On Cloudflare’s blog, a senior research engineer shares a plan for “improving the trustworthiness of JavaScript on the web.”

“It is as true today as it was in 2011 that Javascript cryptography is Considered Harmful.”

The main problem is code distribution. Consider an end-to-end-encrypted messaging web application. The application generates cryptographic keys in the client’s browser that lets users view and send end-to-end encrypted messages to each other. If the application is compromised, what would stop the malicious actor from simply modifying their Javascript to exfiltrate messages? It is interesting to note that smartphone apps don’t have this issue. This is because app stores do a lot of heavy lifting to provide security for the app ecosystem. Specifically, they provide integrity, ensuring that apps being delivered are not tampered with, consistency, ensuring all users get the same app, and transparency, ensuring that the record of versions of an app is truthful and publicly visible.

It would be nice if we could get these properties for our end-to-end encrypted web application, and the web as a whole, without requiring a single central authority like an app store.
Further, such a system would benefit all in-browser uses of cryptography, not just end-to-end-encrypted apps. For example, many web-based confidential LLMs, cryptocurrency wallets, and voting systems use in-browser Javascript cryptography for the last step of their verification chains. In this post, we will provide an early look at such a system, called Web Application Integrity, Consistency, and Transparency (WAICT) that we have helped author. WAICT is a W3C-backed effort among browser vendors, cloud providers, and encrypted communication developers to bring stronger security guarantees to the entire web… We hope to build even wider consensus on the solution design in the near future….

We would like to have a way of enforcing integrity on an entire site, i.e., every asset under a domain. For this, WAICT defines an integrity manifest, a configuration file that websites can provide to clients. One important item in the manifest is the asset hashes dictionary, mapping a hash belonging to an asset that the browser might load from that domain, to the path of that asset.

The blog post points out that the WEBCAT protocol (created by the Freedom of Press Foundation) “allows site owners to announce the identities of the developers that have signed the site’s integrity manifest, i.e., have signed all the code and other assets that the site is serving to the user… We’ve made WAICT extensible enough to fit WEBCAT inside and benefit from the transparency components.” The proposal also envisions a service storing metadata for transparency-enabled sites on the web (along with “witnesses” who verify the prefix tree holding the hashes for domain manifests).

“We are still very early in the standardization process,” with hopes to soon “begin standardizing the integrity manifest format. And then after that we can start standardizing all the other features. We intend to work on this specification hand-in-hand with browsers and the IETF, and we hope to have some exciting betas soon. In the meantime, you can follow along with our transparency specification draft,/A>, check out the open problems, and share your ideas.”

Read more of this story at Slashdot.

“My boss thinks AI will solve every problem and is wildly enthusiastic about it,” complains a mid-level worker at a Fortune 500 company, who considers the technology “unproven and wildly erratic.”

So how should they navigate the next 10 years until retirement, they ask the Washington Post’s “Work Advice” columnist. The columnist first notes that “Despite promises that AI will eliminate tedious, ‘low-value’ tasks from our workload, many consumers and companies seem to be using it primarily as a cheap shortcut to avoid hiring professional actors, writers or artists — whose work, in some cases, was stolen to train the tools usurping them…”

Kevin Cantera, a reader from Las Cruces, New Mexico [a writer for an education-tech compay], willingly embraced AI for work. But as it turns out, he was training his replacement… Even without the “AI will take our jobs” specter, there’s much to be wary of in the AI hype. Faster isn’t always better. Parroting and predicting linguistic patterns isn’t the same as creativity and innovation… There are concerns about hallucinations, faulty data models, and intentional misuse for purposes of deception. And that’s not even addressing the environmental impact of all the power- and water-hogging data centers needed to support this innovation.

And yet, it seems, resistance may be futile. The AI genie is out of the bottle and granting wishes. And at the rate it’s evolving, you won’t have 10 years to weigh the merits and get comfortable with it. Even if you move on to another workplace, odds are AI will show up there before long. Speaking as one grumpy old Luddite to another, it might be time to get a little curious about this technology just so you can separate helpfulness from hype.

