An anonymous reader quotes a report from TorrentFreak: On Tuesday, Mexico's Senate approved (PDF) a reform of the Federal Copyright Law that ties ISP liability to having a policy to terminate repeat infringers. [This policy has to be published permanently on their website and in their terms of service, and it must include a basic way to notify users. In other words, what can be terminated is the Internet connection itself, not just an account. According to Mexican business outlet EL CEO, this means that access providers such as Telmex and Izzi will need such a policy.] The Senate approved the amendments with roughly two-thirds of the vote, as the opposition voted against. The Chamber of Deputies already approved the same text in October, so the decree now goes to President Claudia Sheinbaum. Her government proposed the changes in May to bring the law in line with the USMCA trade agreement between Mexico, the United States and Canada. [...] Providers that don't comply risk facing liability. Under the new rules, any ISP that fails to meet its safe harbor conditions becomes liable for its users' infringements if it knowingly contributes to, induces, or causes the infringement. The same goes for an ISP that can control the infringing user and profits directly from the infringement. In both cases, the Mexican Institute of Industrial Property (IMPI) can fine the provider up to roughly 4.7 million pesos (~$250,000), depending on the infringement. The law doesn't explicitly define the term repeat infringer, nor does it say how many piracy accusations it takes before a subscriber can be cut off. According to Aurora Lopez-Portillo, director of legal services at IP firm ClarkeModet, each provider has to decide its own threshold. She told EL CEO that ISPs should also check whether the accusations actually hold up, while giving users a chance to respond, even though the law doesn't require that. During Tuesday's Senate debate, some lawmakers in the opposition raised similar concerns. Senator Gabriel Elizondo warned that families can share a single connection, so the pirating activities of one person could leave an entire household offline. Previously, opposition lawmakers proposed requiring a court order before Internet service could be suspended, but that proposal was not adopted. [...] There, failing to meet the safe harbor conditions, including the repeat infringer policy, is the first requirement for liability. If an ISP also contributes to infringement with knowledge of it, or can control the infringer and directly profits from it, it can be held responsible. The new repeat infringer rules will take effect 180 days after their publication in Mexico's official gazette, which hasn't happened yet as far as we can see. How Mexican ISPs will define a repeat infringer, and how many accusations it takes, has yet to be seen.

Read more of this story at Slashdot.

The European Commission has preliminarily found that TikTok violates the Digital Services Act because its For You recommendation algorithm can create a "rabbit hole effect," repeatedly exposing users to potentially harmful content involving topics such as sadness, isolation and body image. TikTok must change the feed's design or potentially face fines of up to 6% of its global annual revenue. The Verge reports: The findings come months after the EU Commission declared that TikTok's design is too "addictive." While TikTok has implemented controls to mitigate the algorithm's "rabbit hole effect," the Commission says its preliminary findings suggest that they're not effective. TikTok must now change the design of its For You feed, or else face fines of up to 6 percent of its global annual turnover. The platform is also facing pressure in the US, with lawmakers and a wave of lawsuits raising concerns about child safety. "Every time a user scrolls or likes a video on TikTok, the algorithm serves more of the same leading users down rabbit holes they cannot easily escape from," Henna Virkkunen, the EU Commission's executive vice president of tech sovereignty, security, and democracy, says in the press release. "Today's preliminary findings show again that TikTok needs to step up its efforts to protect users' well-being, including those of minors."

Read more of this story at Slashdot.

Chainalysis says attackers exposed usernames, password hashes and live tokens for all of its customers. "While the company locked Chainalysis accounts as a precaution after discovering that some customers' passwords had been exposed and asked users to reset their passwords before signing in again, it has now taken the login portal offline, together with Reactor and Data Solutions, the Know-Your-Transaction (KYT) user interface and API, and address screening products, after discovering further abnormal activity," reports BleepingComputer. The company says it has no evidence that investigative data or blockchain attribution records were accessed or altered, but all users will be required to reset passwords and rotate API keys before regaining access. BleepingComputer reports: Chainalysis provides blockchain analysis tools to trace cryptocurrency transactions and investigate crimes such as fraud, ransomware, and money laundering. Its customer list includes law enforcement, government agencies, financial institutions, insurance companies, and cryptocurrency businesses worldwide. This follows the company's disclosure last Friday that attackers using AI tools accessed customers' names, email addresses, user IDs, and organizational role labels using what it described as "offensive agentic techniques." While it initially said the impact was limited and the breach affected only non-sensitive identity metadata, later updates revealed that usernames and password hashes for all customers were exposed in an "on-path attack" (more commonly known as a Man-in-the-Middle or MITM attack). However, the company found no evidence that the attackers accessed investigative graph data or altered its blockchain attribution repositories. [...] To ensure threat actors don't access affected accounts, Chainalysis asked customers to provide trusted IP addresses so they can regain access to the login portal once it is brought back online and reset their credentials.

