Julien Malka proposes method for detecting XZ-like backdoors

Julien Malka has

called
for the NixOS project to use build-reproducibility to detect when a program has a maintainer-generated tarball that results in a different artifact than building from source. There are good reasons for projects to release maintainer-generated tarballs, but since the materials included in them are usually documentation, extra build scripts, and so on, it makes sense to check that they don’t influence the final build output. While this would not have stopped

last year’s XZ backdoor
, it would have made it harder to hide.

People are often convinced that OSS is more trustworthy than closed-source software because the code can be audited by practitioners and security professionals in order to detect vulnerabilities or backdoors. In this instance, this procedure has been made difficult by the fact that part of the code activating the backdoor was not included in the sources available within the git repository but was instead present in the maintainer-provided tarball. While this was used to hide the backdoor out of sight of most investigating eyes, this is also an opportunity for us to improve our software supply chain security processes.

Apple Hit With Lawsuit Accusing It Of Falsely Advertising Apple Intelligence

Apple Hit With Lawsuit Accusing It Of Falsely Advertising Apple Intelligence
Apple is in the sights of a lawsuit that accuses it of falsely promoting its Apple Intelligence features to drive more sales of its products. The aggrieved individuals claim that Apple has failed to realize its promises about its intelligence features, and that those who have bought Apple’s devices based on the promises should be compensated.

The

Boeing will build the US Air Force’s next air superiority fighter

Today, it emerged that Boeing has won its bid to supply the United States Air Force with its next jet fighter. As with the last fighter aircraft design procurement in recent times, the Department of Defense was faced with a choice between awarding Boeing or Lockheed the contract for the Next Generation Air Dominance program, which will replace the Lockheed F-22 Raptor sometime in the 2030s.

Very little is known about the NGAD, which the Air Force actually refers to as a “family of systems,” as its goal of owning the skies requires more than just a fancy airplane. The program has been underway for a decade, and a prototype designed by the Air Force first flew in 2020, breaking records in the process (although what records and by how much was not disclosed).

Last summer, the Pentagon paused the program as it reevaluated whether the NGAD would still meet its needs and whether it could afford to pay for the plane, as well as a new bomber, a new early warning aircraft, a new trainer, and a new ICBM, all at the same time. But in late December, it concluded that, yes, a crewed replacement for the F-22 was in the national interest.

Read full article

Comments

CEO of AI ad-tech firm pledging “world free of fraud” sentenced for fraud

In May 2024, the website of ad-tech firm Kubient touted that the company was “a perfect blend” of ad veterans and developers, “committed to solving the growing problem of fraud” in digital ads. Like many corporate sites, it also linked old blog posts from its home page, including a May 2022 post on “How to create a world free of fraud: Kubient’s secret sauce.”

These days, Kubient’s website cannot be reached, the team is no more, and CEO Paul Roberts is due to serve one year and one day in prison, having pled guilty Thursday to creating his own small world of fraud. Roberts, according to federal prosecutors, schemed to create $1.3 million in fraudulent revenue statements to bolster Kubient’s initial public offering (IPO) and significantly oversold “KAI,” Kubient’s artificial intelligence tool.

The core of the case is an I-pay-you, you-pay-me gambit that Roberts initiated with an unnamed “Company-1,” according to prosecutors. Kubient and this firm would each bill the other for nearly identical amounts, with Kubient purportedly deploying KAI to find instances of ad fraud in the other company’s ad spend.

Read full article

Comments

Microsoft Tells Windows 10 Users To Buy New PCs

Microsoft has begun urging Windows 10 users to upgrade their systems ahead of the October 14, 2025 support deadline, but with a solution many find impractical: just buy a new computer. According to StatCounter data, 58.7% of Windows users remain on Windows 10 despite the impending end of security updates and technical assistance.

In emails to Windows 10 users, Microsoft’s primary recommendation is to trade in old devices for newer Windows 11-compatible hardware, rather than focusing on alternative solutions.


Read more of this story at Slashdot.

