Bypassing Ubuntu’s user-namespace restrictions

Ubuntu 23.10 and 24.04 LTS introduced a feature using AppArmor to
restrict access to user namespaces. Qualys has reported
three ways to bypass AppArmor’s restrictions and enable local users to
gain full administrative capabilities within a user namespace. Ubuntu
has followed up with a post
that explains the namespace-restriction feature in detail, and says
these bypasses do not constitute security vulnerabilities.

While a superficial observation of the application of user namespaces may indicate privileged (root level) access, this is a fictitious state that is operating as expected, with access control still mapped to the real (root namespace) user’s permissions. As such, these bypasses do not enable more access than what the default Linux kernel
unprivileged user namespace feature allows in most Linux
distributions. They do, however, demonstrate limitations that we are
looking to address in order to strengthen existing protections against
as-of-yet-unknown Linux kernel vulnerabilities.

LWN covered Ubuntu 24.04 LTS last May.

Columbia University Suspends Student Behind Interview Cheating AI

Columbia University has suspended the student who created an AI tool designed to help job candidates cheat on technical coding interviews, according to disciplinary documents seen by Business Insider. Chungin “Roy” Lee received a yearlong suspension for “publishing unauthorized documents” from a disciplinary hearing about his product, Interview Coder, not for creating the tool itself. Lee had signed a form agreeing not to disclose his disciplinary record or post hearing materials online.

Interview Coder, which sells for $60 monthly, is on track to generate $2 million in annual revenue, Lee said. The university initially placed him on probation after finding him responsible for “facilitation of academic dishonesty.” Lee had already submitted paperwork for a leave of absence before his suspension. He told BI he plans to move to San Francisco, which “was my plan all along.”


Read more of this story at Slashdot.

Study of Lyft rideshare data confirms minorities get more tickets

It’s no secret that “driving while black” is a real phenomenon. Study after study has shown that minority drivers are ticketed at a higher rate, and data from speed cameras suggests that it’s not because they commit traffic violations more frequently. But this leaves open the question of why. Bias is an obvious answer, but it’s hard to eliminate an alternative explanation: Minority groups may engage in more unsafe driving, and the police are trying to deter that.

But now, Lyft has given a group of researchers access to detailed data from their drivers. The results confirm that minority drivers get more tickets, and they pay higher fines when they do. And the results also show that minorities aren’t in any way more likely to speed or engage in unsafe driving. Which suggests, in their words, that the problem is “animus” against minority drivers.

Giving research a Lyft

The work was done thanks to cooperation from the ridesharing company Lyft, which provided data on its drivers in Florida, all 222,838 of them, along with a record of all the GPS pings their tracking systems sent into the company’s servers. Combined with a detailed map of Florida’s roads, along with their speed limits, they could determine when a given driver was speeding. They also obtained Florida police records of any accidents and cross-referenced their locations to any vehicle that experienced a sudden stop in that spot at the same time.

Read full article

Comments

This M4 Mac Mini Deal Is the Cheapest Way to Get Apple’s Newest Chip

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

Are you reading this article on a computer monitor? Typing away in the comments on a keyboard? Then why would you buy yet another MacBook when you could get the same power and convenience for much less by opting for a Mac Mini?

Right now you can pick one up at Amazon for under $500, or $100 off the usual price.

Finally updated last year with Apple’s latest chip, the M4, the new Mac Mini is a small computer that can actually fit in the palm of your hand. It’s got pretty much everything you’d get from one of Apple’s laptops—minus a screen and keyboard. Though thanks to a built-in fan, it’s actually got one up on the MacBook Air, and is more analogous to an entry-level MacBook Pro. And even then, it’s got more ports, including an ethernet port and two extra USB-C ports.

About the only real downside to the new Mac Mini is the annoying button placement—the power button is on the bottom of the device—but that’s what docks are for. Overall, this is a slick mini-computer, small and lightweight enough to be portable. If all you do is move from workstation to workstation, consider ditching the MacBook and saving both your wallet and your desk some space with this deal instead.


