×
Television

TV Networks Want To Yank Nielsen Accreditation (variety.com) 43

The nation's big TV companies are calling for a new yardstick. From a report: A trade organization representing Disney, ViacomCBS, NBCUniversal, Fox Corp. and other media giants is calling for the organization that signs off on Nielsen's methodology for measuring TV viewership to yank accreditation, an aggressive maneuver in an era when media outlets and the advertisers who support them are scrambling to figure out how to count viewer eyeballs across an increasingly unwieldy array of new entertainment venues, digital behaviors and screens. The trade group, the VAB, on Wednesday sent a ten-page letter to the Media Rating Council urging the group to pull its backing of Nielsen's ratings, citing Nielsen's diminished ability to count viewership during the coronavirus pandemic. "Nielsen's COVID-period conduct as a ratings service violated at least five minimum standards," the VAB said in its letter, "with the damage done to their largest subscriber clients still creating material negative impact into July 2021."
Privacy

Pegasus Spyware Seller: Blame Our Customers Not Us For Hacking (bbc.com) 104

The maker of powerful spy software allegedly used to hack the phones of innocent people says blaming the company is like "criticising a car manufacturer when a drunk driver crashes." From a report: NSO Group is facing international criticism, after reporters obtained a list of alleged potential targets for spyware, including activists, politicians and journalists. Investigations have begun as the list, of 50,000 phone numbers, contained a small number of hacked phones. Pegasus infects iPhones and Android devices, allowing operators to extract messages, photos and emails, record calls and secretly activate microphones and cameras. NSO Group has said the software is intended for use against criminals and terrorists and made available to only military, law enforcement and intelligence agencies from countries with good human-rights records. But a consortium of news organisations, led by French media outlet Forbidden Stories, has published dozens of stories based around the list, including allegations French President Emmanuel Macron's number was on it and may have been targeted.
Crime

Serial Swatter Who Caused Death Gets Five Years In Prison (krebsonsecurity.com) 186

A 18-year-old Tennessee man who helped set in motion a fraudulent distress call to police that lead to the death of a 60-year-old grandfather in 2020 was sentenced to 60 months in prison today. Krebs on Security reports: Shane Sonderman, of Lauderdale County, Tenn. admitted to conspiring with a group of criminals that's been "swatting" and harassing people for months in a bid to coerce targets into giving up their valuable Twitter and Instagram usernames. At Sonderman's sentencing hearing today, prosecutors told the court the defendant and his co-conspirators would text and call targets and their families, posting their personal information online and sending them pizzas and other deliveries of food as a harassment technique.

Other victims of the group told prosecutors their tormentors further harassed them by making false reports of child abuse to social services local to the target's area, and false reports in the target's name to local suicide prevention hotlines. Eventually, when subjects of their harassment refused to sell or give up their Twitter and Instagram usernames, Sonderman and others would swat their targets -- or make a false report to authorities in the target's name with the intention of sending a heavily armed police response to that person's address. [...]

Sonderman might have been eligible to knock a few months off his sentence had he cooperated with investigators and refrained from committing further crimes while out on bond. But prosecutors said that shortly after his release, Sonderman went right back to doing what he was doing when he got caught. Investigators who subpoenaed his online communications found he'd logged into the Instagram account "FreeTheSoldiers," which was known to have been used by the group to harass people for their social media handles. Sonderman was promptly re-arrested for violating the terms of his release, and prosecutors played for the court today a recording of a phone call Sonderman made from jail in which he brags to a female acquaintance that he wiped his mobile phone two days before investigators served another search warrant on his home.
"Although it may seem inadequate, the law is the law," said Judge Norris after giving Sonderman the maximum sentence allowed by law under the statute. "The harm it caused, the death and destruction... it's almost unspeakable. This is not like cases we frequently have that involve guns and carjacking and drugs. This is a whole different level of insidious criminal behavior here."
Crime