[$] Multiple memory classes for address-space isolation

Brendan Jackman has been working to try to get ahead of the next hardware CPU
vulnerability
before it gets discovered. In January, he posted the second version of

a patch set
that introduces

address-space isolation
(ASI) as a way of
preventing future CPU vulnerabilities from leaking important
information. The core concept is to ensure that data that is not currently
needed is not present in memory, so that speculative execution cannot leak it.
The work is nowhere near ready to be incorporated into the mainline
kernel — not least of all because it has a large performance impact in its
current form — but it is likely to once again be a topic of discussion at the
2025

Linux Filesystem, Memory Management, and BPF Summit
.

Google says its European ‘experiment’ shows news is worthless to its ad business

In November, Google said it would conduct a “test” in eight European countries that would omit results from EU-based news publishers for a small percentage of users. The results are in, and the survey says the news has no meaningful monetary value for the company. But the “public experiment” was hardly done for scientific curiosity. European copyright law says the company must pay publishers for using snippets from articles, and Google will likely use the data to try to kneecap news outlets’ negotiating leverage.

“During our negotiations to comply with the European Copyright Directive (EUCD), we’ve seen a number of inaccurate reports that vastly overestimate the value of news content to Google,” the company bluntly wrote in its blog post explaining the experiment’s results. “The results have now come in: European news content in Search has no measurable impact on ad revenue for Google.”

Google Economics Director Paul Liu said that when the company removed news content from one percent of users in Belgium, Croatia, Denmark, Greece, Italy, the Netherlands, Poland and Spain, it saw no change in ad revenue and only a 0.8 percent drop in usage. (It initially included France, but a court warned the company that it would break a previous agreement and face fines, so it backed out.) Liu concludes that “any lost usage was from queries that generated minimal or no revenue.”

Interior view of a Google campus in Madrid.
Interior of Google’s Madrid campus
Google

TechCrunch notes that Google is walking a fine line here. It’s already faced antitrust fines in France over news content, and Germany is ratcheting up pressure on the company’s news licensing tactics. Neither country was ultimately included in the “experiment.”

The company has a long history of using the potential withdrawal of visibility as a negotiating stick in similar situations (with success in some cases), including tests in Canada, California and Australia. In the latter case, Aussie grit prevailed: After Google threatened to remove its entire search engine from the country, then-Prime Minister Scott Morrison said, “Let me be clear. Australia makes our rules for things you can do in Australia.” The bill was passed and enacted, and Google struck deals with Australian media companies to license content. And yes, Google search is still available Down Under.

This article originally appeared on Engadget at https://www.engadget.com/big-tech/google-says-its-european-experiment-shows-news-is-worthless-to-its-ad-business-161103352.html?src=rss

Linux Security Hardening Cache Randomization Was Inadvertently Using The Same Seed

Ahead of the upcoming Linux 6.15 kernel cycle a few early pull requests have already been sent in to Linus Torvalds in advance of the anticipated v6.14 release on Sunday. Among those early changes for Linux 6.15 are the SLAB allocator updates that include a fix for cache randomization with kvmalloc inadvertently being inadequate due to accidentally using the same randomization seed…

How to Take Photos on iOS Without All the Post-Processing Junk

Your iPhone’s camera is smart—perhaps too smart. It’s smart enough to relight your selfies and remove distracting background objects from your photos. It’s the kind of reality-altering power that normally requires an Infinity Stone. It can also make it much harder to get photos that are accurate representations of the real world. Fortunately, there are alternatives.

It’s worth noting that it’s difficult to get absolutely zero processing on any smartphone camera. There’s always some amount of interpretation of raw data in order to display it. What we want to minimize here is how much your phone makes decisions about the “right” way your photos should look—decisions like how saturated colors should be, what parts of the image should be in or out of focus, and how your subject should be lit. Sometimes it’s better to let your phone make these decisions for you, but if you want more control, these are the options that are best for you.

Get more flexibility with Apple ProRAW

Normally, when you take a photo, your phone compresses the image to save space and tosses data that’s not necessary to display it. But that data can be useful if you want to do your own photo editing. That’s where Apple ProRAW comes in. This format (which takes up more storage space) saves almost all of the data from your camera’s sensor when the photo was taken.

This lets you adjust things like exposure, contrast, saturation, white balance, and other basic aspects of an image. There’s still some unavoidable image processing done to these photos, but ProRAW gives you a lot more flexibility to make changes than you normally would have.