Read more of this story at Slashdot.

More than 100 activists breached a Microsoft AI data center construction site in Amsterdam as part of coordinated protests against the rapid expansion of AI infrastructure. "These data centres are destroying our world. It's becoming uninhabitable because of all the resources they consume. That's why we're here today," protester Sam van der Beek said. Reuters reports: Activist groups have announced actions in 16 countries on Friday and Saturday, according to the "Stop Dirty Data Centers" coalition, which is rallying environmental groups and digital rights campaigns behind calls to pause large-scale construction. In Amsterdam on Friday, more than 100 activists gathered at the construction site of a Microsoft AI data centre, marching arm in arm before breaking into the site, climbing cranes, hanging balloons and dancing while police stood by. Some carried placards with messages reading: "Screw your datacenter." Site owner Pure Data Centers, which plans to invest more than $1 billion and is backed by Brookfield-owned Oaktree, said it was committed to engagement with local stakeholders. "We respectfully ask those on site to leave safely and engage with us in dialogue about the development and any concerns they may have," it said. Other planned actions include a march in Dublin, a protest outside the parliament building in Warsaw, and a demonstration against a different Microsoft data centre in Denmark. [...] Stop Dirty Data Centers says it is not anti-progress or calling for existing data centers to be closed but that major construction should be halted until governments establish clearer rules.

Read more of this story at Slashdot.

Roku is removing its popular Aquatic Life fish tank screensaver on December 1 and automatically switching affected users to Roku City. According to Cord Cutters News, the creator pulled the license after Roku's sale to FOX was announced. Ars Technica reports: The screensaver has been an option for Roku OS users for 10 years. Roku has been licensing the animation, which is called the Marine Aquarium, from artist Jim Sachs through Prolific Publishing. Sachs is the creator and copyright holder of the Marine Aquarium. He developed the screensaver through his company SereneScreen. He tells Ars Technica that the licensing agreement with Roku is up for renewal every October and can be canceled by either party for any reason. A day after learning that Fox was planning to buy Roku, a deal that closed today, Sachs told Prolific that he wouldn't be renewing Roku's license. "I can't be part of the Fox world," he tells Ars, pointing to Fox News' controversial style of news and entertainment. Roku will automatically switch the Aquatic Life screensaver on affected devices to the Roku City screensaver, another popular animation that includes subtle advertisements, according to the user notice. The Aquatic Life screensaver provided an ad-free, relaxing display for years for some Roku users. Numerous people online have lamented the impending loss of the screensaver for Roku OS. [...] The decision to not renew the licensing contract has "major financial consequences," Sachs said. "Our needs are very small, with a high property tax bill being the only significant expense," he said. "We'll be okay but can't start any of the projects I had planned." According to Sachs, the licensing "agreement was $80,000 per year for exclusive rights to all set-top devices, or $60,000 per year for non-exclusive. They have always opted for exclusive." Ars asked Roku to confirm the details of the licensing agreement but didn't hear back ahead of publication. The licensing deal with Roku was Sachs' primary form of income, he told Ars, noting low sales of the version of the screensaver for computers. Marine Aquarium fans can still buy the screensaver for Windows, macOS, iOS, and Android, but it seems unlikely that it will return to the Roku platform.

Read more of this story at Slashdot.