It might help to think of AI as just another software tool that you have to get familiar with to do your job. Learn what it’s good for — and what it’s bad at — so you can recommend guidelines for ethical and beneficial use. Learn how to word your wishes to get accurate results. Become the “human in the loop” managing the virtual intern. You can test the bathwater without drinking it. Focus on the little ways AI can accommodate and support you and your colleagues. Maybe it could handle small tasks in your workflow that you wish you could hand off to an assistant. Automated transcriptions and meeting notes could be a life-changer for a colleague with auditory processing issues.
I can’t guarantee that dabbling in AI will protect your job. But refusing to engage definitely won’t help. And if you decide it’s time to change jobs, having some extra AI knowledge and experience under your belt will make you a more attractive candidate, even if you never end up having to use it.

Read more of this story at Slashdot.

Cory Doctorow has always warned that companies “enshittify” their services — shifting “as much as they can from users, workers, suppliers, and business customers to themselves.” But this week Doctorow writes in Communications of the ACM that enshittification “would be much, much worse if not for tech workers,” who have “the power to tell their bosses to go to hell…”

When your skills are in such high demand that you can quit your job, walk across the street, and get a better one later that same day, your boss has a real incentive to make you feel like you are their social equal, empowered to say and do whatever feels technically right… The per-worker revenue for successful tech companies is unfathomable — tens or even hundreds of times their wages and stock compensation packages.

“No wonder tech bosses are so excited about AI coding tools,” Doctorow adds, “which promise to turn skilled programmers from creative problem-solvers to mere code reviewers for AI as it produces tech debt at scale. Code reviewers never tell their bosses to go to hell, and they are a lot easier to replace.”

So how should tech workers respond in a world where tech workers are now “as disposable as Amazon warehouse workers and drivers…?”

Throughout the entire history of human civilization, there has only ever been one way to guarantee fair wages and decent conditions for workers: unions. Even non-union workers benefit from unions, because strong unions are the force that causes labor protection laws to be passed, which protect all workers. Tech workers have historically been monumentally uninterested in unionization, and it’s not hard to see why. Why go to all those meetings and pay those dues when you could tell your boss to go to hell on Tuesday and have a new job by Wednesday? That’s not the case anymore. It will likely never be the case again.

Interest in tech unions is at an all-time high. Groups such as Tech Solidarity and the Tech Workers Coalition are doing a land-office business, and copies of Ethan Marcotte’s You Deserve a Tech Union are flying off the shelves. Now is the time to get organized. Your boss has made it clear how you’d be treated if they had their way. They’re about to get it.

Thanks to long-time Slashdot reader theodp for sharing the article.

Read more of this story at Slashdot.

Links have proven to be a tricky thing when it comes to social media engagement. On platforms like Threads, data suggests that people often don’t click the links in posts, and creators on X have complained that posts including links don’t get as much visibility. X is now trying to solve that. Head of product Nikita Bier shared that the platform is “testing a new link experience” that lets people open a link without leaving the original post entirely, so they can still view the Like, Repost and other buttons. The test is rolling out to iOS users first.  

“To help get better signal, posts will now collapse to the bottom of the page so people can react while you’re reading,” Bier wrote alongside a screen recording of how it will work. As to why posts with links typically don’t perform as well, Bier said, “This is because the web browser covers the post and people forget to Like or Reply. So X doesn’t get a clear signal whether the content is any good.” 

Of course, X has been accused of throttling links to specific sites, and Elon Musk has said in the past that links “don’t get as much attention” on the platform, so tweaking the popups will only go so far in addressing the reach issue. Bier added that posts should always “stand alone as great content so write a solid caption.”

This article originally appeared on Engadget at https://www.engadget.com/x-is-testing-a-new-way-of-opening-links-in-posts-to-improve-engagement-211210520.html?src=rss

Slashdot reader BrianFagioli writes: GIMP has officially launched its own Snap package for Linux, finally taking over from the community-maintained Snapcrafters project. The move means all future GIMP releases will now be built directly from the team’s CI pipeline, ensuring faster, more consistent updates across distributions. The developers also introduced a new “gimp-plugins” interface to support external plugins while maintaining Snap’s security confinement, with GMIC and OpenVINO already supported. This marks another major step in GIMP’s cross-platform packaging efforts, joining Flatpak and MSIX distribution options. The first officially maintained version, Version 3.0.6GIMP 3.0.6, is available now on the “latest/stable” Snap channel, with preview builds rolling out for testers.