To enable ProRAW images, tap the RAW button while you’re using your camera to use it for the current session. If you’d rather permanently switch your default settings, go to Settings > Camera > Preserve Settings and enable ProRAW & Resolution control. With this enabled, the camera will be in ProRAW mode unless you specifically disable it each time.

Use ZeroCam, the anti-AI camera app

ZeroCam makes the pitch that less is more, especially when it comes to camera features. In fact it only has one: a shutter button. There’s no post-processing, no filters or effects, and the only optional toggle is which of your phone’s lenses to use. It literally can’t be easier—for better or worse.

In my experience, images taken with ZeroCam in low-light settings had noticeably more noise, which is to be expected without a lot of post-processing. However, photos that were properly lit looked a bit more natural than with the stock camera app.

The main downside to the ZeroCam app is the cost: A subscription will run you $2/month, or $13 if you pay for a year up front. You can get a free three-day trial (for the monthly plan, bumped up to a week if you opt for the annual plan), at which point you’ll probably know for sure whether it’s worth the expense to you.

Use Halide for more control over AI-free photos

Unlike ZeroCam, Halide Mark II provides extensive manual controls over your camera. You can precisely adjust focus, ISO, shutter speed, and white balance before capturing the image. Some of these controls are available in the default camera app, but Halide adds other useful tools like focus peaking and live histograms.

Halide also has a dedicated Process Zero mode, which touts zero post-processing AI. This is as close as you can get to photos that are straight from the sensor with only the minimum processing required to create a viewable image. 

Like ZeroCam, this app isn’t free, although you can get a seven-day free trial to see if it serves your needs. After that, monthly subscriptions start at $10, or you can get a year for $20. If you know for certain you love the app and will be using it for a long time, a lifetime license will set you back $60.

Try the Blackmagic Camera app for filterless video

Blackmagic makes the free video editing suite Davinci Resolve, as well as a line of cinema cameras that tie deeply into the software. More recently, the company has released an app for the iPhone that leverages its expertise for the camera you always have with you. The Blackmagic Camera app is primarily focused on video, but you can use it to grab stills from your clips as well.

If you only want still photos, one of the other options on this list is probably better for you, but this app is perfect for videographers. It offers pro-level camera controls like ISO, shutter speed, and white balance, as well as features like an RGB histogram to see which parts of your image are clipping, and image stabilization to reduce the camera shake from holding it in your hand.

How to watch Milan-San Remo 2025

If there’s one thing Milan-San Remo has in its favour, it’s anticipation – not only because it’s the season’s first Monument (the big five one-day races on the men’s calendar).

Il Lombardia, the fifth Monument of the year, has the benefit of being the last, but other races can get lost on the calendar. Being first, however, commands a big audience, as well as a peloton fresh and chomping at the bit to get going.

Anticipation is also reflected at Milan-San Remo in the way the race unfolds. Nudging 300km (this year’s course is 289km), it’s the longest race on the calendar and, for 90% of it, you’d be forgiven for thinking not much of note is happening.

The peloton departs on flat roads – no longer from Milan but from Pavia, a town 35km south – and heads towards the Mediterranean coast. To get there, it scales the Turchino Pass, before heading west, largely along coastal roads, for the second half.

The Capi climbs along the coast help to wear down the riders as they approach San Remo.

It gets more undulating at this point, followed by a trio of Capi – more substantial rises – in the final quarter.

Still, nothing much typically happens until the Cipressa (5.6km at 4.1%), which in many years can be negotiated without too much disruption to the peloton.

It’s only on the Poggio (3.7km at 3.7%), the summit of which is only 5.6km from the San Remo finish after more than six hours of racing, where moves tend to be made. If the leader at the summit has any sort of gap, being pursued by a rampaging chase group down a highly technical descent will reveal their capacity for downhills.

Wins can be fashioned in several ways, including making a solo breakaway stick, with a daring descent off the Poggio or winning in a sprint of various-sized bunches.

The fact it happens so quickly, after so long without much happening at all, and that it can produce such a variety of winning scenarios, is what makes Milan-San Remo so popular. It’s also one of the few races on the calendar that such different sorts of riders can win.