Shopping for tech? Lifehacker can help you make the right decision. Browse our tech reviews and head-to-head comparisons for everything from laptops and smartwatches to e-bikes and home gyms. Subscribe to our deals newsletter, Add to Cart, for the best sales sent to your inbox, or browse our best-of lists directly on Amazon, including:

Nvidia’s GeForce RTX 5090 Laptop Graphics Benchmarks Revealed

MojoKid writes: Similar to Nvidia’s recent desktop graphics launches, there are four initial GeForce RTX 50 series laptop GPUs coming to market, starting this month. At the top of the stack is the GeForce RTX 5090 laptop GPU, which is equipped with 10,496 CUDA cores and is paired to 24GB of memory. Boost clocks top out around 2,160MHz and GPU power can range from 95-150 watts, depending on the particular laptop model. GeForce RTX 50 series GPUs for both laptops and desktops feature updated shader cores with support for neural shading, in addition to 4th gen ray tracing cores and 5th gen Tensor cores with support for DLSS 4. The GeForce RTX 50 series features a native PCIe gen 5 interface, in addition to support for DisplayPort 2.1b (up to UHBR20). These GPUs are also fed by the latest high speed GDDR7 memory, which offers efficiency benefits that are pertinent to laptop designs as well. Performance-wise, NVIDIA’s mobile GeForce RTX 5090 is the new king of the hill in gaming laptops, and it easily bests all other discrete mobile graphics options on the market currently.


Read more of this story at Slashdot.

Rust adopting Ferrocene Language Specification

One recurring criticism of Rust has been that the language has no official specification. This is a barrier to adoption in some safety-conscious organizations, as well as to writing alternate language implementations. Now, the Rust project has
announced
that it will be adopting the

Ferrocene Language Specification
(FLS) developed by
Ferrous Systems and maintaining it as part of the core project. While this may not satisfy die-hard standardization-process enthusiasts, it’s a step toward removing another barrier to using Rust in safety-critical systems.

It’s in that light that we’re pleased to announce that we’ll be adopting the FLS into the Rust Project as part of our ongoing specification efforts. This adoption is being made possible by the gracious donation of the FLS by Ferrous Systems. We’re grateful to them for the work they’ve done in assembling the FLS, in making it fit for qualification purposes, in promoting its use and the use of Rust generally in safety-critical industries, and now, for working with us to take the next step and to bring the FLS into the Project.

Oracle Customers Confirm Data Stolen In Alleged Cloud Breach Is Valid

An anonymous reader quotes a report from BleepingComputer: Despite Oracle denying a breach of its Oracle Cloud federated SSO login servers and the theft of account data for 6 million people, BleepingComputer has confirmed with multiple companies that associated data samples shared by the threat actor are valid. Last week, a person named ‘rose87168’ claimed to have breached Oracle Cloud servers and began selling the alleged authentication data and encrypted passwords of 6 million users. The threat actor also said that stolen SSO and LDAP passwords could be decrypted using the info in the stolen files and offered to share some of the data with anyone who could help recover them.

The threat actor released multiple text files consisting of a database, LDAP data, and a list of 140,621 domains for companies and government agencies that were allegedly impacted by the breach. It should be noted that some of the company domains look like tests, and there are multiple domains per company. In addition to the data, rose87168 shared an Archive.org URL with BleepingComputer for a text file hosted on the “login.us2.oraclecloud.com” server that contained their email address. This file indicates that the threat actor could create files on Oracle’s server, indicating an actual breach. However, Oracle has denied that it suffered a breach of Oracle Cloud and has refused to respond to any further questions about the incident.

“There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data,” the company told BleepingComputer last Friday. This denial, however, contradicts findings from BleepingComputer, which received additional samples of the leaked data from the threat actor and contacted the associated companies. Representatives from these companies, all who agreed to confirm the data under the promise of anonymity, confirmed the authenticity of the information. The companies stated that the associated LDAP display names, email addresses, given names, and other identifying information were all correct and belonged to them. The threat actor also shared emails with BleepingComputer, claiming to be part of an exchange between them and Oracle.


Read more of this story at Slashdot.

Marvel Cosmic Invasion is a ’90s-style beat-’em-up in the mold of Shredder’s Revenge

There’s a lot in the world to be angry about today. So, why not do like we did in the ’90s and channel that aggression into beating the living hell out of bad guys in a delightfully loud and over-the-top arcade game? Marvel Cosmic Invasion takes characters like Spider-Man, Captain America and Wolverine and gives them a beat-’em-up that looks straight out of a grunge-era cabinet.