Read more of this story at Slashdot.

As political tensions between the two global superpowers grow, China’s State Security Ministry accused the US’ National Security Agency of a cyberattack operation that took place between 2023 and 2024. As first reported by Reuters, the Chinese agency posted on WeChat that the NSA targeted the country’s National Time Service Center. As part of the Chinese Academy of Sciences, the center is tasked with generating, maintaining and transmitting its national standard of time, which is provided to important sectors across the country, including communications, defense and finance.

The state ministry said the operation used around 42 types of “special cyberattack weapons” to infiltrate the National Time Service Center which could have led to the disruption of network communications, financial systems and power supply. The WeChat post also claimed that the NSA exploited vulnerabilities in a foreign mobile phone brand’s messaging system to steal sensitive info from staff devices, without naming the brand.

The NSA has yet to respond to the accusation. On the other hand, the US Treasury Department said it was targeted by a “China state-sponsored actor” in a December cyberattack.

This article originally appeared on Engadget at https://www.engadget.com/cybersecurity/china-claims-the-nsa-conducted-cyberattacks-on-its-national-time-center-201852066.html?src=rss

We still have a few months to wait before the next Cult of the Lamb DLC, Woolhaven, arrives, but the Massive Monster team just shared a closer look at one of the new experiences the expansion will bring and, oh boy, I cannot wait to play this. In addition to adding a new mountain area with two new dungeons, Woolhaven will introduce ranching, so you can raise animals — the regular, non-anthropomorphic kind — to keep as pets, shear for wool or slaughter for meat (you know, if you have no heart).

Based on the overview video, we’ll get to raise cows(ish), goats and sheep as well as some more unexpected critters like crabs, snails, spiders and turtles. I, personally, am very excited about the snails. You’ll be able to form bonds with and name the animals, and you’ll have to tend to their wellbeing, feeding them healthy foods and cleaning them. Followers will also be able to bond with the animals and have their own pets. As wholesome as that all sounds, this is Cult of the Lamb we’re talking about, so I’m already bracing myself for the inevitable heartbreak of when some unruly follower kills my favorite animals at some point. The video notes that you’ll have to keep them safe from predators.

Woolhaven will be a paid expansion, but we don’t know yet how much it will cost or when exactly it drops. The team has so far only said early 2026.

This article originally appeared on Engadget at https://www.engadget.com/this-is-how-the-new-ranching-system-will-work-in-cult-of-the-lamb-woolhaven-194324041.html?src=rss

“This is an attempt to stop Waymo cars from driving into the dead end,” complains a home-made sign in San Francisco, “where they are forced to reverse and adversely affect the lives of the residents.”

On an orange traffic post, the home-made sign declares “NO WAYMO – 8:00 p.m. to 8:00 a.m,” with an explanation for the rest of the neighborhood. âoeWaymo comes at all hours of the night and up to 7 times per hour with flashing lights and screaming reverse sounds, waking people up and destroying the quality of life.â

SFGate reports that 1,400 people on Reddit upvoted a photo of the sign’s text:

It delves into the bureaucratic mess â” multiple requests to Waymo, conversations with engineers, and 311 [municipal services] tickets, which had all apparently gone ignored â” before finally providing instructions for human drivers. âoePlease move [the cones] back after you have entered so we can continue to try to block the Waymo cars from entering and disrupting the lives of residents.â

This isnâ(TM)t the first time Waymoâ(TM)s autonomous vehicles have disrupted San Francisco residentsâ(TM) peace. Last year, a fleet of the robotaxis created another sleepless fiasco in the cityâ(TM)s SoMa neighborhood, honking at each other for hours throughout the night for two and a half weeks.

