“It is the talk of the town today — the loud boom, the flash of light in the sky experienced by a lot of folks across the Houston area this afternoon,” says a local Texas newscaster. “And then there was this — a home in northwest Harris county hit by something that crashed through their roof.”

Travelling at very high speed, the six-pound meteorite crashed through their roof and through their attic, crashing again through the ceiling oF the floor below. It then bounced off the floor, hit the ceiling again — and then fell onto the bed.

CBS News reports:

NASA said in a social media post that the meteor became visible at 49 miles above Stagecoach, northwest of Houston, at 4:40 p.m. local time. The meteor moved southeast at 35,000 miles per hour, breaking apart 29 miles above Bammel, just west of Cypress Station, NASA said. “The fragmentation of the meteor — which weighed about a ton with a diameter of 3 feet — created a pressure wave that caused booms heard by some in the area,” NASA said in the post. Across the Houston area, residents described hearing a low, rumbling sound that many compared to thunder, even though the skies were clear, according to CBS affiliate KHOU.

Earlier this week, an asteroid weighing about 7 tons and traveling at 45,000 mph traveled over multiple states. And last June, a bright meteor was seen across the southeastern U.S. and exploded over Georgia, creating similar booms heard by residents in the area.

Read more of this story at Slashdot.

“After nearly a decade of delays and industry skepticism, Tesla’s electric big rig is finally rolling out of Nevada’s Gigafactory for mass production starting summer 2026,” writes Gadget Review. And some truckers who tested the vehicles already love them (as reported by the Wall Street Journal):

Dakota Shearer and Angel Rodriguez, among other pilot drivers, rave about the centered cab that eliminates blind spots during tight maneuvers. The automatic transmission means no more wrestling with 13-gear diesels, reducing physical stress on long hauls. Most surprisingly, the Semi maintains highway speeds on grades where diesel trucks typically crawl at 30 mph. The 500-mile range enables multiple daily round-trips — think Long Beach to Vegas or Inland Empire runs — without range anxiety…
Sure, the Semi costs under $300,000 — roughly double a diesel equivalent — but the math gets interesting quickly. Energy costs drop to $0.17 per mile compared to $0.50-0.70 for diesel fuel. Maintenance requirements shrink dramatically; one fleet reports needing just one mechanic for their electric trucks versus five for 40 diesels… Tesla offers Standard Range (325 miles) and Long Range (500 miles) versions, both handling 82,000-pound gross combined weight at 1.7 kWh per mile efficiency.

The tri-motor setup delivers 800 kW — over 1,000 horsepower equivalent — enabling loaded 0-60 mph acceleration in 20 seconds versus 45-60 for diesel. Fast charging hits 60% capacity in 30 minutes [which Tesla says is 4x faster than other battery-electric trucks] using the new MCS 3.2 standard, while 25 kW ePTO power runs refrigerated trailers without diesel auxiliaries. Charging networks remain the biggest hurdle for widespread adoption. Public charging stations lack the Semi’s massive power requirements, limiting long-haul routes. Tesla plans dedicated fast-charging corridors starting this summer, but coverage remains spotty. The lack of sleeper cabs also restricts the Semi to regional freight rather than cross-country hauling.

Production scales to 5,000-15,000 units by 2026, then 50,000 annually — assuming charging infrastructure keeps pace with demand.

Thanks to long-time Slashdot reader schwit1 for sharing the article.

Read more of this story at Slashdot.

“We have removed all malicious artifacts from the affected registries and channels,” Trivy maintainer Itay Shakury posted today, noting that all the latest Trivy releases “now point to a safe version.” But “On March 19, we observed that a threat actor used a compromised credential…”

And today The Hacker News reported the same attackers are now “suspected to be conducting follow-on attacks that have led to the compromise of a large number of npm packages…” (The attackers apparently leveraged a postinstall hook “to execute a loader, which then drops a Python backdoor that’s responsible for contacting the ICP canister dead drop to retrieve a URL pointing to the next-stage payload.”)
The development marks the first publicly documented abuse of an ICP canister for the explicit purpose of fetching the command-and-control (C2) server, Aikido Security researcher Charlie Eriksen said… Persistence is established by means of a systemd user service, which is configured to automatically start the Python backdoor after a 5-second delay if it gets terminated for some reason by using the “Restart=always” directive. The systemd service masquerades as PostgreSQL tooling (“pgmon”) in an attempt to fly under the radar…

In tandem, the packages come with a “deploy.js” file that the attacker runs manually to spread the malicious payload to every package a stolen npm token provides access to in a programmatic fashion. The worm, assessed to be vibe-coded using an AI tool, makes no attempt to conceal its functionality. “This isn’t triggered by npm install,” Aikido said. “It’s a standalone tool the attacker runs with stolen tokens to maximize blast radius.”