If this sounds like Teenage Mutant Ninja Turtles: Shredder’s Revenge, that’s no coincidence. Marvel Cosmic Invasion is not only cut from the same cloth; it’s from the same team (developer Tribute Games and publisher Dotemu). The idea is to recreate the look, sound and feel of side-scrolling ’90s button-mashers like X-Men, The Simpsons and the original Teenage Mutant Ninja Turtles with modern touches.

Screenshot from the game Marvel Cosmic Invasion, showing heroes beating up bad guys.
Tribute Games / Dotemu

Like Shredder’s Revenge, it exploits the advantages of modern graphical engines without betraying its muses’ old-school pixel art. Appropriately, the characters’ visual style is inspired by 90s-era Marvel comics.

You’ll choose a team of two superheroes and can tag between them mid-fight. At launch, you can play as Captain America, Wolverine, Spider-Man, Storm, Phyla-Vell, Venom and Nova. The developers are mum about which characters we might see in the future, but it’s hard to imagine Marvel stalwarts like Thor, Iron Man, Black Panther, Hulk and Black Widow not swooping in at some point.

Screenshot from the game Marvel Cosmic Invasion. showing heroes beating up bad guys.
Tribute Games / Dotemu

Its story sounds as extravagant as you’d want from a ’90s-inspired Marvel beat-’em-up. “The immortal Super Villain Annihilus has launched an unprecedented attack across the galaxy, threatening all life as we know it,” the description reads. “Fighters both Earth-born and cosmic must now join forces in a star-spanning adventure against the deadly Annihilation Wave. Brawl through the streets of New York City all the way to the depths of the Negative Zone to foil Annihilus’ vow to spread death across the cosmos.”

You can play with up to four players, local or online. (And it supports crossplay!)

Marvel Cosmic Invasion will be available for PC, Switch, PS5 / PS4 and Xbox. There’s no word yet on pricing or an exact release date, but Dotemu says it will arrive later this year. In the meantime, you can check out the announcement trailer below.

This article originally appeared on Engadget at https://www.engadget.com/gaming/marvel-cosmic-invasion-is-a-90s-style-beat-em-up-in-the-mold-of-shredders-revenge-191110625.html?src=rss

Boston Dynamics Atlas Humanoid Robot Can Run, Cartwheel, Breakdance Now

The robot apocalypse: it can’t come soon enough for some people. And to prove it, here’s a video of Boston Dynamics’ latest iteration of its Atlas humanoid that’s capable of running, crawling, doing cartwheels, and breakdancing. So, if you were wondering if robots were now able to easily circumvent any anti-robot traps you set up around your house, the answer is a definitive yes, and the only foolproof protection is my $39 anti-robot spray. I recommend a can for every room of the house. “This is just bug spray you relabeled.” Huff enough and you’ll be invincible!

Google announces Maps screenshot analysis, AI itineraries to help you plan trips

After a long and gloomy winter, many people are looking forward to some summer travel. Google has some new tools to help you plan, but like most of what Google does now, the new features lean heavily on AI. And unusually, the most interesting of these additions is launching first on iOS.

Google says that lots of people tend to take screenshots when they’re planning a trip. Instead of letting those images become lost in your camera roll, Google will let you feed them into Maps. The new screenshot list feature will let you add those images to Maps, where Gemini will scan them to identify locations.

This feature is opt-in, and the AI doesn’t appear to detect locations with image recognition. Instead, it looks for place names in text, allowing you to review the results before marking them on the map for later perusal.

Read full article

Comments

Nintendo’s digital Switch game sharing plan could be so much simpler

In the final days of our pre-Switch 2 world, Nintendo is trying to rethink how sharing games works. The biggest announcement from the company’s latest Direct was its upcoming Virtual Game Cards feature, a new approach to sharing digital games that improves on the company’s current system, but still carries limitations that keep it from feeling truly modern.

Virtual Game Cards attempt to make digital games as easy to share as physical ones. That starts with the company visually representing games as “cards” and using the language of loading and ejecting them, and extends to how simple they are to share. Two Switch consoles logged into your Nintendo Account can share any digital game just by “ejecting” it from one and “loading” it on another. The only catch is that the consoles need to be connected over local wireless (as in, be physically near each other) when the trade happens, and be able to access the internet to download the game and run it for the first time.