Other on Reddit shared the concern. “I live at an dead end street in Noe Valley, and these Waymos always stuck there,” another commenter posted. “It’s been bad for more than a year,” agreed another comment. “People on the Internet think you’re just a hater but it’s a real issue with Waymos.”

On Thursday “the sign remained at the corner of Lake Street and Second Avenue,” notes SFGate. And yet “something appeared to have shifted. “Waymo vehicles werenâ(TM)t allowing drop-offs or pickups on the street, though whether this was due to the home-printed plea, the cone blockage, or simply updating routes remains unclear.”

Read more of this story at Slashdot.

The National Transportation Safety Board confirmed Sunday that it is investigating an airliner that was struck by an object in its windscreen, mid-flight, over Utah.

“NTSB gathering radar, weather, flight recorder data,” the federal agency said on the social media site X. “Windscreen being sent to NTSB laboratories for examination.”

The strike occurred Thursday, during a United Airlines flight from Denver to Los Angeles. Images shared on social media showed that one of the two large windows at the front of a 737 MAX aircraft was significantly cracked. Related images also reveal a pilot’s arm that has been cut multiple times by what appear to be small shards of glass.

Read full article

Comments

Violent video games have found themselves in the crosshairs of politicians yet again, but this time with Mexico’s government. Earlier this week, Mexico’s Chamber of Deputies approved a comprehensive financial package that includes an eight percent tax on video games with mature content. As first reported by Insider Gaming, the proposed tax covers games that have a C or D rating under Mexico’s video game age classification system, which is similar to ESRB in the US. The C rating is for players who are at least 18 years old and allows for extreme violence, bloodshed and moderate graphic sexual content, while the D rating is reserved for adults only and allows for prolonged scenes that include similar content.

The proposed law was first introduced in September, when the country’s Treasury Department claimed that “recent studies have found a relationship between the use of violent video games and higher levels of aggression among adolescents, as well as negative social and psychological effects such as isolation and anxiety.” The report cited a study from 2012 in a footnote, which also observed some positive associations with video games, including motor learning and building resilience.

The current interpretation of the proposal that’s been approved by the Chamber of Deputies would apply to digital and physical copies of affected games, as well as any in-game purchases or microtransactions. The proposal still has to go through Mexico’s other congressional chamber, the Senate, where it will be debated before a November 15 deadline to submit a budget proposal.

This article originally appeared on Engadget at https://www.engadget.com/gaming/mexico-is-considering-slapping-an-eight-percent-tax-on-violent-video-games-184101628.html?src=rss

An anonymous reader shared this report from Cryptonews:

Sony has taken Wall Street by surprise after its banking division, Sony Bank, filed an application with the U.S. Office of the Comptroller of the Currency (OCC) to establish a national crypto bank under its subsidiary “Connectia Trust.” The move positions the Japanese tech giant to become one of the first major global corporations to issue a U.S. dollar-backed stablecoin through a federally regulated institution. The application outlines plans to issue a U.S. dollar-pegged stablecoin, maintain the reserve assets backing it, and provide digital asset custody and management services.

The filing places Sony alongside an elite list of firms, including Coinbase, Circle, Paxos, Stripe, and Ripple, currently awaiting OCC approval to operate as national digital banks. If approved, Sony would become the first major global technology company to receive a U.S. bank charter specifically tied to stablecoin issuance….

The Office of the Comptroller of the Currency “has received over 15 applications from fintech and crypto entities seeking trust charters,” according to the article, calling it “a sign of renewed regulatory openness” under the office’s new chief, a former blockchain executive.

Meanwhile, the United States has also “conditionally given the nod to a new cryptocurrency-focused national bank launched by California tech billionaire Palmer Luckey,” reports SFGate:

To bring the bank to life, Luckey joined forces with JoeLonsdale, co-founder of Palantir and venture firm 8VC, and financial backer and fellow Palantir co-founder Peter Thiel, according to the Financial Times. Luckey conceived the idea for Erebor following the collapse of the Silicon Valley Bank in 2023, the Financial Times reported. The bank’s name draws inspiration from J.R.R. Tolkien’s “The Hobbit,” referring to another name for the Lonely Mountain in the novel…

The OCC said it applied the “same rigorous review and standards” used in all charter applications. The [“preliminary”] approval was granted in just four months; however, compliance and security checks are expected to take several more months before the new bank can open.