UK Man Arrested in Spain for Role in Twitter 2020 Hack (therecord.media) 6

A 22-year-old UK national was arrested today in Spain for his role in hacking Twitter's internal network and hijacking high-profile accounts in July last year. From a report: Joseph O'Connor, 22, was arrested today in the city of Estepona, in southern Spain, by Spanish National Police pursuant to a US arrest warrant. O'Connor marks the fourth man linked to the Twitter 2020 hack, after three men were charged and detained on July 31, last year. O'Conner, who went online as "j0e," worked with the other three to gain access to one of Twitter's internal Slack channels. The group found credentials in the Slack workplaces that allowed them to gain access to Twitter's moderation panel.
China

China Unveils 'Fastest Ground Vehicle In the World' (usatoday.com) 146

China has unveiled its new maglev train that's being touted as the fastest ground vehicle in the world with a maximum speed of 372 mph (600 kph). USA Today reports: The train uses electro-magnetic force, making it "float" so there is no contact between the rail and the body, Reuters reported. The debut of the super fast train could cut down time for people traveling from Beijing to Shanghai to only 2.5 hours. That's a distance of 754 miles and currently a 4.5-hour train ride on one of China's bullet trains. China's newest train is expected to be ready for commercial use within the next decade.
Open Source

Stockfish Sues ChessBase (stockfishchess.org) 21

Slashdot reader Hmmmmmm shares a blog post from Stockfish announcing a lawsuit against ChessBase: The Stockfish project strongly believes in free and open-source software and data. Collaboration is what made this engine the strongest chess engine in the world. We license our software using the GNU General Public License, Version 3 (GPL) with the intent to guarantee all chess enthusiasts the freedom to use, share and change all versions of the program. Unfortunately, not everybody shares this vision of openness. We have come to realize that ChessBase concealed from their customers Stockfish as the true origin of key parts of their products (see also earlier blog posts by us and the joint Lichess, Leela Chess Zero, and Stockfish teams). Indeed, few customers know they obtained a modified version of Stockfish when they paid for Fat Fritz 2 or Houdini 6 -- both Stockfish derivatives -- and they thus have good reason to be upset. [ChessBase released Fat Fritz 2, described on their website as the "new number 1" chess engine "with a massive new neural network, trained by Albert Silver with the original Fat Fritz." They advertise Fat Fritz 2 as using novel strong ideas compared to existing chess engines, but in reality Fat Fritz 2 is just Stockfish with a different neural network and minimal changes that are neither innovative nor appear to make the engine stronger.] ChessBase repeatedly violated central obligations of the GPL, which ensures that the user of the software is informed of their rights. These rights are explicit in the license and include access to the corresponding sources, and the right to reproduce, modify and distribute GPLed programs royalty-free.

In the past four months, we, supported by a certified copyright and media law attorney in Germany, went through a long process to enforce our license. Even though we had our first successes, leading to a recall of the Fat Fritz 2 DVD and the termination of the sales of Houdini 6, we were unable to finalize our dispute out of court. Due to Chessbase's repeated license violations, leading developers of Stockfish have terminated their GPL license with ChessBase permanently. However, ChessBase is ignoring the fact that they no longer have the right to distribute Stockfish, modified or unmodified, as part of their products. Thus, to enforce the consequences of the license termination, we have filed a lawsuit. This lawsuit is broadly supported by the team of maintainers and developers of Stockfish. We believe we have the evidence, the financial means and the determination to bring this lawsuit to a successful end. We will provide an update to this statement once significant progress has been made.

The Almighty Buck

Together Price Helps Strangers Share Subscription Passwords (fastcompany.com) 83

An anonymous reader shares a report: Earlier this week, I bought a month of Starz for a fraction of its typical asking price. Instead of paying $9 per month, I paid $3.24. Then I added a subscription to Spotify for $3.49, and a Disney Plus subscription for just $3. All told, my bill comes to about $10 per month for $28 worth of services. Those cut-rate subscriptions come courtesy of Together Price, a service that lets people rent out access to a share of their digital subscriptions. In exchange for a cut of each transaction, Together Price essentially serves as a marketplace for organized password sharing. The service, which started five years ago in Europe and has 80,000 paying customers, just launched in the U.S. last week.