You can similarly share a Virtual Game Card with anyone in the same Nintendo Account family group for two weeks, after which the game automatically returns. In both cases, saves for each game stay on the console where the game was played, making it simple to share the Virtual Game Card again and keep playing.

In comparison to Nintendo’s current system, which requires defining a Switch console as “primary” and able to be used offline and other devices as a “secondary” and needing an internet connection to play shared games, Virtual Game Cards are a meaningful improvement. If you’re a parent trying to share games with your kids or a super-fan with multiple Switches (something Nintendo no doubt wants to encourage), Virtual Game Cards have basically solved the problem — or at least made it much easier to manage and understand. The company isn’t exactly leading the pack here, though.

If I own a game on PlayStation, I can download it on my Playstation 4 and PlayStation 5, and play on either console, without needing to go through the rigamarole of ejecting virtual cards. The same goes for Steam games. Valve even goes further and lets the vast majority of games be shared and played on accounts connected to the same Steam Family, without your computers needing to be near each other when you “hand-off” games.

People are highly sensitive to any kind of DRM. Just ask Xbox, which had big plans to change how loaning games work when the Xbox One was announced, but had to dramatically backtrack after basically everyone complained. 

Nintendo isn’t pulling an Xbox, per se, but it is pitching something adjacent. Virtual Game Cards are inarguably better than how things work now, but they require an internet connection and they still limit how many people can play a game at once. Nintendo came up with a better mental model for sharing games, but not necessarily a better way to do it.

This article originally appeared on Engadget at https://www.engadget.com/gaming/nintendo/nintendos-digital-switch-game-sharing-plan-could-be-so-much-simpler-190353732.html?src=rss

Shadow Labyrinth, the edgy Pac-Man Metroidvania, arrives on July 18

Shadow Labyrinth, an utterly bonkers riff on Pac-Man and sidescrolling Metroidvania games, will hit digital store shelves on July 18. It’ll be available for Nintendo Switch, PC via Steam, PS5 and Xbox Series X/S.

The game casts players as Swordsman No. 8 as he befriends a yellow orb called Puck. For the gaming historians out there, Puck-Man was the original name for Pac-Man. The gameplay involves switching from the classic sword-wielding hero to Puck, with the latter able to crawl on walls and (surprise) gobble up yellow dots. There’s also a third form, a mecha construct called Gaia.

The gameplay looks frenetic and fairly violent, which seems like an odd choice for everyone’s favorite perpetually hungry orb. Bandai Namco is making the game, however, and it made the very first Pac-Man all of those decades ago. I’m going to give them the benefit of the doubt here. In any event, it’s not as if developers haven’t experimented with Pac-Man in the past. The famished fiend has been featured in racing games, platformers, endless runners, puzzlers and more. What’s one more genre to add to the mix?

Shadow Labyrinth will be available in the original version and as a Digital Deluxe edition. That one comes with a digital artbook and the soundtrack.

This article originally appeared on Engadget at https://www.engadget.com/gaming/shadow-labyrinth-the-edgy-pac-man-metroidvania-arrives-on-july-18-185011811.html?src=rss

Android Development Is Going Private As Google Confirms Big Strategy Shift

Android Development Is Going Private As Google Confirms Big Strategy Shift
Google is making a big shift in how it manages the Android Open Source Project (AOSP), which it has been maintaining for over a decade, alongside its internal branch. AOSP has allowed for a lot of flexibility with how third parties could make use of the operating system. Moreover, it took in code from outside developers that would eventually

AMD Ryzen 5 9600 Looks Strong Compared To 9600X In Early Benchmarks

AMD Ryzen 5 9600 Looks Strong Compared To 9600X In Early Benchmarks
Ever since at least the Ryzen 3000 series, AMD’s release schedule for its Ryzen desktop processors has been to launch the enthusiast-focused “X” processors first, and then release the very-slightly neutered “non-X” versions after. The standard model Ryzen chips usually differ from their “X”-branded brethren only in that they have a lower power

Ubisoft Is Getting A $1.25 Billion Bailout From Tencent To Spin-Off Assassin’s Creed, Far Cry, And Rainbow Six Siege

Ubsioft will spin off its most successful game franchises, including Assassin’s Creed, Far Cry, and Rainbow Six Siege, into a separate subsidiary thanks to a $1.25 billion investment from Chinese conglomerate Tencent. The massive deal allows the founding Guillemot family to remain in control of the publisher despite…

Read more…