“I am committed to a dynamic and diverse federal banking system,” America’s Comptroller of the Currency said Wednesday, “and our decision today is a first but important step in living up to that commitment.”

“Permissible digital asset activities, like any other legally permissible banking activity, have a place in the federal banking system if conducted in a safe and sound manner. The OCC will continue to provide a path for innovative approaches to financial services to ensure a strong, diverse financial system that remains relevant over time.”

Read more of this story at Slashdot.

Nearly four years after the release of Halo: Infinite, the sixth installment in the franchise has failed to live up to its name. Instead, the studio behind the sci-fi series may be working on a “live service, long-term updating multiplayer” Halo game that could do just that. According to YouTuber Rebs Gaming, a source claimed that Halo Studios, previously known as 343 Industries, is working on a multiplayer Halo title that could borrow Fortnite‘s model of constantly pushing out content updates. The report also noted that there aren’t any mentions of Fortnite‘s battle royale style for the upcoming game.

While live service games are becoming the norm, veterans of the Halo franchise may not have much faith in Halo Studios after failing to deliver on Halo: Infinite‘s longevity. Back in March, another report revealed that Halo: Infinite was meant to be supported with a 10-year plan of consistent updates, but this roadmap was scrapped following leadership issues and a switch to Unreal Engine. While Halo: Infinite‘s multiplayer mode has received notable updates since its initial release, the game still sits at a Mixed rating on Steam.

Along with this upcoming live service Halo title, the report claimed that the studio is working on a remake of the first game in the series, Halo: Combat Evolved. According to John Junyszek, the senior community manager at Halo Studios, we could hear more about either project during the Halo World Championship that takes place from October 24 to 26.

This article originally appeared on Engadget at https://www.engadget.com/gaming/xbox/the-next-game-in-the-halo-franchise-could-be-live-service-multiplayer-171036206.html?src=rss

“Eleven days ago, the nonprofit entity that develops the protocol, Signal Messenger LLC, published a 5,900-word write-up describing its latest updates that bring Signal a significant step toward being fully quantum-resistant,” writes Ars Technica:

The mechanism that has made this constant key evolution possible over the past decade is what protocol developers call a “double ratchet.” Just as a traditional ratchet allows a gear to rotate in one direction but not in the other, the Signal ratchets allow messaging parties to create new keys based on a combination of preceding and newly agreed-upon secrets. The ratchets work in a single direction, the sending and receiving of future messages. Even if an adversary compromises a newly created secret, messages encrypted using older secrets can’t be decrypted… [Signal developers describe a “ping-pong” behavior as parties take turns replacing ratchet key pairs one at a time.] Even though the ping-ponging keys are vulnerable to future quantum attacks, they are broadly believed to be secure against today’s attacks from classical computers.

The Signal Protocol developers didn’t want to remove them or the battle-tested code that produces them. That led to their decision to add quantum resistance by adding a third ratchet. This one uses a quantum-safe Key-Encapsulation Mechanism (KEM) to produce new secrets much like the Diffie-Hellman ratchet did before, ensuring quantum-safe, post-compromise security… The technical challenges were anything but easy. Elliptic curve keys generated in the X25519 implementation are about 32 bytes long, small enough to be added to each message without creating a burden on already constrained bandwidths or computing resources. A ML-KEM 768 key, by contrast, is 1,000 bytes. Additionally, Signal’s design requires sending both an encryption key and a ciphertext, making the total size 2,272 bytes… To manage the asynchrony challenges, the developers turned to “erasure codes,” a method of breaking up larger data into smaller pieces such that the original can be reconstructed using any sufficiently sized subset of chunks…

The Signal engineers have given this third ratchet the formal name: Sparse Post Quantum Ratchet, or SPQR for short. The third ratchet was designed in collaboration with PQShield, AIST, and New York University. The developers presented the erasure-code-based chunking and the high-level Triple Ratchet design at the Eurocrypt 2025 conference. Outside researchers are applauding the work. “If the normal encrypted messages we use are cats, then post-quantum ciphertexts are elephants,” Matt Green, a cryptography expert at Johns Hopkins University, wrote in an interview. “So the problem here is to sneak an elephant through a tunnel designed for cats. And that’s an amazing engineering achievement. But it also makes me wish we didn’t have to deal with elephants.”