OpenAI says its new GPT-6 Cyber model helped an automated system identify 1,724 security flaws in the Linux kernel and exploit 948 of them to gain administrator-level access during testing, including at least 10 previously unknown techniques. Axios reports: During testing, the system identified 1,724 security flaws and found ways to use 948 of them to gain administrator-level access to Linux systems for about $1.2 million in API credits. At least 10 of the techniques the model used were previously unknown, according to OpenAI. Human researchers reviewed the Linux findings before reporting vulnerabilities and proposed fixes to maintainers. The model also uncovered 81 previously unknown, high-severity flaws in Mozilla's Firefox browser.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica: Top Republican lawmakers have asked Jensen Huang to appear before Congress to answer questions after it was reported that US intelligence officials believe Nvidia's chief executive has been targeted by a Chinese spying operation. The chairs of the House committees on China, foreign affairs, and intelligence wrote to Huang this week asking him to appear before a joint closed-door briefing for their committees on November 18. "Recent reports raise significant national security concerns regarding the People's Republic of China's access to sensitive US technology and information," representatives John Moolenaar, Brian Mast, and Rick Crawford wrote. "The issue of PRC infiltration and access to cutting-edge US technology is core to the investigative work of our three committees this Congress. It is vital that Congress determines the extent to which US national security has been placed at risk," the lawmakers added. The New York Times last week wrote that US intelligence officials believed Huang had been the target of a Chinese spy operation. The concerns center on a Chinese woman named Alice Huang, an executive at Megaspeed, a Singapore-based cloud company that has bought billions of dollars of Nvidia's chips. Nvidia has rejected the claims and on Thursday would not say if Huang would appear before Congress. "Meetings with customers are part of a CEO's job. Jensen talks with thousands of customer executives every year," the company said. "Our regional cloud customers receive ordinary business information -- not sensitive Nvidia trade secrets -- and zero information relevant to national security," it added. The lawmakers said they wanted Huang to discuss the security protocols Nvidia had in place to protect against "foreign adversary espionage." The company said its chief executive had an "outstanding security team" that travels with him. The New York Times said Huang had not received a "defensive briefing," which the intelligence community usually, but not always, provides potential espionage targets to warn them about the activity. Nvidia said it was confident that the US government would have let the company know if it thought a person was a threat to US industry and that it often receives updates from Washington about people of concern.

Read more of this story at Slashdot.

Elon Musk says Tesla will be "winding down" Cybertruck production at its Texas Gigafactory around mid-2027 to free up capacity for increased production of its Cybercab robotaxi. CNBC reports: The Cybertruck is exclusively produced at the company's plant in Texas alongside the Tesla Model Y and two-seat Cybercab, which Musk has touted as a crucial product for the automaker moving forward. Musk did not say whether the company would produce the Cybertruck at a different facility, but he later responded to a user on X who called the update an "end of an era" and said the Cybertruck was the "best vehicle Tesla has ever made." "True, but the Cybertruck fleet will be around for a long time," Musk said. The Cybertruck and its polarizing design gained a niche following, but it did not achieve mass-market sales, despite Musk's pre-launch prediction that annual sales would eventually total 250,000. "Trucks have been the same for a very long time," Musk said when the truck was unveiled in 2019. "Like 100 years. Trucks have been basically the same. We want to try something different." While Tesla does not break out its sales by model or region, Cox Automotive estimated sales of the Cybertruck last year at 20,237 units in the U.S., down 48% from 38,965 in 2024. Thank you Slashdot reader Dan Posluns for sharing the news.

Read more of this story at Slashdot.