While Together Price isn't the first service to make password sharing easier, it's definitely the most brazen. Still, CEO Marco Taddei insists that the service is legal and that it technically honors each subscription's terms of use. He also believes the service is helping companies retain users that they'd otherwise lose. "We are targeting the very specific audience that needs to share," he says. "If [subscription providers] are not going to allow them do so so, they are going to drop the subscriptions." After signing up for Together Price, you can browse a "network" of users offering to share their subscriptions. Most major streaming video and music services are available, including Netflix, Spotify, Disney Plus, HBO Max, and Hulu, but sharing isn't limited to media. Some users are also peddling subscriptions to software tools such as Canva Pro and Surfshark VPN, and the site lets you set up custom subscriptions for pretty much anything by listing the service name, price, and sharing rules. For each service, you send a request to the subscription owner and submit credit card information to Together Price. Once the owner accepts the request, Together Price processes the payment, and you're allowed into a group where you can view login details and chat with the other members.

Privacy

Edward Snowden Calls For Spyware Trade Ban Amid Pegasus Revelations (theguardian.com) 75

Governments must impose a global moratorium on the international spyware trade or face a world in which no mobile phone is safe from state-sponsored hackers, Edward Snowden has warned in the wake of revelations about the clients of NSO Group. The Guardian reports: Snowden, who in 2013 blew the whistle on the secret mass surveillance programs of the US National Security Agency, described for-profit malware developers as "an industry that should not exist." He made the comments in an interview with the Guardian after the first revelations from the Pegasus project, a journalistic investigation by a consortium of international media organizations into the NSO Group and its clients. [...] Snowden said the consortium's findings illustrated how commercial malware had made it possible for repressive regimes to place vastly more people under the most invasive types of surveillance. For traditional police operations to plant bugs or wiretap a suspect's phone, law enforcement would need to "break into somebody's house, or go to their car, or go to their office, and we'd like to think they'll probably get a warrant," he said. But commercial spyware made it cost-efficient for targeted surveillance against vastly more people. "If they can do the same thing from a distance, with little cost and no risk, they begin to do it all the time, against everyone who's even marginally of interest," he said. "If you don't do anything to stop the sale of this technology, it's not just going to be 50,000 targets. It's going to be 50 million targets, and it's going to happen much more quickly than any of us expect."

Part of the problem arose from the fact that different people's mobile phones were functionally identical to one another, he said. "When we're talking about something like an iPhone, they're all running the same software around the world. So if they find a way to hack one iPhone, they've found a way to hack all of them." He compared companies commercializing vulnerabilities in widely used mobile phone models to an industry of "infectioneers" deliberately trying to develop new strains of disease. "It's like an industry where the only thing they did was create custom variants of Covid to dodge vaccines," he said. "Their only products are infection vectors. They're not security products. They're not providing any kind of protection, any kind of prophylactic. They don't make vaccines -- the only thing they sell is the virus."

Snowden said commercial malware such as Pegasus was so powerful that ordinary people could in effect do nothing to stop it. Asked how people could protect themselves, he said: "What can people do to protect themselves from nuclear weapons? "There are certain industries, certain sectors, from which there is no protection, and that's why we try to limit the proliferation of these technologies. We don't allow a commercial market in nuclear weapons." He said the only viable solution to the threat of commercial malware was an international moratorium on its sale. "What the Pegasus project reveals is the NSO Group is really representative of a new malware market, where this is a for-profit business," he said. "The only reason NSO is doing this is not to save the world, it's to make money." He said a global ban on the trade in infection vectors would prevent commercial abuse of vulnerabilities in mobile phones, while still allowing researchers to identify and fix them. "The solution here for ordinary people is to work collectively. This is not a problem that we want to try and solve individually, because it's you versus a billion dollar company," he said. "If you want to protect yourself you have to change the game, and the way we do that is by ending this trade."