To make matters worse, a subsequent iteration of CanisterWorm detected in “@teale.io/eslint-config” versions 1.8.11 and 1.8.12 has been found to self-propagate on its own without the need for manual intervention… [Aikido Security researcher Charlie Eriksen said] “Every developer or CI pipeline that installs this package and has an npm token accessible becomes an unwitting propagation vector. Their packages get infected, their downstream users install those, and if any of them have tokens, the cycle repeats.”

So far affected packages include 28 in the @EmilGroup scope and 16 packages in the @opengov scope, according to the article, blaming the attack on “a cloud-focused cybercriminal operation known as TeamPCP.”

Ars Technica explains that Trivy had “inadvertently hardcoded authentication secrets in pipelines for developing and deploying software updates,” leading to a situation where attacks “compromised virtually all versions” of the widely used Trivy vulnerability scanner:

Trivy maintainer Itay Shakury confirmed the compromise on Friday, following rumors and a thread, since deleted by the attackers, discussing the incident. The attack began in the early hours of Thursday. When it was done, the threat actor had used stolen credentials to force-push all but one of the trivy-action tags and seven setup-trivy tags to use malicious dependencies… “If you suspect you were running a compromised version, treat all pipeline secrets as compromised and rotate immediately,” Shakury wrote.
Security firms Socket and Wiz said that the malware, triggered in 75 compromised trivy-action tags, causes custom malware to thoroughly scour development pipelines, including developer machines, for GitHub tokens, cloud credentials, SSH keys, Kubernetes tokens, and whatever other secrets may live there. Once found, the malware encrypts the data and sends it to an attacker-controlled server. The end result, Socket said, is that any CI/CD pipeline using software that references compromised version tags executes code as soon as the Trivy scan is run… “In our initial analysis the malicious code exfiltrates secrets with a primary and backup mechanism. If it detects it is on a developer machine it additionally writes a base64 encoded python dropper for persistence….”

Although the mass compromise began Thursday, it stems from a separate compromise last month of the Aqua Trivy VS Code extension for the Trivy scanner, Shakury said. In the incident, the attackers compromised a credential with write access to the Trivy GitHub account. Shakury said maintainers rotated tokens and other secrets in response, but the process wasn’t fully “atomic,” meaning it didn’t thoroughly remove credential artifacts such as API keys, certificates, and passwords to ensure they couldn’t be used maliciously.
“This [failure] allowed the threat actor to perform authenticated operations, including force-updating tags, without needing to exploit GitHub itself,” Socket researchers wrote.
Pushing to a branch or creating a new release would’ve appeared in the commit history and trigger notifications, Socket pointed out, so “Instead, the attacker force-pushed 75 existing version tags to point to new malicious commits.” (Trivy’s maintainer says “we’ve also enabled immutable releases since the last breach.”)
Ars Technica notes Trivy’s vulnerability scanner has 33,200 stars on GitHub, so “the potential fallout could be severe.”

Read more of this story at Slashdot.

“Imagine a newspaper publisher announcing it will no longer allow libraries to keep copies of its paper,” writes EFF senior policy analyst Joe Mullin.

“That’s effectively what’s begun happening online in the last few months.”

The Internet Archive — the world’s largest digital library — has preserved newspapers since it went online in the mid-1990s… But in recent months The New York Times began blocking the Archive from crawling its website, using technical measures that go beyond the web’s traditional robots.txt rules. That risks cutting off a record that historians and journalists have relied on for decades. Other newspapers, including The Guardian, seem to be following suit…

The Times says the move is driven by concerns about AI companies scraping news content. Publishers seek control over how their work is used, and several — including the Times — are now suing AI companies over whether training models on copyrighted material violates the law. There’s a strong case that such training is fair use. Whatever the outcome of those lawsuits, blocking nonprofit archivists is the wrong response.

