In October cryptologist/CS professor Daniel J. Bernstein alleged that America’s National Security
Agency (and its UK counterpart GCHQ) were attempting to influence NIST to adopt weaker post-quantum cryptography
standards without a “hybrid” approach that would’ve also included pre-quantum ECC.

Bernstein is of the opinion that “Given how
many post-quantum proposals have been broken and the continuing flood of side-channel attacks, any competent engineering evaluation will conclude that
the best way to deploy post-quantum [PQ] encryption for TLS, and for the Internet more broadly, is as double encryption: post-quantum cryptography on top of ECC.” But
he says he’s seen it playing out differently:

By 2013, NSA had a quarter-billion-dollar-a-year
budget to “covertly influence and/or overtly leverage”
systems to “make the systems in question exploitable”; in
particular, to “influence policies, standards and specification
for commercial public key technologies”. NSA is quietly
using stronger cryptography for the data it cares about, but
meanwhile is spending money to promote a market for weakened
cryptography, the same way that it successfully created decades of
security failures by building up the market for, e.g., 40-bit
RC4 and 512-bit
RSA and Dual EC.
I looked concretely at what was happening in IETF’s
TLS working group, compared to the consensus
requirements for standards-development organizations. I reviewed
how a call for “adoption” of an NSA-driven specification produced a variety of objections that weren’t
handled properly. (“Adoption” is a preliminary step before IETF standardization….) On 5 November 2025, the chairs issued “last call” for objections to publication of the document. The deadline for input is “2025-11-26”, this coming Wednesday.

Bernstein also shares concerns about how the Internet Engineering Task Force is handling the discussion, and argues that the document is even “out of scope” for the
IETF TLS working group

This document doesn’t serve any of the official goals in the TLS working group charter. Most importantly, this document is directly contrary to the “improve security” goal, so it would violate the charter even if it contributed to another goal… Half of the PQ proposals submitted to NIST in 2017 have been broken already… often with attacks having sufficiently low cost to demonstrate on
readily available computer equipment. Further PQ software has been broken by implementation issues such as side-channel attacks.

He’s also concerned about how that discussion is being handled:

On 17 October 2025, they posted a “Notice of Moderation for Postings by D. J. Bernstein” saying that they would “moderate the postings of D. J. Bernstein for 30 days due to disruptive behavior effective immediately” and specifically that my postings “will be held for moderation and after confirmation by the TLS Chairs of being on topic and not disruptive, will be released to the list”…

I didn’t send anything to the IETF TLS mailing list for 30 days after that. Yesterday [November 22nd] I finished writing up my new objection and sent that in. And, gee, after more than 24 hours it still hasn’t appeared… Presumably the chairs “forgot” to flip the censorship button off after 30 days.

Thanks to alanw (Slashdot reader #1,822) for spotting the blog posts.

Read more of this story at Slashdot.

“Three years ago, Google removed JPEG XL support from Chrome, stating there wasn’t enough interest at the time,” writes the blog Windows Report. “That position has now changed.”

In a recent note to developers, a Chrome team representative confirmed that work has restarted to bring JPEG XL to Chromium and said Google “would ship it in Chrome” once long-term maintenance and the usual launch requirements are met.

The team explained that other platforms moved ahead. Safari supports JPEG XL, and Windows 11 users can add native support through an image extension from Microsoft Store. The format is also confirmed for use in PDF documents. There has been continuous demand from developers and users who ask for its return.

Before Google ships the feature in Chrome, the company wants the integration to be secure and supported over time. A developer has submitted new code that reintroduces JPEG XL to Chromium. This version is marked as feature complete. The developer said it also “includes animation support,” which earlier implementations did not offer.

Read more of this story at Slashdot.

“Fresh from announcing it is building an AI browsing mode in Firefox and laying the groundwork for agentic interactions in the Firefox 145 release, the corp arm of Mozilla is now flexing its AI muscles in the direction of those more likely to care,” writes the blog OMG Ubuntu:

If you’re a developer building AI agents, you can sign up to get early access to Mozilla’s TABS API, a “powerful web content extraction and transformation toolkit designed specifically for AI agent builders”… The TABS API enables devs to create agents to automate web interactions, like clicking, scrolling, searching, and submitting forms “just like a human”. Real-time feedback and adaptive behaviours will, Mozilla say, offer “full control of the web, without the complexity.”