Thanks to long-time Slashdot reader mspohr for sharing the article.

Read more of this story at Slashdot.

Long-time Slashdot reader Bruce66423 shared this article from the Los Angeles Times:

Scientists have increasingly observed how the rupturing of a fault during an earthquake can be even faster than the speed of another type of damaging seismic wave, theoretically generating energy on the level of a sonic boom. These shock waves — created during “supershear” earthquakes — can worsen how bad the ground shakes both side to side and up and down along an affected fault area, scientists at USC, Caltech and the University of Illinois Urbana-Champaign wrote in a recent opinion article for the journal Seismological Research Letters. Although not everyone agrees that supershear earthquakes are inherently more destructive than other types, the potential implications are massive and need to be accounted for in seismic forecasts, the scientists contend… In just the last 15 years, 14 of 39 large strike-slip earthquakes have exhibited features of supershear ruptures, the opinion article said….

In California, supershear earthquakes would be expected on the straightest of “strike-slip” faults — in which one block of earth slides past another — like the San Andreas… There are a number of communities directly on top of the San Andreas fault. Among them are Coachella, Indio, Cathedral City, Palm Springs, Desert Hot Springs, Banning, Yucaipa, Highland, San Bernardino, Wrightwood, Palmdale, Gorman, Frazier Park, San Juan Bautista, Palo Alto, Portola Valley, Woodside, San Bruno, South San Francisco, Pacifica, Daly City and Bodega Bay.

One earthquake scientist suggests building codes need to be more strict, according to the article.

But it also cites a U.S. Geological Survey research geophysicist who isn’t convinced by the new opinion article. “I don’t think we know yet whether supershear ruptures really are more destructive.”

Read more of this story at Slashdot.

“Microsoft does everything in its power to keep Windows users under its control,” warns the Free Software Foundation in a new blog post this week.

They argue that the lack of freedom that comes with proprietary code “forces users to surrender to decisions made by Microsoft to maximize its profits and further lock users into its product ecosystem” — describing both the problem and one possible solution:

[IT management company Lansweeper] found that of the 30 million enterprise systems they manage, over 40% are incompatible with Windows 11. This is due to the hardware requirements like Treacherous Platform Module version 2.0 — a proprietary chip that uses cryptography that users can’t influence or audit to restrict their control over the system.
The end of Windows 10 support is the perfect opportunity to break free from this cycle and switch to GNU/Linux operating system (GNU/Linux OS), a system that respects your freedom…

The endless, freedom-restricting cycle of planned obsolescence is not inevitable. Instead of paying Microsoft for continued updates or buying new hardware, Windows users left behind by Microsoft should install GNU/Linux. Free Software Foundation certified GNU/Linux distributions respect the user’s freedom to run their computer as they wish, to study and modify its source code, and to redistribute copies. They don’t require update contracts, often run faster on older hardware, and, most importantly, put you in control.

“If you’re already a GNU/Linux user, you have an important role to play. Help your friends and family make the switch by sharing your knowledge, help them install a free-as-in-freedom OS. Show them what it means to have real control over their computing!”

Read more of this story at Slashdot.

Techtober is a busy time for our reviews team as a deluge of new devices arrive before the holiday season. We’ve been hard at work conducting our in-depth testing, but it’s understandable if you missed a review or two over the last few weeks. Read on to catch up all the reviews you might’ve missed, including the latest trio of Google Pixel devices.