Bitcoin

Viral Video Shows Malaysian Police Destroying 1,069 Bitcoin Mining Rigs With a Steamroller (cnbc.com) 88

Malaysian authorities seized 1,069 bitcoin mining rigs, laid them out in a parking lot at police headquarters, and used a steamroller to crush them, as part of a joint operation between law enforcement in the city of Miri and electric utility Sarawak Energy. CNBC reports: Assistant Commissioner of Police Hakemal Hawari told CNBC the crackdown came after miners allegedly stole $2 million worth of electricity siphoned from Sarawak Energy power lines. A video of the event posted last week by local Sarawak news outlet Dayak Daily has since gone viral on social media.

Acting on a tip, authorities on the island of Borneo confiscated the rigs in six separate raids between February and April. In total, police destroyed about $1.26 million of mining equipment. Police opted to crush the mining gear rather than sell it, in accordance with a court order. Other countries, like China, have taken a different route, reportedly auctioning off seized rigs. Hawari said that electricity theft by bitcoin miners led to three houses burning down in the city. The Miri police chief told CNBC that there are no other active mining operations underway currently.
The report notes that crypto mining is not illegal in Malaysia, although "there are stringent laws around power use."

"The Cambridge Center for Alternative Finance estimates that Malaysia accounts for 3.44% of all the world's bitcoin miners, placing it in the top ten mining destinations on the planet."
Facebook

'Facebook Isn't Killing People' -- Biden Walks Back Attack Over Vaccine Lies (cnbc.com) 241

President Joe Biden walked back some of his criticism of Facebook, saying Monday he meant to accuse a dozen users, but not the social media platform itself, of spreading deadly lies about Covid vaccines. From a report: "Facebook isn't killing people," Biden said. Biden added that he hopes Facebook will do more to fight "the outrageous misinformation" about coronavirus vaccines being spread on its platform "instead of taking it personally that somehow I'm saying Facebook is killing people." Last week, Biden appeared to say just that: Asked outside the White House what his message was to platforms like Facebook regarding Covid disinformation, Biden said, "They're killing people. I mean they really, look, the only pandemic we have is among the unvaccinated, and that's -- they're killing people," Biden said Friday.
China

White House Formally Blames China's Ministry of State Security for Microsoft Exchange Hack (therecord.media) 38

The U.S. and a coalition of allies on Monday formally attributed the sweeping campaign against Microsoft Exchange email servers to hackers affiliated with China's Ministry of State Security. From a report: The group assessed with "high confidence" that Beijing-linked digital operators carried out the attack that ensnared hundreds of thousands of systems worldwide, a senior Biden administration official told reporters on Sunday. In addition, the partners alleged the ministry -- which oversees the civilian arm of Beijing's intelligence gathering operations -- has utilized contract hackers to conduct other malicious cyber activities around the globe, including a ransomware attack on an American company, and other pursuits to line the pockets of MSS officials.

The use of such hired muscle "was really eye-opening and surprising for us," said the official, who was only authorized to speak anonymously. The coalition includes the U.S., the so-called "Five Eye" nations, Japan, the European Union and NATO. Monday's announcement marks the first time the transatlantic alliance has condemned Chinese digital activities, the official said. The massive Exchange hack was first disclosed in March -- at the same time the Biden administration was dealing with the SolarWinds breach that has since been formally attributed to Russia's foreign intelligence service.