Organizations like the Internet Archive are not building commercial AI systems. They are preserving a record of our history. Turning off that preservation in an effort to control AI access could essentially torch decades of historical documentation over a fight that libraries like the Archive didn’t start, and didn’t ask for. If publishers shut the Archive out, they aren’t just limiting bots. They’re erasing the historical record…

Even if courts place limits on AI training, the law protecting search and web archiving is already well established… There are real disputes over AI training that must be resolved in courts. But sacrificing the public record to fight those battles would be a profound, and possibly irreversible, mistake.

Read more of this story at Slashdot.

13 million people live in Moscow, reports CNN.

But since early March the city “has experienced internet and mobile service outages on a level previously unseen.” (Though Wi-Fi access to the internet is still available…) Russian social media “is flooded with jokes and memes about sending letters by carrier pigeons or using smartphones as ping-pong paddles…”

[Moscow residents] complain they cannot navigate around the center or use their favorite mobile apps. The interruptions appear to have had a knock-on effect of making it more difficult to make voice calls or send an SMS. Some are panic-buying walkie-talkies, paper maps, and even pagers.

The latest shutdown builds on similar efforts around the country. For months, mobile internet service interruptions have hit Russia’s regions, particularly in provinces bordering Ukraine, which has staged incursions and launched strikes inside Russian territory to counter Russia’s full-scale invasion. Some regions have reported not having any mobile internet since summer. But the most recent outages have hit the country’s main centers of wealth and power: Moscow and Russia’s second city, St. Petersburg.

Public officials claim the blackout of mobile internet service in the capital and other regions is part of a security effort to counter “increasingly sophisticated methods” of Ukrainian attack… Speculation centers on whether the authorities are testing their ability to clamp down on public protest in the case there’s an effort to reintroduce unpopular mobilization measures to find fresh manpower for the war in Ukraine; whether mobile internet outages may precede a more sweeping digital blackout; or if the new restrictions reflect an atmosphere of heightened fear and paranoia inside the Kremlin as it watches US-led regime- change efforts unfold against Russian allies such as Venezuela and Iran… On Wednesday, Russian mobile providers sent notifications that there would be “temporary restrictions” on mobile internet in parts of Moscow for security reasons, Russian state news agency RIA-Novosti reported. The measures will last “for as long as additional measures are needed to ensure the safety of our citizens,” Kremlin spokesman Dmitry Peskov said on March 11…

As well as banning many social media platforms, Russia blocks calling features on messenger apps such as WhatsApp and Telegram. Roskomnadzor, the country’s communications regulator, has introduced a “white list” of approved apps… Russia has also tested what it calls the “sovereign internet,” a network that is effectively firewalled from the rest of the world. The disruptions are fueling broader concerns about tightening state control. In parallel with the internet shutdown, the Kremlin has also been pushing to impose a state-controlled messaging app called Max as the country’s main portal for state services, payments and everyday communication. There has been speculation the Kremlin may be planning to ban Telegram, Russia’s most widely used messaging app, entirely. Roskomnadzor said that it was restricting Telegram for allegedly failing to comply with Russian laws.

“Russia has opened a criminal case against me for ‘aiding terrorism,'” Telegram’s Russian-born founder Pavel Durov said on X last month. “Each day, the authorities fabricate new pretexts to restrict Russians’ access to Telegram as they seek to suppress the right to privacy and free speech….”
The article includes this quote from Mikhail Klimarev, head of the Internet Protection Society and an expert on Russian internet freedom. “In any situation when they (the authorities) perceive some kind of danger for themselves and accept the belief that the internet is dangerous for them, even if it may not be true, they will shut it down,” he said. “Just like in Iran.”

Read more of this story at Slashdot.

“Juicier steaks could soon be served up after barley was given the go-ahead to become Britain’s first gene-edited crop,” reports the Telegraph:
In an effort to fatten up cows and get them to market faster, scientists have altered the DNA of Golden Promise barley to increase its fat content… [Regulators have approved the feeding of that barley to cows for further studies.] [T]he small increase reduces the time it takes for farmers to raise animals for slaughter and increases the amount of milk and meat they produce to make the industry more profitable.

The gene-edited barley is also able to cut the amount of methane a cow produces, [Rothamsted Research professor/biochemist Peter] Eastmond said… Reducing methane from cattle is a major goal of the industry, and Professor Eastmond estimated his barley could cut the methane output from a single cow by up to 15%.