Google Pixel 10 Pro Fold, Pixel Watch 4 and Pixel Buds 2a

Earlier this month, a trio of new Pixel devices arrived for us to put through their paces. The Pixel 10 Pro Fold headlines the group, but the Pixel Watch 4 and Pixel Buds 2a are also highly capable devices in their own categories. Senior reviews writer Sam Rutherford wrote that Google has removed one of the last remaining issues with foldable phones: durability. “The addition of proper dust and water resistance on the Pixel 10 Pro Fold has removed one of the last two shortcomings of modern foldables, which is no mean feat,” he said. However, at $1,799, the price barrier is still hard to overcome for most folks.”

Meta Ray-Ban Display

The second-gen Meta Ray-Ban smart glasses may be the best option for most people right now, but the Meta Ray-Ban Display is the more exciting product for many. If you can get past the chunky look and in-progress features, you still have to contend with limited availability and a $800 price tag. “The Meta Ray-Ban Display glasses, on the other hand, still look very much like a first-gen product,” senior reporter Karissa Bell wrote. “There are some really compelling use cases for the display, but its functionality is limited.”

ASUS ROG Xbox Ally X

Microsoft’s collaboration with ASUS has produced a compelling gaming handheld that’s decidedly Xbox. The combination of familiar controls and a full-screen Xbox experience give this device an advantage over its Windows-based competition. “While Microsoft’s first real foray into PC gaming handhelds isn’t upending the status quo and it’s way too early to say if this gadget will save Xbox as a whole, it is bringing some notable advancements,” Sam said. “The new full-screen experience makes launching and playing games on Windows-based devices so much more seamless that it’s kind of wild it took so long to get here.”

Bose QuietComfort Headphones (2nd gen)

Bose never leave the top few spots on our best noise canceling headphones list, but its refresh of the QC Ultra Headphones put the company firmly back in first place. Updates to active noise cancellation, sound performance, battery life and power management are enough to recommend this model over the previous version and the Sony WH-1000XM6. “Similar to the second-gen QC Ultra Earbuds over the summer, Bose didn’t make huge upgrades for the updated version of the QC Ultra Headphones,” I explained. “But what you do get here is a decent improvement over its predecessor.”

Razer Blade 18 (2025)

Razer’s massive 18-inch gaming laptop has impressive performance, but it’s size and limited battery life don’t offer a lot of convenience. “Personally, if I had to choose between Razer’s current lineup, I’d go with the Blade 16 so that I could actually carry it around and occasionally use it as a productivity machine,” senior reviews editor Devindra Hardawar wrote. “Not so with the Blade 18 — its short two hour and 17 minute battery life (in PCMark 10’s battery benchmark) means you’ll always need to lug around its beefy power adapter.”

This article originally appeared on Engadget at https://www.engadget.com/engadget-review-recap-new-pixel-devices-meta-ray-ban-display-asus-rog-xbox-ally-x-and-more-130000215.html?src=rss

Microsoft said in a blog post this week that “over half of cyberattacks with known motives were driven by extortion or ransomware… while attacks focused solely on espionage made up just 4%.”

And Microsoft’s annual digital threats report found operations expanding even more through AI, with cybercriminals “accelerating malware development and creating more realistic synthetic content, enhancing the efficiency of activities such as phishing and ransomware attacks.”

[L]egacy security measures are no longer enough; we need modern defenses leveraging AI and strong collaboration across industries and governments to keep pace with the threat…

Over the past year, both attackers and defenders harnessed the power of generative AI. Threat actors are using AI to boost their attacks by automating phishing, scaling social engineering, creating synthetic media, finding vulnerabilities faster, and creating malware that can adapt itself… For defenders, AI is also proving to be a valuable tool. Microsoft, for example, uses AI to spot threats, close detection gaps, catch phishing attempts, and protect vulnerable users. As both the risks and opportunities of AI rapidly evolve, organizations must prioritize securing their AI tools and training their teams…

Amid the growing sophistication of cyber threats, one statistic stands out: more than 97% of identity attacks are password attacks. In the first half of 2025 alone, identity-based attacks surged by 32%. That means the vast majority of malicious sign-in attempts an organization might receive are via large-scale password guessing attempts. Attackers get usernames and passwords (“credentials”) for these bulk attacks largely from credential leaks. However, credential leaks aren’t the only place where attackers can obtain credentials. This year, we saw a surge in the use of infostealer malware by cybercriminals…
Luckily, the solution to identity compromise is simple. The implementation of phishing-resistant multifactor authentication (MFA) can stop over 99% of this type of attack even if the attacker has the correct username and password combination.

