An anonymous reader shared this report from security research Brian Krebs:
In the summer of 2022, KrebsOnSecurity documented the plight of several readers who had their accounts at big-three consumer credit reporting bureau Experian hijacked after identity thieves simply re-registered the accounts using a different email address. Sixteen months later, Experian clearly has not addressed this gaping lack of security. I know that because my account at Experian was recently hacked, and the only way I could recover access was by recreating the account…

The homepage said I needed to provide a Social Security number and mobile phone number, and that I’d soon receive a link that I should click to verify myself. The site claims that the phone number you provide will be used to help validate your identity. But it appears you could supply any phone number in the United States at this stage in the process, and Experian’s website would not balk.
One user said they recreated their account this week — even though the phone number they’d input was a random number. “The only difference: it asked me FIVE questions about my personal history (last time it only asked three) before proclaiming, ‘Welcome back, Pete!,’ and granting full access,” @PeteMayo wrote. “I feel silly saving my password for Experian; may as well just make a new account every time.”
And Krebs points out that “Regardless, users can simply skip this step by selecting the option to ‘Continue another way.'”
Experian then asks for your full name, address, date of birth, Social Security number, email address and chosen password. After that, they require you to successfully answer between three to five multiple-choice security questions whose answers are very often based on public records. When I recreated my account this week, only two of the five questions pertained to my real information, and both of those questions concerned street addresses we’ve previously lived at — information that is just a Google search away…

Experian will send a message to the old email address tied to the account, saying certain aspects of the user profile have changed. But this message isn’t a request seeking verification: It’s just a notification from Experian that the account’s user data has changed, and the original user is offered zero recourse here other than to a click a link to log in at Experian.com. And of course, a user who receives one of these notices will find that the credentials to their Experian account no longer work. Nor do their PIN or account recovery question, because those have been changed also. Your only option at this point is recreate your account at Experian and steal it back from the ID thieves!
Experian’s security measures “are constantly evolving,” insisted Experian spokesperson Scott Anderson — though Krebs remains unsatisfied.

Anderson said all consumers have the option to activate a multi-factor authentication method that’s requested each time they log in to their account. But what good is multi-factor authentication if someone can simply recreate your account with a new phone number and email address?

Read more of this story at Slashdot.

Source: Slashdot – It’s Still Too Easy for Anyone to ‘Become You’ at Experian

In Chrome, JavaScript (and WebAssembly) code are both executed by Google’s open source V8 engine — which already has garbage-collecting capabilities. “This means developers making use of, for example, PHP compiled to Wasm, end up shipping a garbage collector implementation of the ported language (PHP) to the browser that already has a garbage collector,” writes Google developer advocate Thomas Steiner, “which is as wasteful as it sounds.”

“This is where WasmGC comes in.”

WebAssembly Garbage Collection (or WasmGC) is a proposal of the WebAssembly Community Group [which] adds struct and array heap types, which means support for non-linear memory allocation… In simplified terms, this means that with WasmGC, porting a programming language to WebAssembly means the programming language’s garbage collector no longer needs to be part of the port, but instead the existing garbage collector can be used.
Sometime on Halloween, Steiner wrote that in Chrome, WebAssembly garbage collection is now enabled by default. But then he explored what this means for high-level programming languages (with their own built-in garbage collection) being compiled into WebAssembly:

To verify the real-world impact of this improvement, Chrome’s Wasm team has compiled versions of the Fannkuch benchmark (which allocates data structures as it works) from C, Rust, and Java. The C and Rust binaries could be anywhere from 6.1 K to 9.6 K depending on the various compiler flags, while the Java version is much smaller at only 2.3 K! C and Rust do not include a garbage collector, but they do still bundle malloc/free to manage memory, and the reason Java is smaller here is because it doesn’t need to bundle any memory management code at all. This is just one specific example, but it shows that WasmGC binaries have the potential of being very small, and this is even before any significant work on optimizing for size.

The blog post includes two examples of WasmGC-ported programming languages in action:

“One of the first programming languages that has been ported to Wasm thanks to WasmGC is Kotlin in the form of Kotlin/Wasm.”
“The Dart and Flutter teams at Google are also preparing support for WasmGC. The Dart-to-Wasm compilation work is almost complete, and the team is working on tooling support for delivering Flutter web applications compiled to WebAssembly.”

