California sued to fine a data-harvesting company, reports the Washington Post, calling it “a rare step to put muscle behind one of the strongest online privacy laws in the United States.”

Even when states have tried to restrict data brokers, it has been tough to make those laws stick. That has generally been a problem for the 19 states that have passed broad laws to protect personal information, said Matt Schwartz, a policy analyst for Consumer Reports. He said there has been only 15 or so public enforcement actions by regulators overseeing all those laws. Partly because companies aren’t held accountable, they’re empowered to ignore the privacy standards. “Noncompliance is fairly widespread,” Schwartz said. “It’s a major problem.”

That’s why California is unusual with a data broker law that seems to have teeth. To make sure state residents can order all data brokers operating in the state to delete their personal records [with a single request], California is now requiring brokers to register with the state or face a fine of $200 a day. The state’s privacy watchdog said Thursday that it filed litigation to force one data broker, National Public Data, to pay $46,000 for failing to comply with that initial phase of the data broker law. NPD declined to comment through an attorney… This first lawsuit for noncompliance, Schwartz said, shows that California is serious about making companies live up to their privacy obligations… “If they can successfully build it and show it works, it will create a blueprint for other states interested in this idea,” he said.
Last summer NPD “spilled hundreds of millions of Americans’ Social Security Numbers, addresses, and phone numbers online,” according to the blog Krebs on Security, adding that another NPD data broker sharing access to the same consumer records “inadvertently published the passwords to its back-end database in a file that was freely available from its homepage…”
California’s attempt to regulate the industry inspired the nonprofit Consumer Reports to create an app called Permission Slip that reveals what data companies collect and, for people in U.S. states, will “work with you to file a request, telling companies to stop selling your personal information.”

Other data-protecting options suggested by The Washington Post:
Use Firefox, Brave or DuckDuckGo, “which can automatically tell websites not to sell or share your data. Those demands from the web browsers are legally binding or will be soon in at least nine states.”
Use Privacy Badger, an EFF browser extension which the EFF says “automatically tells websites not to sell or share your data including where it’s required by state law.”

Read more of this story at Slashdot.

“IBM stopped supporting OS/2 at the end of 2006,” write the makers of ArcaOS, an OEM distribution of OS/2’s discontinued Warp operating system.

And now long-time Slashdot reader martiniturbide tells us that ArcaOS 5.1.1 has been released, and that many of it’s components have been updated too. From this week’s announcement:

ArcaOS 5.1.1 continues to support installation on the latest generation of UEFI-based systems, as well as the ability to install to GPT-based disk layouts. This enables ArcaOS 5.1.1 to install on a wide array of modern hardware. Of course, ArcaOS 5.1.1 is just as much at home on traditional BIOS-based systems, offering enhanced stability and performance across both environments….
Need more convincing? How about a commercial operating system which doesn’t spy on you, does not report your online activity to anyone, and gives you complete freedom to choose the applications you want to use, however you want to use them? How about an operating system which isn’t tied to any specific hardware manufacturer, allowing you to choose the platform which is right for you, and fits perfectly well in systems with less than 4GB of memory or even virtual machines?

Read more of this story at Slashdot.

Google’s Threat Intelligence Group notes “the growing threat to secure messaging applications.” While specifically acknowledging “wide ranging efforts to compromise Signal accounts,” they add that the threat “also extends to other popular messaging applications such as WhatsApp and Telegram, which are also being actively targeted by Russian-aligned threat groups using similar techniques.

“In anticipation of a wider adoption of similar tradecraft by other threat actors, we are issuing a public warning regarding the tactics and methods used to date to help build public awareness and help communities better safeguard themselves from similar threats.”

Computer Weekly reports:

Analysts predict it is only a matter of time before Russia starts deploying hacking techniques against non-military Signal users and users of other encrypted messaging services, including WhatsApp and Telegram. Dan Black, principal analyst at Google Threat Intelligence Group, said he would be “absolutely shocked” if he did not see attacks against Signal expand beyond the war in Ukraine and to other encrypted messaging platforms…

Russia-backed hackers are attempting to compromise Signal’s “linked devices” capability, which allows Signal users to link their messaging account to multiple devices, including phones and laptops, using a quick response (QR) code. Google threat analysts report that Russia-linked threat actors have developed malicious QR codes that, when scanned, will give the threat actor real-time access to the victim’s messages without having to compromise the victim’s phone or computer. In one case, according to Black, a compromised Signal account led Russia to launch an artillery strike against a Ukrainian army brigade, resulting in a number of casualties… Google also warned that multiple threat actors have been observed using exploits to steal Signal database files from compromised Android and Windows devices.

The article notes that the attacks “are difficult to detect and when successful there is a high risk that compromised Signal accounts can go unnoticed for a long time.” And it adds that “The warning follows disclosures that Russian intelligence created a spoof website for the Davos World Economic Forum in January 2025 to surreptitiously attempt to gain access to WhatsApp accounts used by Ukrainian government officials, diplomats and a former investigative journalist at Bellingcat.”