IT

Amazon Shuts Down NSO Group Infrastructure (vice.com) 37

Amazon Web Services (AWS) has shut down infrastructure and accounts linked to Israeli surveillance vendor NSO Group, Amazon said in a statement. From a report: The move comes as a group of media outlets and activist organizations published new research into NSO's malware and phone numbers potentially selected for targeting by NSO's government clients. "When we learned of this activity, we acted quickly to shut down the relevant infrastructure and accounts," an AWS spokesperson told Motherboard in an email.
Iphone

Despite the Hype, iPhone Security No Match For NSO Spyware (washingtonpost.com) 116

International investigation finds 23 Apple devices that were successfully hacked. From a report: The text delivered last month to the iPhone 11 of Claude Mangin, the French wife of a political activist jailed in Morocco, made no sound. It produced no image. It offered no warning of any kind as an iMessage from somebody she didn't know delivered malware directly onto her phone -- and past Apple's security systems. Once inside, the spyware, produced by Israel's NSO Group and licensed to one of its government clients, went to work, according to a forensic examination of her device by Amnesty International's Security Lab. It found that between October and June, her phone was hacked multiple times with Pegasus, NSO's signature surveillance tool, during a time when she was in France. The examination was unable to reveal what was collected. But the potential was vast: Pegasus can collect emails, call records, social media posts, user passwords, contact lists, pictures, videos, sound recordings and browsing histories, according to security researchers and NSO marketing materials.

The spyware can activate cameras or microphones to capture fresh images and recordings. It can listen to calls and voice mails. It can collect location logs of where a user has been and also determine where that user is now, along with data indicating whether the person is stationary or, if moving, in which direction. And all of this can happen without a user even touching her phone or knowing she has received a mysterious message from an unfamiliar person -- in Mangin's case, a Gmail user going by the name "linakeller2203." These kinds of "zero-click" attacks, as they are called within the surveillance industry, can work on even the newest generations of iPhones, after years of effort in which Apple attempted to close the door against unauthorized surveillance -- and built marketing campaigns on assertions that it offers better privacy and security than rivals.

[...] Researchers have documented iPhone infections with Pegasus dozens of times in recent years, challenging Apple's reputation for superior security when compared with its leading rivals, which run Android operating systems by Google. The months-long investigation by The Post and its partners found more evidence to fuel that debate. Amnesty's Security Lab examined 67 smartphones whose numbers were on the Forbidden Stories list and found forensic evidence of Pegasus infections or attempts at infections in 37. Of those, 34 were iPhones -- 23 that showed signs of a successful Pegasus infection and 11 that showed signs of attempted infection.

The Almighty Buck

Both Dogecoin Creators are Now Criticizing Cryptocurrencies (twitter.com) 169

This week Dogecoin co-creator Jackson Palmer addressed the question of whether he'd return to cryptocurrency.

"My answer is a wholehearted 'no'," he confirmed, before launching into a scathing Tweet storm. "To avoid repeating myself I figure it might be worthwhile briefly explaining why hereâ¦" "After years of studying it, I believe that cryptocurrency is an inherently right-wing, hyper-capitalistic technology built primarily to amplify the wealth of its proponents through a combination of tax avoidance, diminished regulatory oversight and artificially enforced scarcity. Despite claims of 'decentralization', the cryptocurrency industry is controlled by a powerful cartel of wealthy figures who, with time, have evolved to incorporate many of the same institutions tied to the existing centralized financial system they supposedly set out to replace.

"The cryptocurrency industry leverages a network of shady business connections, bought influencers and pay-for-play media outlets to perpetuate a cult-like 'get rich quick' funnel designed to extract new money from the financially desperate and naive. Financial exploitation undoubtedly existed before cryptocurrency, but cryptocurrency is almost purpose built to make the funnel of profiteering more efficient for those at the top and less safeguarded for the vulnerable. Cryptocurrency is like taking the worst parts of today's capitalist system (eg. corruption, fraud, inequality) and using software to technically limit the use of interventions (eg. audits, regulation, taxation) which serve as protections or safety nets for the average person...

"I applaud those with the energy to continue asking the hard questions and applying the lens of rigorous skepticism all technology should be subject to. New technology can make the world a better place, but not when decoupled from its inherent politics or societal consequences."

Insider points out this wasn't Palmer's first time speaking out against crypto. "When Dogecoin soared to $2 billion in 2018, he wrote an op-ed on Vice, saying 'something is very wrong.'" Palmer and his co-founder, Billy Markus, created Dogecoin in 2013 as a "joke" currency as alternative cryptocurrencies flooded the market, promising to be the next big thing... It is now valued at $25.8 billion, as of time of writing.