Britain plans to require employers to disclose salaries in job advertisements. "Whether you're a young person starting out or a parent trying to support your family, you should know what a job pays before spending your time and effort applying for it," Prime Minister Andy Burnham said in a statement. Reuters reports: The government said requiring companies to disclose pay in job ads would help young people applying for their first jobs, while boosting pay transparency and helping tackle disparities that can disadvantage women. Just over two in five employers always publish salary ranges, while fewer than one in five always disclose specific salaries, Burnham's office said, citing estimates from the Chartered Institute of Personnel and Development. The government will soon introduce legislation to parliament making salary disclosures mandatory, Burnham's office said, although it did not provide a timeline. Nearly one million, or 13%, of 16 to 24 year-olds in Britain are not in employment, education or training, one of the highest shares in Europe. A government review into youth inactivity is due to be published later in November.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica: Sony has brought back the MDR-3-series headphones that debuted in 1979 alongside the Walkman TPS-L2 cassette player. [...] The new MDR-3R (originally called the "MDR-3L2") headphones look just like the originals and come with orange and blue ear cushions. New headphones are often wireless these days, but the MDR-3R continues the wired tradition of the MDR-3, with an essential twist: a USB-C connector. For better or worse, the new headphones also use "the same 23 mm driver units as the MDR-3 to reproduce sound quality close to the original," per Sony. Audiophiles will prefer something more advanced, perhaps with additional acoustic features. In addition to the USB-C connector, the MDR-3R also adds an in-line remote control and an integrated microphone. They are available for $60.

Read more of this story at Slashdot.

Blue Origin has unveiled a third stage called GS3 for its New Glenn rocket, designed to deliver satellite constellations directly to geostationary orbit and support heavy-lift missions to the Moon and deep space. The company also announced Northstar, a new methalox booster engine that it says produces 715,000 pounds of thrust while cutting mass by 30% and parts by 50% compared with the BE-4. Space.com reports: The new stage will be powered by one BE-7 engine, which the company developed for use on its Blue Moon spacecraft, one of the two private vehicles that NASA selected to be crewed lunar landers for its Artemis program. (The other is SpaceX's Starship.) Blue Moon landing missions won't need to launch on GS3-equipped New Glenn rockets, according to Blue Origin. But the third stage "can support sustained operations around the moon," the company wrote in today's blog post. "By delivering significant payload mass directly to trans-lunar injection (TLI), GS3 enables faster transit times while preserving propellant for on-orbit operations." And there's already demand for such services: Blue Origin also announced today that a government customer (which it did not name) has booked a GS3 mission to cislunar (Earth-moon) space, with launch targeted for 2028. And the company dropped yet more news today -- that it's working on a new first-stage engine, called Northstar. Like Blue Origin's other booster engine, the BE-4, Northstar burns liquid oxygen and liquid methane propellant, a combination known as methalox. But the new engine is more powerful and less complex. "Compared to the BE-4 engine, Northstar reduces mass by 30% and parts count by 50%, while increasing thrust from 640,000 to 715,000 pounds-force," Blue Origin said in a second blog post today. "Manufacturing advancements have also significantly shortened production timelines, enabling assembly in less than a day." Northstar went from program approval to development testing in just 11 months, according to the company. But today's update did not say when the new engine will fly for the first time.

Read more of this story at Slashdot.

The FAA announced today that it is finally phasing out floppy disks from air traffic control systems at more than 400 facilities. Engadget reports: They'll be replaced by a more modern system called Enterprise -- Information Display System (E-IDS), which is comprised of a digital display for relaying status information, updates and other alerts to air traffic teams. The FAA plans to have E-IDS installed in 435 sites by the end of 2028; the first five locations to receive the upgrades are the Atlantic City International Airport, Nashville International Airport and Greater Rochester International Airport, as well as data processing hubs in Atlanta and Salt Lake City.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Scientific American: The Great Pacific Garbage Patch, an area in the Pacific Ocean where debris naturally accumulates, is full of tiny bits of plastic -- so full, in fact, that it seems to be changing the color of the ocean. [...] To better understand how microplastics may have influenced the ocean's color, [Daniel Koestner, a postdoctoral fellow at the University of Bergen in Norway] and his colleagues looked at 20 years of satellite data from the spot in the ocean with perhaps the most of plastic -- the Great Pacific Garbage Patch, a zone between Hawaii and California where trash trapped by ocean currents accumulates. Between 2002 and 2022, the researchers found, waters near the garbage patch have gotten brighter in both blue and green wavelengths compared with surrounding areas. The results, published in the journal Communications Earth & Environment on Thursday, don't yet prove that microplastics have directly brightened the ocean, the researchers emphasize, though their findings are backed up by lab experiments with microplastics. But without taking direct ocean samples, it's hard to know for sure what's causing the ocean's color to change. "We're still one step away from proving definitively that microplastics are causing the shift in color that that we're seeing," adds study co-author Shea Cheatham, a Ph.D. student also at the University of Bergen. "We just have to get in there [to the garbage patch] to verify." The hope is that detecting these color shifts could help identify other areas around the world where microplastics have accumulated.