As TABS is not powered by a Mozilla-backed LLM you’ll need to connect it to your choice of third-party LLM for any relevant processing… Developers get 1,000 requests monthly on the free tier, which seems reasonable for prototyping personal projects. Complex agentic workloads may require more. Though pricing is yet to be locked in, the TABS API website suggests it’ll cost ~$5 per 1000 requests.
Paid plans will offer additional features too, like lower latency and, somewhat ironically, CAPTCHA solving so AI can ‘prove’ it’s not a robot on pages gated to prevent automated activities.

Google, OpenAI, and other major AI vendors offer their own agentic APIs. Mozilla is pitching up late, but it plans to play differently. It touts a “strong focus on data minimisation and security”, with scraped data treated ephemerally — i.e., not kept. As a distinction, that matters. AI agents can be given complex online tasks that involve all sorts of personal or sensitive data being fetched and worked with…. If you’re minded to make one, perhaps without a motivation to asset-strip the common good, Mozilla’s TABS API look like a solid place to start.

Read more of this story at Slashdot.

Social media is an overwhelming part of our lives these days, but the Pew Research Center provided an in-depth look at just how much we rely on these platforms. In a 2025 report that looks at social media usage with American adults, the data-driven think tank revealed some nitty-gritty details like year-to-year changes, age gaps and most importantly, frequency of use.

At the number one spot, YouTube holds a dominant position, with 84 percent of the 5,022 adults surveyed saying they use Alphabet’s video-sharing platform. Meta earns silver and bronze medals since 71 percent of adults said they use Facebook, while 50 percent responded positively when it comes to Instagram use. However, not all of Meta’s social media outlets are doing well. Threads may have hit 400 million monthly active users this summer, but only eight percent of adults surveyed said they use it. Rounding out the bottom of the list, only 21 percent of adults surveyed said they use X, while four percent of adults said they’re on Bluesky and three percent are on Truth Social.

Besides popularity, the Pew Research Center also explored the frequency with which American adults use their preferred social media platforms. In a separate survey with 5,123 adults, the report uncovered that 52 percent of adults go on Facebook daily, with 37 percent of them logging on several times a day. Nearly as frequently, 48 percent of adults use YouTube daily, including 33 percent of that demographic watching videos on the platform several times a day. When looking at frequency through the lens of age gaps, the starkest difference is found with 47 percent of adults between 18 and 29 using TikTok at least once a day, while only five percent of those aged 65 or older use the ByteDance-owned app every day.

When looking at annual trends, YouTube and Facebook have largely maintained stable usage — and even some growth — since 2021. Even though it may feel like Facebook has begun to stagnate, the report shows that it has a loyal user base that’s still growing at a consistent rate. On top of that, Meta is still continuing to update the social media platform, including recently revamping Facebook Marketplace. 

This article originally appeared on Engadget at https://www.engadget.com/social-media/the-most-popular-social-media-platform-among-us-adults-isnt-instagram-or-tiktok-195823871.html?src=rss

Long-time Slashdot reader jenningsthecat shared this article from IEEE Spectrum:

By dropping a nuclear reactor 1.6 kilometers (1 mile) underground, Deep Fission aims to use the weight of a billion tons of rock and water as a natural containment system comparable to concrete domes and cooling towers. With the fission reaction occurring far below the surface, steam can safely circulate in a closed loop to generate power.

The California-based startup announced in October that prospective customers had signed non-binding letters of intent for 12.5 gigawatts of power involving data center developers, industrial parks, and other (mostly undisclosed) strategic partners, with initial sites under consideration in Kansas, Texas, and Utah… The company says its modular approach allows multiple 15-megawatt reactors to be clustered on a single site: A block of 10 would total 150 MW, and Deep Fission claims that larger groupings could scale to 1.5 GW. Deep Fission claims that using geological depth as containment could make nuclear energy cheaper, safer, and deployable in months at a fraction of a conventional plant’s footprint…

The company aims to finalize its reactor design and confirm the pilot site in the coming months. [Company founder Liz] Muller says the plan is to drill the borehole, lower the canister, load the fuel, and bring the reactor to criticality underground in 2026. Sites in Utah, Texas, and Kansas are among the leading candidates for the first commercial-scale projects, which could begin construction in 2027 or 2028, depending on the speed of DOE and NRC approvals. Deep Fission expects to start manufacturing components for the first unit in 2026 and does not anticipate major bottlenecks aside from typical long-lead items.

In short “The same oil and gas drilling techniques that reliably reach kilometer-deep wells can be adapted to host nuclear reactors…” the article points out. Their design would also streamline construction, since “Locating the reactors under a deep water column subjects them to roughly 160 atmospheres of pressure — the same conditions maintained inside a conventional nuclear reactor — which forms a natural seal to keep any radioactive coolant or steam contained at depth, preventing leaks from reaching the surface.”