Palmer and Markus are no longer part of Dogecoin. Both left in 2015 after deciding that the cryptocurrency was not aligned with their values. Palmer's co-creator, Markus, retweeted Palmer's Twitter thread and responded with a GIF.

In a later tweet, Markus added that "I think his points are generally valid aside from the pointless American politics piece."
Cellphones

Investigation Reveals Widespread Cellphone Surveillance of the Innocent (theguardian.com) 184

Cellphones "can be transformed into surveillance devices," writes the Guardian, reporting startling new details about which innocent people are still being surveilled (as part of a collaborative reporting project with 16 other media outlets led by the French nonprofit Forbidden Stories).

Long-time Slashdot reader shanen shared the newspaper's critique of a "privatised government surveillance industry" that's made NSO a billion-dollar company, thanks to its phone-penetrating spy software Pegaus: [NSO] insists only carefully vetted government intelligence and law enforcement agencies can use Pegasus, and only to penetrate the phones of "legitimate criminal or terror group targets". Yet in the coming days the Guardian will be revealing the identities of many innocent people who have been identified as candidates for possible surveillance by NSO clients in a massive leak of data... The presence of their names on this list indicates the lengths to which governments may go to spy on critics, rivals and opponents.

First we reveal how journalists across the world were selected as potential targets by these clients prior to a possible hack using NSO surveillance tools. Over the coming week we will be revealing the identities of more people whose phone numbers appear in the leak. They include lawyers, human rights defenders, religious figures, academics, businesspeople, diplomats, senior government officials and heads of state. Our reporting is rooted in the public interest. We believe the public should know that NSO's technology is being abused by the governments who license and operate its spyware.

But we also believe it is in the public interest to reveal how governments look to spy on their citizens and how seemingly benign processes such as HLR lookups [which track the general locations of cellphone users] can be exploited in this environment.

It is not possible to know without forensic analysis whether the phone of someone whose number appears in the data was actually targeted by a government or whether it was successfully hacked with NSO's spyware. But when our technical partner, Amnesty International's Security Lab, conducted forensic analysis on dozens of iPhones that belonged to potential targets at the time they were selected, they found evidence of Pegasus activity in more than half.

The investigators say that potential targets included nearly 200 journalists around the world, including numerous reporters from CNN, the Associated Press, Voice of America, the New York Times, the Wall Street Journal, Bloomberg News, Le Monde in France, and even the editor of the Financial Times.

In addition, the investigators say they found evidence the Pegasus software had been installed on the phone of the fiancée of murdered Saudi journalist Jamal Khashoggi. NSO denies this to the Washington Post. But they also insist that they're simply licensing their software to clients, and their company "has no insight" into those clients' specific intelligence activities.

The Washington Post reports that Amnesty's Security Lab found evidence of Pegasus attacks on 37 of 67 smartphones from the list which they tested. But beyond that "for the remaining 30, the tests were inconclusive, in several cases because the phones had been replaced. Fifteen of the phones were Android devices, none of which showed evidence of successful infection. However, unlike iPhones, Androids do not log the kinds of information required for Amnesty's detective work."

Familiar privacy measures like strong passwords and encryption offer little help against Pegasus, which can attack phones without any warning to users. It can read anything on a device that a user can, while also stealing photos, recordings, location records, communications, passwords, call logs and social media posts. Spyware also can activate cameras and microphones for real-time surveillance.
Music

Music Streaming Inquiry Finds 'Pitiful Returns' For Performers (bbc.com) 108

A committee in the U.K. Parliament says the music industry is weighted against artists, with even successful pop stars seeing "pitiful returns," reports the BBC: They are calling for a "complete reset" of the market, with musicians given a "fair share" of the £736.5 million that UK record labels earn from streaming. In a report, they said royalties should be split 50/50, instead of the current rate, where artists receive about 16%.