At 289km, the men’s race is the longest on the calendar. RCS Sport

Sprinter Arnaud Démare, for example, won it in 2016, followed up two years later by Grand Tour winner Vincenzo Nibali. It’s a race that holds immense promise for so many riders at the outset, and one in which there’s so much to be gained from the briefest of hard efforts and acts of cunning in the finale.

To hammer home the point, at the time of writing, the three top favourites for 2025’s race are Classics rider extraordinaire Mathieu van der Poel (Alpecin-Deceuninck), three-time Tour de France champ Tadej Pogačar (UAE Team Emirates XRG), and the world’s top sprinter (and last year’s winner) Jasper Philipsen (Alpecin-Deceuninck). More than any other race on the calendar, a winner is impossible to call.

This year sees the welcome return of Milan-San Remo Women after a 20-year absence. A copy of the men’s route would blow the kilometre limit for women’s races out of the water, which means it starts in the coastal city of Genoa.

Its 156km route picks up the men’s course in Voltri at 18km and follows the same route to San Remo – in other words, the races share all the same best bits.

Lotte Kopecky (Team SD Worx Protime), as is often the case in one-day races at the moment, starts as favourite. However, she will face stiff competition from home favourite Elisa Balsamo (Lidl-Trek) and former team-mate turned arch-rival Demi Vollering (FDJ-Suez).

The women’s race begins in Genoa. RCS Sport

How can I watch Milan-San Remo 2025 live in the UK?

UK residents are still dealing with the shock of Eurosport’s closure, where live cycling could previously be accessed for £6.99 a month. That’s since risen to £30.99 a month, after Eurosport’s coverage was rolled into TNT Sports by parent company Warner Bros. Discovery.

Live coverage of both races on 22 March begins with the men, on TNT Sports 2 from 8.30am, covering the whole race until 4.30pm. The women’s race is on TNT Sports 3 from 11am UK time (until 2pm). TNT Sports is available via the Discovery+ app, EE TV, Sky and Virgin Media.

How can I watch Milan-San Remo 2025 live in the US?

FloBikes streams both races in the US, with costs starting from $12.50 when signing up to an annual plan. It’s also available on Max (formerly HBO Max), which is part of the Warner Bros. Discovery group – monthly subscriptions start from $9.99.

Coverage on FloBikes begins with the men’s race at 5.05am ET, with the women’s race following at 7.30am ET.

How can I watch Milan-San Remo 2025 live in Australia?

SBS will be covering the men’s and women’s races, with coverage starting from 10.25pm (Sydney time).

How else can I watch Milan-San Remo 2025?

There’s live terrestrial coverage in many European countries. Italian national broadcaster RAI is a race partner and official broadcaster, and will be showing the race live and on-demand, with coverage of the women’s race on RAI 2 from 1.30pm CET. The men’s race will be shown on Rai2 from 2.25pm.

Yahoo Sells TechCrunch

Yahoo on Friday said it has struck a deal to sell TechCrunch, the 20-year-old tech journalism site, to Regent, a media investment firm. Axios: Yahoo’s business centers mostly on aggregation. Journalism isn’t its core focus. Regent is trying to pull together a portfolio of tech news sites and is eager to invest in news. Earlier this week, it acquired Foundry, which houses a slew of online tech publications, such as PCWorld, Macworld and TechAdvisor.

In a statement, Regent said it is “thrilled to expand its reach as it provides breaking technology news, opinions, and analysis on tech companies worldwide to our audience.” Financial deal terms were not disclosed. The deal will not require regulatory review, which is normally needed for deals valued at roughly more than $100 million.


Read more of this story at Slashdot.

Bugatti’s Stunning New Supercar Is An 1800 HP Hybrid Beast With 8-Pipe Exhaust

Bugatti's Stunning New Supercar Is An 1800 HP Hybrid Beast With 8-Pipe Exhaust
As if Bugatti’s Tourbillon isn’t bonkers enough as it is with its V16 plug-in hybrid powerplant, or that the motor makes nearly 1,800 horses and tops out at 276 miles per hour, or that it costs more than $4 million dollars (assuming you can still order one of the 250 planned for production). The Rimac-owned automaker just announced the car’s