Read more of this story at Slashdot.

Joe_Dragon shares a report from TechCrunch: Applebee's has fixed a security flaw that allowed anyone to access the personal information of its registered customers, after a researcher found a password for an internal database inside Applebee's mobile app, TechCrunch has learned. The popular restaurant chain confirmed [last Thursday] that it had taken action to address the security issue to prevent any unauthorized access to its customer database. [...] The exposed database contained customer names, email addresses (including whether or not the customer verified their email), dates of birth, phone numbers, and ZIP codes. The data also included veteran status, the number of times customers had logged in, when their accounts were created, and the IP addresses of their most recent log-ins, which can be used to reveal the person's approximate location. [...] When asked by TechCrunch, the spokesperson would not say if the company has server logs that it can review to determine whether anyone accessed the database, or if it has any logs at all. "Our investigation is ongoing, and we will take appropriate steps based on our findings," the company added. It's unclear how many customers were affected by the data exposure. [...] Applebee's had at least 8.5 million customers enrolled in its rewards program as of last year, though the company would not provide a number of how many customers had their personal information exposed by this security flaw.

Read more of this story at Slashdot.

"OpenAI has published a new National Community Compact and Compute Campus Policy Blueprint, apparently in response to the Blue Wave Midterm Elections," writes ancient Slashdot reader Gilmoure. "Instead of moving into communities like a juggernaut, they say they will be dangling friendly carrots going forward." Here's an excerpt from OpenAI's article: Every future compute campus OpenAI owns and operates will have its own local compact. We'll engage residents early enough to ensure their input shapes project plans, give them a local point of contact throughout the life of the campus, and report publicly each year on how we're doing. Each compact will reflect local priorities and include a common set of commitments: - Pay our own way on energy and infrastructure. We'll pay the full cost of the electricity we use and the infrastructure needed to serve us. Before major spending begins, we'll provide financial assurances so other customers are protected if a project is delayed, reduced, or canceled. - Protect local resources and report on our impact. We'll develop a water plan for each campus, prioritize closed-loop or low-water cooling, and publish site-level water and electricity use. We'll publish construction plans and independent noise studies before operations begin and annually afterward. And we will not use non-disclosure agreements (NDAs) with public officials, allowing only narrow protections covering legitimate security information, trade secrets, or proprietary or competitively sensitive information. - Create opportunities for local workers and businesses. We'll publish the jobs we expect to create, work with unions and training providers to help residents prepare for them, and report annually on hiring and apprenticeships. We'll also make sustained investments in priorities residents help select. [...] The investments that help America compete globally can also help communities prosper locally. That starts with giving residents a say while plans can still change and a way to hold developers accountable for delivering on their commitments. That's what we're committing to at the campuses we own and operate, and what we believe people should be able to count on wherever AI infrastructure is built across the country.

Read more of this story at Slashdot.

A newly disclosed OpenSSH flaw dubbed "*sshole" can allow attackers to log in to password-disabled accounts on certain musl-based Linux systems simply by submitting a password longer than 256 bytes. "Apparently certain varieties of musl Linux (Alpine, OpenWrt, Buildroot, Yocto, etc.) have had this OpenSSH vulnerability for about a decade," writes longtime Slashdot reader AlteredEgg. "Upgrade now!" BleepingComputer reports: Security researcher Ozgun Kultekin, who discovered and released details on the vulnerability today, says the flaw has existed since 2016 and stems from how OpenSSH handles password verification errors on systems using the musl C library. Linux accounts can be configured to prevent password logins by replacing their password hash with an asterisk (*) in the /etc/shadow file. Because this is not a valid password hash, no password should allow access to those accounts. However, a patch introduced in OpenSSH in 2016 to fix a username enumeration vulnerability tracked as CVE-2016-6210 changed how OpenSSH handled accounts without usable password hashes. To prevent attackers from identifying valid usernames through different response times, OpenSSH was modified to perform password hashing even when an account had no usable password hash, including accounts configured with * to block password logins. The problem is that the musl C library's crypt() function also returns * when password hashing fails, including when a submitted password exceeds its 256-byte limit. This means an attacker can submit an oversized password and cause OpenSSH to compare the returned * against the account's stored *, resulting in a successful login. To be clear, the flaw does not allow attackers to bypass passwords on accounts with valid password hashes. [...] Admins who can't immediately install the update can mitigate the issue by turning off SSH password authentication with PasswordAuthentication no in their SSH server configuration and restarting SSH. Kultekin says admins can also check for signs of exploitation by examining SSH authentication logs for password-based logins for accounts that should not allow them.