Read more of this story at Slashdot.

Source: Slashdot – Why Chrome Enabled WebAssembly Garbage Collection (WasmGC) By Default

This week GitHub announced the approaching general availability of the GPT-4-powered GitHub Copilot Chat in December “as part of your existing GitHub Copilot subscription” (and “available at no cost to verified teachers, students, and maintainers of popular open source projects.”)

And this “code-aware guidance and code generation” will also be integrated directly into github.com, “so developers can dig into code, pull requests, documentation, and general coding questions with Copilot Chat providing suggestions, summaries, analysis, and answers.”

With GitHub Copilot Chat we’re enabling the rise of natural language as the new universal programming language for every developer on the planet. Whether it’s finding an error, writing unit tests, or helping debug code, Copilot Chat is your AI companion through it all, allowing you to write and understand code using whatever language you speak…

Copilot Chat uses your code as context, and is able to explain complex concepts, suggest code based on your open files and windows, help detect security vulnerabilities, and help with finding and fixing errors in code, terminal, and debugger…
With the new inline Copilot Chat, developers can chat about specific lines of code, directly within the flow of their code and editor.

InfoWorld notes it will chat in “whatever language a developer speaks.” (And that Copilot Chat will also be available in GitHub’s mobile app.) But why wait until December? GitHub’s blog post says that Copilot Chat “will come to the JetBrains suite of IDEs, available in preview today.”

GitHub also plans to introduce “slash commands and context variables” for GitHub Copilot, “so fixing or improving code is as simple as entering /fix and generating tests now starts with /tests.”

“With Copilot in the code editor, in the CLI, and now Copilot Chat on github.com and in our mobile app, we are making Copilot ubiquitous throughout the software development lifecycle and always available in all of GitHub’s surface areas…”

CNBC adds that “Microsoft-owned GitHub” also plans to introduce “a more expensive Copilot assistant” in February “for developers inside companies that can explain and provide recommendations about internal source code.”
Wednesday’s blog post announcing these updates was written by GitHub’s CEO, who seemed to be predicting an evolutionary leap into a new future. “Just as GitHub was founded on Git, today we are re-founded on Copilot.” He promised they’d built on their vision of a future “where AI infuses every step of the developer lifecycle.”
Open source and Git have fundamentally transformed how we build software. It is now evident that AI is ushering in the same sweeping change, and at an exponential pace… We are certain this foundational transformation of the GitHub platform, and categorically new way of software development, is necessary in a world dependent on software. Every day, the world’s developers balance an unsustainable demand to both modernize the legacy code of yesterday and build our digital tomorrow. It is our guiding conviction to make it easier for developers to do it all, from the creative spark to the commit, pull request, code review, and deploy — and to do it all with GitHub Copilot deeply integrated into the developer experience.
And if you’re worried about the security of AI-generated code…

Today, GitHub Copilot applies an LLM-based vulnerability prevention system that blocks insecure coding patterns in real-time to make GitHub Copilot’s suggestions more secure. Our model targets the most common vulnerable coding patterns, including hardcoded credentials, SQL injections, and path injections. GitHub Copilot Chat can also help identify security vulnerabilities in the IDE, explain the mechanics of a vulnerability with its natural language capabilities, and suggest a specific fix for the highlighted code.
But for Enterprise accounts paying for GitHub Advanced Security, there’s also an upgrade coming: “new AI-powered application security testing features designed to detect and remediate vulnerabilities and secrets in your code.” (It’s already available in preview mode.)

GitHub even announced plans for a new AI assistant in 2024 that generates a step-by-step plan for responding to GitHub issues. (GitHub describes it as “like a pair programming session with a partner that knows about every inch of the project, and can follow your lead to make repository-wide changes from the issue to the pull request with the power of AI.”)

CNBC notes that AI-powered coding assistants “are still nascent, though, with less than 10% enterprise adoption, according to Gartner, a technology industry research firm.”