Google’s Threat Intelligence Group notes there’s a variety of attack methods, though the “linked devices” technique is the most widely used. “We are grateful to the team at Signal for their close partnership in investigating this activity,” Google’s group says in their blog post, adding that “the latest Signal releases on Android and iOS contain hardened features designed to help protect against similar phishing campaigns in the future. Update to the latest version to enable these features.”

Read more of this story at Slashdot.

Deadline reports:
It’s taking around $1 billion to have 007 stewards Barbara Broccoli and Michael G. Wilson cede creative oversight of their family’s storied James Bond franchise to Amazon MGM Studios, sources tell us. Amazon originally overpaid on its purchase of MGM in a deal orchestrated by then-MGM board chair Kevin Ulrich. Though valued between $3.5 billion-$4 billion, the legendary motion picture studio was absorbed by the streamer for $8.5 billion, the hefty sum propped up by the potential access of the 007 franchise. However, Amazon couldn’t fully freely develop Bond with Broccoli and Wilson in the mix. Hence, it took another $1 billion to ensure that they could fully steer and exploit the Ian Fleming IP.
The article suggests Broccoli’s long hold-out came from “Amazon’s desire to expand the James Bond franchise into its own universe akin to Marvel or Star Wars.”
In the past, filmmakers including Quentin Tarantino and Christopher Nolan have expressed an interest in putting their stamp on Bond; both however, required complete creative control, which wasn’t possible under the reign of Broccoli and Wilson. Now, with the producers on the side, Amazon can move forward to attract a top-tier director.

Also available to come to life in the new deal finally are a slew of Bond villains and women in their own series or features. The last time an attempt was made to spin off the Bond franchise was in 2003 with a stand-alone movie about the spy’s girlfriend Jinx, played by Halle Berry in Die Another Day. Bond scribes Neal Purvis and Rob Wade were attached to pen that, with Stephen Frears circling, but Broccoli and Wilson put the kibosh to the idea due to creative differences.
In a related note, the article adds that Amazon “is looking to have an international theatrical distribution arm fully operational by some time in 2026.”

Jeff Bezos asked his followers on X.com who should play James Bond in the next movie, reports IGN, “and the answer was loud and clear.” On X.com the “clear fan favorite” was DC Extended Universe actor Henry Cavill. (Besides playing Superman, Cavill also appeared in the 2024 film spy action-comedy Argyle, and fought Tom Cruise’s character in 2018’s Mission Impossible: Fallout — and played Geralt of Rivia in the Netflix series The Witcher.)

Read more of this story at Slashdot.

Linus Torvalds responded Thursday to kernel developer Christoph Hellwig, who had claimed Torvalds merged Rust code into the kernel even over his objections as the original C code’s maintainer. Highlights from Torvalds’ response:

The fact is, the pull request you objected to DID NOT TOUCH THE DMA LAYER AT ALL. It was literally just another user of it, in a completely separate subdirectory, that didn’t change the code you maintain in _any_ way, shape, or form… Honestly, what you have been doing is basically saying “as a DMA maintainer I control what the DMA code is used for”.

And that is not how *any* of this works. What’s next? Saying that particular drivers can’t do DMA, because you don’t like that device, and as a DMA maintainer you control who can use the DMA code? That’s _literally_ exactly what you are trying to do with the Rust code. You are saying that you disagree with Rust — which is fine, nobody has ever required you to write or read Rust code. But then you take that stance to mean that the Rust code cannot even use or interface to code you maintain…

You don’t have to like Rust. You don’t have to care about it. That’s been made clear pretty much from the very beginning, that nobody is forced to suddenly have to learn a new language, and that people who want to work purely on the C side can very much continue to do so. So to get back to the very core of your statement:

“The document claims no subsystem is forced to take Rust”

that is very much true. You are not forced to take any Rust code, or care about any Rust code in the DMA code. You can ignore it…

You can’t have it both ways. You can’t say “I want to have nothing to do with Rust”, and then in the very next sentence say “And that means that the Rust code that I will ignore cannot use the C interfaces I maintain”…. So when you change the C interfaces, the Rust people will have to deal with the fallout, and will have to fix the Rust bindings. That’s kind of the promise here: there’s that “wall of protection” around C developers that don’t want to deal with Rust issues in the promise that they don’t *have* to deal with Rust.

But that “wall of protection” basically goes both ways. If you don’t want to deal with the Rust code, you get no *say* on the Rust code. Put another way: the “nobody is forced to deal with Rust” does not imply “everybody is allowed to veto any Rust code”.

Torvalds also made sure to add some kind remarks, including “I respect you technically, and I like working with you.”

Read more of this story at Slashdot.