Read more of this story at Slashdot.

According to Bloomberg, Apple is cutting employee AI spending limits to reduce costs, lowering some engineers from $300 to $200 per day and considering limits as low as $100, with some teams capped at $25. Employees are also being encouraged to use cheaper models or on-device AI. MacRumors reports: Engineers at Apple have the largest budgets because using AI for coding can consume a large number of tokens. Apple lets employees use Claude, ChatGPT, Gemini, and other models. Some Apple employees told Bloomberg that few were using their full $300 daily limit, so the savings may be small. Apple has also hired outside productivity consultants for some divisions. Combined with the AI cost cuts, the reviews have fueled worries about possible restructuring.

Read more of this story at Slashdot.

Longtime Slashdot reader bbsguru shares a report from KrebsOnSecurity: Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder's web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016. The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President (AS2650). Layer3 said the proxy activity was relatively persistent between October 5 to November 3, and that a review of the proxies available from AS2650 showed they exited from the White House network 236 times during that period. The proxy tracking company Synthient said on Twitter/X that the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica, a proxy program that is often integrated into "free" mobile and desktop applications. Infatica's founder Vladimir Fomenko is a Russian man whose hosting firm King Servers was home to six of the eight internet addresses used by Russia's state security services to compromise databases for election systems in Arizona and Illinois in 2016. [...] Layer3 Intel said the proxy exit nodes at the White House came from six internet addresses, on 26 of the 30 days, and that most of the activity happens in the evening, between 5 p.m. and midnight. Incredibly, Infatica was not the only proxy service that reportedly has been reselling access to White House internet addresses: Layer3 Intel said it found 28 separate residential proxy services were able to exit through this network. "This is public access," the Layer3 Intel team wrote. "Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. We did not selectively target this network or try to make our probes exit from it. We caught this by chance, simply by requesting global rotating access through these services."

Read more of this story at Slashdot.

Discord is replacing Electron with a desktop client built fully in Rust, which the company says should significantly reduce the app's notoriously high resource usage while improving performance and memory safety. "We've been early adopters of Rust since 2018 and a lot of our infra, voice tech, and even some of the current client is already Rust, the holy grail was getting the whole client there," explains Discord chief technology officer Stanislav Vishnevskiy in a post on X. "That means Electron goes away, and so does React Native, mobile keeps native UI but shares app code with desktop via Rust." The Verge reports: Vishnevskiy also shared an image of the Discord Windows client using just 290MB of RAM, which is a clear improvement as you only have to participate in a few servers and RAM usage can easily hit 1GB or more using the current Windows app. It's not clear when Discord will make the full switch over to Rust, but Vishnevskiy says the company "hope to get it into testing with users soon."

Read more of this story at Slashdot.

Motorola's $1,600 Signature 27 will become the company's first smartphone to support the security- and privacy-focused GrapheneOS that completely strips out native Google services and telemetry at the OS level. To help justify the price, Motorola equipped the Signature 27 with top-of-the-line specs, including a tandem OLED display, Qualcomm's Snapdragon 8 Elite Extreme Gen 6, up to 16GB of LPDDR5X RAM and 512GB of UFS 4.1 storage (up from a base configuration of 12GB and 256GB), and a 200-megapixel periscope telephoto camera. According to Motorola, the EVS action sensor (telephoto camera) is the first in a smartphone, offering "new possibilities for photographing moving subjects and captures even fast movement with impressive clarity and precision." It'll be available in markets worldwide in the coming months.

Read more of this story at Slashdot.