“Security is not only a technical challenge but a governance imperative…” Microsoft adds in their blog post. “Governments must build frameworks that signal credible and proportionate consequences for malicious activity that violates international rules.” (The report also found that America is the #1 most-targeted country — and that many U.S. companies have outdated cyber defenses.)

But while “most of the immediate attacks organizations face today come from opportunistic criminals looking to make a profit,” Microsoft writes that nation-state threats “remain a serious and persistent threat.” More details from the Associated Press:

Russia, China, Iran and North Korea have sharply increased their use of artificial intelligence to deceive people online and mount cyberattacks against the United States, according to new research from Microsoft. This July, the company identified more than 200 instances of foreign adversaries using AI to create fake content online, more than double the number from July 2024 and more than ten times the number seen in 2023.

Examples of foreign espionage cited by the article:

China is continuing its broad push across industries to conduct espionage and steal sensitive data…
Iran is going after a wider range of targets than ever before, from the Middle East to North America, as part of broadening espionage operations..

“[O]utside of Ukraine, the top ten countries most affected by Russian cyber activity all belong to the North Atlantic Treaty Organization (NATO) — a 25% increase compared to last year.”
North Korea remains focused on revenue generation and espionage…

There was one especially worrying finding. The report found that critical public services are often targeted, partly because their tight budgets limit their incident response capabilities, “often resulting in outdated software…. Ransomware actors in particular focus on these critical sectors because of the targets’ limited options. For example, a hospital must quickly resolve its encrypted systems, or patients could die, potentially leaving no other recourse but to pay.”

Read more of this story at Slashdot.

The Guardian reports that atmospheric carbon dioxide “soared by a record amount in 2024 to hit another high, UN data shows.”
But what’s more troubling is why:

Several factors contributed to the leap in CO2, including another year of unrelenting fossil fuel burning despite a pledge by the world’s countries in 2023 to “transition away” from coal, oil and gas. Another factor was an upsurge in wildfires in conditions made hotter and drier by global heating. Wildfire emissions in the Americas reached historic levels in 2024, which was the hottest year yet recorded. However, scientists are concerned about a third factor: the possibility that the planet’s carbon sinks are beginning to fail. About half of all CO2 emissions every year are taken back out of the atmosphere by being dissolved in the ocean or being sucked up by growing trees and plants. But the oceans are getting hotter and can therefore absorb less CO2 while on land hotter and drier conditions and more wildfires mean less plant growth…

Atmospheric concentrations of methane and nitrous oxide — the second and third most important greenhouse gases related to human activities — also rose to record levels in 2024. About 40% of methane emissions come from natural sources. But scientists are concerned that global heating is leading to more methane production in wetlands, another potential feedback loop.

Thanks to long-time Slashdot reader mspohr for sharing the article.

Read more of this story at Slashdot.

An anonymous reader shared this report from Gizmodo:

It’s been over a year since OpenAI cofounder Andrej Karpathy exited the company. In the time since he’s been gone, he coined and popularized the term “vibe coding” to describe the practice of farming out coding projects to AI tools. But earlier this week, when he released his own open source model called nanochat, he admitted that he wrote the whole thing by hand, vibes be damned.
Nanochat, according to Karpathy, is a “minimal, from scratch, full-stack training/inference pipeline” that is designed to let anyone build a large language model with a ChatGPT-style chatbot interface in a matter of hours and for as little as $100. Karpathy said the project contains about 8,000 lines of “quite clean code,” which he wrote by hand — not necessarily by choice, but because he found AI tools couldn’t do what he needed.
“It’s basically entirely hand-written (with tab autocomplete),” he wrote. “I tried to use claude/codex agents a few times but they just didn’t work well enough at all and net unhelpful.”

Read more of this story at Slashdot.