Other interesting points from the article:

They plan on operating and controlling the reactor remotely from the surface.

Company founder Muller says if an earthquake ever disrupted the site, “you seal it off at the bottom of the borehole, plug up the borehole, and you have your waste in safe disposal.”

For waste management, the company “is eyeing deep geological disposal in the very borehole systems they deploy for their reactors.”

“The company claims it can cut overall costs by 70 to 80 percent compared with full-scale nuclear plants.”

“Among its competition are projects like TerraPower’s Natrium, notes
the tech news site Hackaday, saying TerraPower’s fast neutron reactors “are already under construction and offer much more power per reactor, along with Natrium in particular also providing built-in grid-level storage.

“One thing is definitely for certain…” they add. “The commercial power sector in the US has stopped being mind-numbingly boring.”

Read more of this story at Slashdot.

Valve shook up the gaming world with the announcement of the Steam Machine, but we’re all still curious about the million-dollar question of pricing. While there’s plenty of speculation, we finally have some sort of indication from Valve directly. In an interview with Skill Up’s Friends Per Second podcast, Valve’s Pierre-Loup Griffais revealed that the Steam Machine will not be subsidized but will still have competitive pricing.

“I think that if you build a PC from parts and get to basically the same level of performance, that’s the general price window that we aim to be at,” Griffais said on the podcast. “Obviously, our goal is for it to be a good deal at that level of performance, and then you have features that are actually really hard to build if you’re making your own gaming PC from parts.”

Griffais didn’t offer a concrete price range since Valve was still early in the process, adding that “right now is just a hard time to have a really good idea of what the price is going to be because there’s a lot of different things that are fluctuating.” When asked if the Steam Machine would be subsidized like how other companies often sell new consoles at a loss or slim profit margin to generate early momentum, Griffais said no and that it would be “more in line with what you might expect from the current PC market.”

However, Griffais also revealed that Valve is potentially interested in doing a Steam Machine Pro, but that the company is currently focused on this mid-range level as a “good trade off between affordability and the level of power we get.”

This article originally appeared on Engadget at https://www.engadget.com/gaming/valve-says-that-the-steam-machines-price-will-be-more-in-line-with-current-pc-market-182213173.html?src=rss

After years of introducing major changes with its annual iOS releases, Apple may be altering its approach next time around, instead focusing on refinement over a bevy of flashy new features. According to Mark Gurman in this week’s Power On newsletter, for iOS 27, Apple is “focused on improving the software’s quality and underlying performance.” That, and beefing up its AI offerings.

On the heels of iOS 26, which brought the Liquid Glass design overhaul, and the trickle of underbaked AI features that have arrived since the rollout of Apple Intelligence last year, Apple is reportedly honing in to improve the experience. Gurman writes that “engineering teams are now combing through Apple’s operating systems, hunting for bloat to cut, bugs to eliminate, and any opportunity to meaningfully boost performance and overall quality.” Gurman compares the strategy to 2009’s Snow Leopard release for Mac, which focused on bug fixes, decluttering and efficiency. 

Catching up on AI is a major priority as well, the report notes. The company is working on an AI web search tool and an Apple Intelligence overhaul, alongside plans to integrate its AI into more apps. We still have yet to see the smarter, more personal AI-powered Siri the company has been talking about since 2024, but that’s expected to arrive before iOS 27 — possibly with iOS 26.4 this coming spring, according to Gurman. 

This article originally appeared on Engadget at https://www.engadget.com/mobile/smartphones/ios-27-will-reportedly-focus-on-performance-improvements-and-ai-upgrades-175700261.html?src=rss

With some animated graphics, CNN “reimagined” what three of America’s busiest air and road travel routes would look like with high-speed trains, for “a glimpse into a faster, more connected future.”

The journey from New York City to Chicago could take just over six hours by high-speed train at an average speed of 160 mph, cutting travel time by more than 13 hours compared with the current Amtrak route… The journey from San Francisco to Los Angeles could be completed in under three hours by high-speed train… The journey from Atlanta to Orlando could be completed in under three hours by high-speed train that reaches 160 mph, cutting travel time by over half compared with driving…

While high-speed rail remains a fantasy in the United States, it is already hugely successful across the globe. Passengers take 3 billion trips annually on more than 40,000 miles of modern high-speed railway across the globe, according to the International Union of Railways. China is home to the world’s largest high-speed rail network. The 809-mile train journey from Beijing to Shanghai takes just four and a half hours… In Europe, France’s Train a Grand Vitesse (TGV) is recognized as a pioneer of high-speed rail technology. Spain soon followed France’s success and now hosts Europe’s most extensive high-speed rail network…

[T]rain travel contributes relatively less pollution of every type, said Jacob Mason of the Institute for Transportation and Development Policy, from burning less gasoline to making less noise than cars and taking up less space than freeways. The reduction in greenhouse gas emissions is staggering: Per kilometer traveled, the average car or a short-haul flight each emit more than 30 times the CO2 equivalent than Eurostar high-speed trains, according to data from the UK government.