The two genetic tweaks to the barley are believed to alter the gut bacteria in cows’ stomachs and reduce the amount of methane-generating microbes, cutting the cows’ emissions…. [Eastmond] is also working on applying the same two gene edits to rye grass to create pastures and meadows which are lipid-rich and calorie-dense. This, he said, could lead to entire fields of gene-edited grass which could be grazed by cows, sheep, horses and goats to fatten them up and cut emissions… “It would be better to have this technology in a pasture grass that’s grown to supply the livestock and graze it directly.”
The barley “has been modified to have a single letter of DNA removed from two different genes to switch them off,” the article points out. “No genes have been added to its DNA and it is not considered to be genetically modified.”

The article points out that Britain “has launched a push towards more gene-edited crops as a key post-Brexit freedom since splitting from the European Union,” noting that U.K. scientists and private companies “have created products such as bread with fewer cancer-causing chemicals, longer-lasting strawberries and bananas, sweeter-tasting lettuce and disease-resistant potatoes, although these are yet to be granted permission to land on supermarket shelves…”
But the EU has so far resisted the sale of any gene-edited crops in the EU.

Thanks to long-time Slashdot reader fjo3 for sharing the article.

Read more of this story at Slashdot.

There could be one more step required before creating an account and posting on Reddit in the future. According to Reddit’s CEO, Steve Huffman, the social media platform is exploring different ways to verify a user is human and not a bot. When asked by the TBPN podcast how to confirm that it’s a human using Reddit, Huffman responded with several verification methods with varying degrees of heavy-handedness.

“The most lightweight way is with something like Face ID or Touch ID,” Huffman said during the interview. “They actually require a human presence, like a human has to touch, or do or look at something, so that actually just proves there’s a person there or gets you pretty far.”

Besides these passkey methods that use biometrics data, Huffman said there are other options like relying on third-party services that are decentralized or don’t require ID. On the other end of the spectrum, Huffman also mentioned more burdensome options, like ID-checking services.

Recent years have brought a rise in bots flooding social media platforms including Reddit, where they’ve even been used to conduct secret experiments. It doesn’t sound like Reddit has landed on how to verify its users’ human identity yet, but Huffman did emphasize that the platform still wants to prioritize anonymity for its users. However, verifying humanity through identifiable and personal data could end up as a dealbreaker for Reddit users who value the anonymity of the platform. 

“Part of our promise for our users is we don’t know your name but we do want to know you’re a person,” Huffman said. “It’ll be an evolution for us for a while, and probably every platform to find the right middle ground here.”

Reddit co-founder and former executive chair, Alexis Ohanian, said on X that Reddit requiring Face ID wasn’t something he expected but agreed that something had to be done about the fake content from bots, adding that, “I just don’t know how to sell face-scanning to Redditors or even lurkers.” We reached out to Reddit’s communications team and will update the story when we hear back.

This article originally appeared on Engadget at https://www.engadget.com/social-media/reddit-is-weighing-identity-verification-methods-to-combat-its-bot-problem-195814671.html?src=rss

China’s orbital outpost Tiangong was completed in 2022 and is hosting up to three astronauts at a time, reports CNN.

But meanwhile U.S. lawmakers are now signaling there’s not time to develop and launch a replacement for the International Space Station — considered the signal most expensive object ever built — before its deorbiting in 2030. A recent Senate bill calls for the U.S. to continue funding it as late as 2032, but that bill still awaits approval from the U.S. Senate and the House.

But some private space companies are already building their alternatives:

Private companies that are in the early design and mockup phase of developing these space stations are still waiting on NASA for guidance — and money… [NASA’s “Requests for Proposals”] were delayed, in part because it took all of 2025 to cinch a confirmation for Trump’s on-again-off-again pick for NASA administrator, Jared Isaacman [confirmed in December]… Similarly, 2025 saw a 45-day government shutdown, the longest in history — adding another hiccup in the space agency’s plans to begin formally soliciting proposals from the private sector. Companies now expect that NASA will issue its Request for Proposals in late March or early April, one CEO told CNN…

Several commercial outfits have recently announced big funding influxes aimed at speeding up the development and launch of new orbiting outposts. Houston-based Axiom Space announced a $350 million funding round last month. Its California-based competitor Vast then notched a $500 million raise in early March. Vast is determined to launch a bare-bones station to orbit as soon as possible, with or without federal input, according to the company. “Our approach is to actually not wait for (NASA) and get going and build a minimum viable product, single-module space station called Haven-1, which we’re launching into orbit next year,” Vast CEO Max Haot told CNN in a phone interview earlier this month. Similarly, Axiom Space is working toward a 2028 launch date for a module that it plans to initially attach to the ISS before breaking off to orbit on its own. A spokesperson told CNN that it the company is “committed” to winning the NASA contract money and may continue pursing such goals even without contract awards.