The findings came after a six-month inquiry into music streaming. "While streaming has brought significant profits to the recorded music industry, the talent behind it — performers, songwriters and composers — are losing out," said Julian Knight, MP, who chairs parliament's Digital, Culture, Media and Sport committee. "Only a complete reset of streaming that enshrines in law their rights to a fair share of the earnings will do...."

A survey by the Ivors Academy and Musicians' Union found that in 2019, 82% of professional musicians made less than £200 from streaming, whilst only 7% made more than £1,000...

The committee's report said streaming had "undoubtedly helped save the music industry" after decades of piracy, "but it is clear that what has been saved does not work for everyone".

A chart accompanying the article shows that meanwhile streaming services keep 30% of the revenue, while labels end up with 55%.

"Artists who release their own music, or who work with independent labels and distribution companies, tend to get a higher share."
China

Will a New Law Help the Chinese Government Stockpile Zero-Days? (securityweek.com) 27

"Starting September 1, 2021, the Chinese government will require that any Chinese citizen who finds a zero-day vulnerability must pass the details to the Chinese government," reports SecurityWeek, "and must not sell or give the knowledge to any third-party outside of China (apart from the vulnerable product's manufacturer)." Brief details are provided in a report by the Associated Press (AP) published Tuesday, July 13, 2021. No source is provided beyond the statement, "No one may 'collect, sell or publish information on network product security vulnerabilities,' say the rules issued by the Cyberspace Administration of China and the police and industry ministries...."

AP describes this action as "further tightening the Communist Party's control over information". This is unlikely to be the primary motivation for the new rule since the government already has a vice-like grip on data. Companies may not store data on Chinese customers outside of China. Foreign companies selling routers and some other network devices in China must disclose to regulators how any encryption features work.

"I would expect the Chinese Government to weaponize any discovered security vulnerabilities to enhance China's cybersecurity capabilities," Joseph Carson, chief security scientist and advisory CISO at ThycoticCentrify, tells SecurityWeek. And Jake Williams, co-founder and CTO at BreachQuest adds that "the defensive advantages of Chinese government organizations being able to mitigate vulnerabilities discovered may well outweigh any offensive gains...."

But he also believes this could rebound against China. "One of the biggest likely issues is brain drain. If Chinese researchers can profit handsomely from their work anywhere else, but can't do so in China, why would they stay? This probably helps China in the short term but harms them in the long term."

The new law does encourage network operators and product vendors to set up a reward mechanism for reported vulnerabilities, according to the Record. But Katie Moussouris, founder and CEO of Luta Security, also raises the issue of western-based bug bounty platforms that have been working with Chinese security researchers for the past years. "If Western-based bug bounty platforms comply with this requirement in order to continue to legally receive bug reports from Chinese researchers, we must assume they will be required to hand over vulnerability data to the Ministry within two days of receiving the reports," Moussouris said. "That requirement will effectively introduce a backdoor straight to the Chinese government in any VDP [vulnerability disclosure program] or bug bounty program where Chinese researchers submit bugs via platforms, even to non-Chinese companies."
Government

Fired Covid-19 Data Manager is Now Running for Congress (orlandoweekly.com) 214

Florida's fired Department of Health data manager Rebekah Jones lost access to her 400,000 followers on Twitter last month — which she'd been using to criticize Florida governor Ron DeSantis for downplaying the severity of the state's Covid-19 crisis. Then Jones announced she'd be running for Congress. "This also means, under Desantis' recently signed social media law, I get to fine Twitter $250K per day until my account is restored starting July 1."

Orlando Weekly reports: After a media frenzy, Jones deleted the post. She said she was attempting to point out Gov. Ron DeSantis's "hypocrisy" in writing a law that allowed political candidates to sue media companies that ban them, while still celebrating her Twitter suspension...

The bit became real when she filed to run as an Independent in Florida's 1st congressional district on June 25...