But last month Microsoft CEO Satya Nadella told analysts GitHub Copilot already had one million paying users…
And GitHub’s blog post concludes, “And we’re just getting started.”

Read more of this story at Slashdot.

Source: Slashdot – GitHub Announces Its ‘Refounding’ on Copilot, Including an AI-Powered ‘Copilot Chat’ Assistant

“Dealers don’t want to change the model. They want to be the gatekeepers.” That’s according to Daniel Crane, a law professor at the University of Michigan who studies the laws and economics of car dealerships. He’s quoted in a Washington Post article warning that “Electric vehicles are hitting a road block: Car dealers.”

Former Chevy salesman Buzz Smith tells the Post that it can take longer to sell electric cars (with multiple visits and questions about their technology and chargers) — in effect reducing what a salesman earns per hour. But more to the point, “he believes the pay structure of auto salespeople isn’t a good fit for the EV era.”
Electric cars have narrower profit margins, he said, which cuts into the commission a dealer can get. And if a customer returns to the dealership multiple times, salespeople may have to split the commission, again cutting into their take-home pay. At the same time, car dealerships make most of their overall profits from providing service for vehicles — not selling new cars. According to an analysis from the U.S. Bureau of Labor Statistics, just 16 percent of dealers’ gross profits came from new car sales, while 43 percent came from parts, labor and service. (The rest of the profits come from used car sales and financing and incentives…)

That could also discourage dealers from selling EVs. Gas cars have 100 times more moving parts than electric vehicles do, and studies show that EVs have lower maintenance costs. An average gas-powered car, for example, needs an oil change about every six months, or every 5,000 to 7,500 miles. But many electric cars don’t require a major service until around 150,000 miles.

“They’re all terrified of that loss of maintenance,” Smith said.
The Post reports one woman’s complain that after buying an electric car, her salesperson “offered her a plan for oil changes and an extended warranty for a gas-powered car.”
But is there something bigger going on? Since the 1950s dozens of states passed laws protecting auto dealerships, and many of those laws prevent manufacturers from selling directly to consumers. The Post notes that now “many automakers have to sell their vehicles through one of the country’s more than 16,000 franchised auto dealerships. And those salespeople often don’t have extensive training on how to sell an EV or even on the technology itself.”
Frustrated customers told The Washington Post that dealers tried to redirect their attention toward gas cars, or gave incorrect or unclear answers to questions about charging and day-to-day electric vehicle use… Then there is the maze of federal and state tax incentives that can help drivers afford a new or used EV — but only if the dealer and the consumer can understand how they work.

Some dealers, however, don’t seem to want to offer electric cars: According to a survey that the Sierra Club conducted at the end of 2022, 66 percent of dealerships did not have an EV available for sale. That was at the height of EV supply chain problems, but 45 percent of those dealers — or 30 percent of all dealers surveyed — said they wouldn’t offer an EV even if they could. Amid concern over an EV slowdown, electric cars are sitting longer on dealerships’ lots than gas-powered cars. According to data from Cox Automotive, dealerships started the year with a roughly 50 days’ supply of gas cars and electric cars. Now the supply of gas cars is around the same, but the supply of EVs has doubled.

Read more of this story at Slashdot.

Source: Slashdot – Are Car Dealers Slowing the Adoption of Electric Vehicles?

A a report from TechSpot says AMD has recently increased its market share in the CPU sector for desktops, laptops, and servers:

According to Mercury Research (via Tom’s Hardware), AMD gained 5.8% unit share in desktops, 3.8% in laptops, and 5.8% in servers. In terms of revenue share, Team Red gained 4.1% in desktops, 5.1% in laptops, and 1.7% in servers. The report does not mention competitors by name, but the global PC industry only has one other major CPU supplier, Intel, which has a major stake in all the market segments.

While Intel and AMD make x86 processors for PCs, Qualcomm offers Arm-based SoCs for Windows notebooks, but its market share is minuscule by comparison. So, while the report doesn’t say anything about the market share of Intel or Qualcomm, it is fair to assume that most of AMD’s gains came at Intel’s expense.

Thanks to Slashdot reader jjslash for sharing the news.

Read more of this story at Slashdot.