Still, there’s lingering doubt that any of the companies pursuing space stations will be able to stay afloat without securing a coveted NASA contract or at least cinching significant business from the public sector.

The article includes “Another complicating fact: Russia, the United States’ primary partner on the ISS, has not pledged to keep operating its half of the space station past 2028.” NASA will eventually evaluate proposals for an ISS alternative from Vast, Axiom Space, Jeff Bezos’ Blue Origin, Max Space and several competitors including Voyager Technologies, CNN notes, ultimately handing out an estimated $1.5 billion in contracts between 2026 and 2031.

And while those companies may wait decades before a return on their investment, the article includes this quotes from the cofounder/general partner of Balerion Space Ventures, which led the fundraising for Vast. ” What’s obvious to us is you’re going to have multiple vehicles with myriad companies go into space. You’re going to have vehicles leaving from celestial bodies, like the moon. And we need a habitat.”

Read more of this story at Slashdot.

Need something new for your reading list? Here are two titles we think are worth checking out. This week, we’ve got Andy Weir’s Project Hail Mary and The Thing on the Doorstep, an H.P. Lovecraft adaptation for Image Comics. 

This article originally appeared on Engadget at https://www.engadget.com/entertainment/what-to-read-this-weekend-revisiting-project-hail-mary-and-the-thing-on-the-doorstep-190000250.html?src=rss

ReactOS aims to be compatible with programs and drivers developed for Windows Server 2003 and later versions of Microsoft Windows.

And Slashdot reader jeditobe reports that the project has now “announced significant progress in achieving compatibility with proprietary graphics drivers.”

ReactOS now supports roughly 90% of GPU drivers for Windows XP and Windows Server 2003, thanks to a series of fixes and the implementation of the KMDF (Kernel-Mode Driver Framework) and WDDM (Windows Display Driver Model) subsystems. Prior to these changes, many proprietary drivers either failed to launch or exhibited unstable behavior. In the latest nightly builds of the 0.4.16 branch, drivers from a variety of manufacturers — including Intel, NVIDIA, and AMD — are running reliably.

The project demonstrated ReactOS running on real hardware, including booting with installed drivers for graphics cards such as Intel GMA 945, NVIDIA GeForce 8800 GTS and GTX 750 Ti, and AMD Radeon HD 7530G. They also highlighted successful operation on mobile GPUs like the NVIDIA Quadro 1000M, with 2D/3D acceleration, audio, and network connectivity all functioning correctly. Further tests confirmed support on less common or older configurations, including a laptop with a Radeon Xpress 1100, as well as high-performance cards like the NVIDIA GTX Titan X.

A key contribution came from a patch merged into the main branch for the memory management subsystem, which improved driver stability and reduced crashes during graphics adapter initialization.

Read more of this story at Slashdot.

A legal feud between the co-founders of Lux Optics, the developer behind the Halide camera app, revealed that Apple was close to acquiring the company. As first reported by The Information, Apple held acquisition talks for Lux Optics, which also developed the Kino, Spectre and Orion apps, in the summer of 2025.

According to The Information, the deal eventually fell through in September of that year, but the potential acquisition could’ve provided Apple with the third-party software to improve its own built-in camera app. Apple is already rumored to be introducing variable aperture to its upcoming iPhone 18 Pro models, so it’s not surprising that the iPhone maker was looking for software with advanced features to match its possibly upgraded camera hardware.

Despite Apple’s interest, Lux Optics’ co-founders, Ben Sandofsky and Sebastiaan de With concluded that future updates to Halide could increase the company’s valuation and ended the acquisition talks. According to the lawsuit between the co-founders, Sandofsky started investigating de With for the alleged misuse of company funds shortly after the talks with Apple ended. Afterwards, de With was fired from Lux Optics and later joined Apple’s design team. While Halide may remain third-party software for iPhones and iPads, users can still look forward to some software improvements to the built-in camera app, since that’s reportedly one of Apple’s priorities.

This article originally appeared on Engadget at https://www.engadget.com/apps/apple-considered-buying-halide-to-upgrade-its-native-camera-app-175139818.html?src=rss