Read more of this story at Slashdot.

Building on Google’s recent announcement that Android’s Quick Share will work with iOS’ AirDrop for Pixel 10 smartphones, Qualcomm revealed in a post on X that the cross-platform file-sharing feature will be available on devices powered by its Snapdragon chips. In the post, Qualcomm said that it “can’t wait for people to use this once enabled on Snapdragon in the near future.”

It’s not a complete surprise since Google mentioned in its announcement that Quick Share to AirDrop would come to more Android devices. However, the Snapdragon confirmation acknowledged that this new compatibility wouldn’t be limited to Pixel smartphones or devices running Google Tensor chips. Soon, we could have the ability to share files with iPhone users, even if it’s with a Samsung Galaxy smartphone, a OnePlus device or even Nothing phones.

Qualcomm didn’t specify exactly when or which smartphones will get this Quick Share to AirDrop feature, but we might see it come to more devices than just smartphones, like tablets or laptops. Along with this latest file-sharing feature, Apple’s announcement of iOS 18 getting RCS compatibility has reduced the longstanding friction between smartphone operating systems.

This article originally appeared on Engadget at https://www.engadget.com/mobile/smartphones/snapdragon-devices-will-soon-be-able-to-transfer-files-to-iphones-via-quick-share-164835065.html?src=rss

“Security, development, and AI now move as one,” says Microsoft’s director of cloud/AI security
product marketing.

Microsoft and GitHub “have launched a native integration between Microsoft Defender for Cloud and GitHub Advanced Security that aims to address what one executive calls decades of accumulated security debt in enterprise codebases…” according to The New Stack:

The integration, announced this week in San Francisco at the
Microsoft
Ignite 2025 conference and now available in public preview,
connects runtime intelligence from production environments directly
into developer workflows. The goal is to help organizations
prioritize which vulnerabilities actually matter and use AI to fix
them faster. “Throughout my career, I’ve seen vulnerability
trends going up into the right. It didn’t matter how good of a
detection
engine and how accurate our detection engine was, people just
couldn’t fix things fast enough,” said Marcelo
Oliveira, VP of product management at GitHub, who has spent
nearly a decade in application security. “That basically resulted
in decades of accumulation of security debt into enterprise code
bases.” According to industry data, critical and high-severity
vulnerabilities constitute 17.4% of security backlogs, with a mean
time to remediation of 116 days, said Andrew
Flick, senior director of developer services, languages and tools
at Microsoft, in a blog
post. Meanwhile, applications face attacks as frequently as once
every three minutes, Oliveira said.

The integration represents the first native link between runtime
intelligence and developer workflows, said Elif
Algedik, director of product marketing for cloud and AI security
at Microsoft, in a blog
post… The problem, according to Flick, comes down to three
challenges: security teams drowning in alert fatigue while AI rapidly
introduces new threat
vectors that they have little time to understand; developers
lacking clear prioritization while remediation takes too long; and
both teams relying on separate, nonintegrated tools that make
collaboration slow and frustrating… The new integration works
bidirectionally. When Defender for Cloud detects a vulnerability in a
running workload, that runtime context flows into GitHub, showing
developers whether the vulnerability is internet-facing, handling
sensitive data or actually exposed in production. This is powered by
what GitHub calls the Virtual Registry, which creates code-to-runtime
mapping, Flick said…

In the past, this alert would age in a dashboard while developers
worked on unrelated fixes because they didn’t know this was the
critical one, he said. Now, a security campaign can be created in
GitHub, filtering for runtime risk like internet exposure or
sensitive data, notifying the developer to prioritize this issue.

GitHub Copilot “now automatically checks dependencies, scans
for first-party code vulnerabilities and catches hardcoded secrets
before code reaches developers,” the article points out — but
GitHub’s VP of product management says this takes things even
further.

“We’re not only helping you fix existing vulnerabilities,
we’re also reducing the number of vulnerabilities that come into
the system when the level of throughput of new code being created is
increasing dramatically with all these agentic coding agent platforms.”

Read more of this story at Slashdot.