Source: Slashdot – Gaining on Intel? AMD Increases CPU Market Share In Desktops, Laptops, and Servers

From AaronSwartzDay.com:

Aaron Swartz Day was founded, in 2013, after the death of Aaron Swartz, with these combined goals:

To draw attention to what happened to Aaron, in the hopes of stopping it from happening to anyone else.
– This includes clarifying that, although Aaron was a hacker, he didn’t hack MIT.

To provide a yearly showcase of many of the projects that were started by Aaron before his death.
– SecureDrop
– Open Library

To provide a yearly showcase of new projects that were directly inspired by Aaron and his work.

A few Aaron-inspired examples from this year’s event include:

– The Pursuance Project (by Barrett Brown & Steve Phillips)
– Open Archive (by Natalie Cadranel)
– Jason Leopold’s Freedom of Information Act Request (FOIA) activism (article from 2013)

Happening right now is a livestream from 11 a.m. to 6:30 p.m. PST of “intimate virtual talks,” including a special presentation by members of Brazil’s Aaron Swartz Institute starting in just a few minutes. You can also playback video for talks that happened earlier today.

Other speakers include:

Scifi novelist/technology activist Cory Doctorow (11 a.m.)Signal user support engineer/project manager Riya Abraham (11:30 a.m.)EFF executive director Cindy Cohn (12)EFF Certbot director of engineering Alexis Hancock (12:20)Internet Archive’s Brewster Kahle (12:40)Anaconda CEO Peter Wang (1)The Freedom of the Press Foundation’s Kevin O’Gorman (speaking on SecureDrop at 1:30)

Read more of this story at Slashdot.

Source: Slashdot – EFF, Cory Doctorow, Others Speak in Commemoration of Aaron Swartz Day

With 1.4 billion people, India is the second most-populous country in the world.

But a new article in the Washington Post alleges that India has “set a global standard for online censorship.”

For years, a committee of executives from U.S. technology companies and Indian officials convened every two weeks in a government office to negotiate what could — and could not — be said on Twitter, Facebook and YouTube. At the “69A meetings,” as the secretive gatherings were informally called, officials from India’s information, technology, security and intelligence agencies presented social media posts they wanted removed, citing threats to India’s sovereignty and national security, executives and officials who were present recalled. The tech representatives sometimes pushed back in the name of free speech…

But two years ago, these interactions took a fateful turn. Where officials had once asked for a handful of tweets to be removed at each meeting, they now insisted that entire accounts be taken down, and numbers were running in the hundreds. Executives who refused the government’s demands could now be jailed, their companies expelled from the Indian market. New regulations had been adopted that year to hold tech employees in India criminally liable for failing to comply with takedown requests, a provision that executives referred to as a “hostage provision.” After authorities dispatched anti-terrorism police to Twitter’s New Delhi office, Twitter whisked its top India executive out of the country, fearing his arrest, former company employees recounted.

Indian officials say they have accomplished something long overdue: strengthening national laws to bring disobedient foreign companies to heel… Digital and human rights advocates warn that India has perfected the use of regulations to stifle online dissent and already inspired governments in countries as varied as Nigeria and Myanmar to craft similar legal frameworks, at times with near-identical language. India’s success in taming internet companies has set off “regulatory contagion” across the world, according to Prateek Waghre, a policy director at India’s Internet Freedom Foundation…

Despite the huge size of China’s market, companies like Twitter and Facebook were forced to steer clear of the country because Beijing’s rules would have required them to spy on users. That left India as the largest potential growth market. Silicon Valley companies were already committed to doing business in India before the government began to tighten its regulations, and today say they have little choice but to obey if they want to remain there.

The Post spoke to Rajeev Chandrasekhar, the deputy technology minister in the BJP government who oversees many of the new regulations, who argued “The shift was really simple: We’ve defined the laws, defined the rules, and we have said there is zero tolerance to any noncompliance with the Indian law…

“You don’t like the law? Don’t operate in India,” Chandrasekhar added. “There is very little wiggle room.”

Read more of this story at Slashdot.

Source: Slashdot – Is India Setting a ‘Global Standard’ for Online Censorship of Social Media?