On her campaign website, she lists eight issues on her platform: protecting Florida's environmental systems, promoting government transparency, fighting for media accountability in disinformation, giving access to representatives, ensuring the district's veterans are taken care of, scrutinizing restrictive voting laws, funding science and research, and boosting support for all levels of education. Jones says there's still room for other issues on her platform, after she talks to more residents.

Jones' GoFundMe account ("DefendScience") now directs visitors to her official campaign site if they want to make campaign contributions. (And the GoFundMe page also notes that her campaign has been endorsed by 90-year-old Daniel Ellsberg, the famous whistleblower who in 1971 leaked the Pentagon Papers, a top-secret government study on the Vietnam War.)

But the last six weeks have been a wild ride for the data scientist:

Yesterday the official coronavirus coordinator for the White House reported that one in five of America's Covid-19 cases this week have come from Florida.


Censorship

1.4 Million Cubans Bypass Censorship Using US Government-Funded Software Psiphon (reuters.com) 50

"Cuban officials rallied tens of thousands of supporters in the streets on Saturday — nearly a week after they were stunned by the most widespread protests in decades," the Associated Press reports.

President Miguel Díaz-Canel — accompanied by 90-year-old former President Raul Castro — "made an impassioned speech blaming unrest on the U.S. and its economic embargo, 'the blockade, aggression and terror... The enemy has returned to throw all it has at destroying the sacred unity and tranquility of the citizens.'" "I think the government is just trying to signal to people that it understands their desperation and that it's going to try to alleviate some of the misery that they're experiencing. The problem is that the government just doesn't have much in the way of resources that it can devote to doing that," said William LeoGrande, an expert on Cuba at the American University in the United States.
Meanwhile, Reuters reports: Psiphon Inc's freely available internet censorship circumvention tool has helped nearly 1.4 million Cubans this week gain access to websites, the company said on Friday, after Cuba's government curbed access to popular social media and messaging platforms... Thousands of Cubans joined nationwide protests over shortages of basic goods, limits on civil liberties and the government's handling of a surge in COVID-19 infections on Sunday, the most significant unrest in decades in the communist-run country.

Psiphon said 1.389 million users accessed the open web from Cuba through its network on Thursday, as well as 1.238 million as noon EDT (1600 GMT) on Friday.

"Internet is ON; circumvention tools ARE working," Psiphon said in a statement.

Psiphon said the roughly 1.4 million represents about 20% of Cuban internet users. Its open source circumvention tool can be downloaded from app stores like Google Play or Apple to "maximize your chances of bypassing censorship," according to the company. Canadian university researchers developed the software in 2007 to let users evade governmental internet firewalls.

The censorship-circumvention tool — which combines VPN, SSH, and HTTP Proxy tools — has also been used in Iran, China, Belarus, Myanmar, according to recent news reports. Bloomberg notes that the Toronto-based nonprofit Psiphon "has received funding from the Open Technology Fund, a U.S. government nonprofit that aims to support global internet freedom technologies...

"On Thursday, President Biden said the U.S. is examining whether it's able to restore internet access shut down by the Cuban government."
Businesses

Automattic, Owner of Tumblr and WordPress, Buys Podcast App Pocket Casts (theverge.com) 20

Pocket Casts has a new owner. Automattic, which runs WordPress.com and recently purchased Tumblr, announced today that it's acquired Pocket Casts, the well-regarded podcast app. The blog post announcing the purchase didn't offer much in the way of a preview, but it did tease potential future integrations. From a report: "As part of Automattic, Pocket Casts will continue to provide you with the features needed to enjoy your favorite podcasts (or find something new)," the post states. "We will explore building deep integrations with WordPress.com and Pocket Casts, making it easier to distribute and listen to podcasts." Pocket Casts launched in 2010 and sold to NPR and a group of other public media groups eight years later. It's been well-received, particularly from sites like The Verge, because it's available across platforms. It started monetizing through a program called Pocket Casts Plus, which charges users a monthly subscription fee for features like desktop app access and a standalone Apple Watch app, in 2019.

Slashdot Top Deals