk with users trusting updating tools and package management systems.

Aside from some out-of-tree experiments last year by one of Valve's developers on a RADV Vulkan HUD of similar nature to the popular Gallium HUD option, it turns out an Intel developer has recently been working on a Vulkan overlay layer to provide "Gallium HUD" inspired information. From a report: Lionel Landwerlin is the open-source Intel developer that has begun working on this Intel Vulkan driver "heads-up display" implemented as a Vulkan overlay layer. The code is intended to provide Vulkan swapchain information and various statistics of use to Vulkan driver developers and game developers. The code is under a merge request for Mesa but is considered experimental at this point. Particularly for multi-threaded Vulkan programs it may end up crashing in its current form.