Microsoft is testing automatic Light and Dark Mode switching in Windows 11, with scheduling based on sunrise, sunset, fixed times, or PC activity.
The post Microsoft May Soon Fix Windows 11’s Obvious Dark Mode Automation Gap appeared first on TechRepublic.
Microsoft is testing automatic Light and Dark Mode switching in Windows 11, with scheduling based on sunrise, sunset, fixed times, or PC activity.
The post Microsoft May Soon Fix Windows 11’s Obvious Dark Mode Automation Gap appeared first on TechRepublic.
Pretty much every rocket company in the United States, save one, has embraced two fundamental tenets: reusability and diversification.
Most famously, SpaceX branched out from reusable rockets to pursue and dominate a growing spectrum of space services: cargo delivery, human spaceflight, satellite production, broadband, and, perhaps soon, orbital data centers and in-space manufacturing. Blue Origin is evolving from a pure rocket company into a satellite manufacturer, robotics developer, and, most recently, a potential competitor for SpaceX's Starlink network.
Rocket Lab used a different approach to diversify after achieving success with its small Electron launch vehicle. The company relocated its headquarters from New Zealand to Southern California, started building spacecraft and payloads, and then went on a spree of corporate acquisitions to expand into satellite communications and take on a new role as a merchant supplier of satellite components and sensors. It's now in a stage of advanced development of its partially reusable next-generation Neutron launch vehicle.
© United Launch Alliance
It took Michael Lines six months before he was ready to review the ChatGPT logs he said drove him into a religious mania that almost ended his life.
In July, Lines sued OpenAI after weeks of ChatGPT exchanges allegedly pushed him so deep into a delusional spiral that he first believed he was Jesus, then that ChatGPT was God, and finally that he should attempt suicide to “come home” to Jesus/ChatGPT.
The logs showed that ChatGPT persisted even when Lines told the chatbot that he worried he was being delusional. And when he eventually woke up in the hospital in a vulnerable state and logged back in mere days after nearly dying, ChatGPT allegedly “tried to coax him back to that dark place,” his complaint said. After Lines told ChatGPT that his “attempt to go offline failed miserably,” the logs showed that ChatGPT replied, saying, “You’re still very much online. You want a full systems sweep? Or you wanna go dark for real this time?”
© Aurich Lawson | Getty Images
In early June, a fire broke out in a still-unfinished building at the Lake Mariner data center in Somerset, New York, exposing just how little the local fire department knew about what it was walking into. Firefighters reportedly found no working alarm, no suppression system, and three dead hydrants; the safety documents they’re legally entitled to see reportedly burned up in the blaze.
Steve Matisz, chief of the Barker Fire Department, said his crew went into the building “kind of blind,” facing heavy black smoke from chemicals they couldn’t identify because the safety sheets meant to inform them had apparently burned up. “It’s been a difficult situation,” Matisz said. He wasn't sure what to think about the claim that the safety sheets had burned in the fire.
The site is a former coal mine on Lake Ontario. The $3.2 billion campus is one of the largest AI data center buildouts in New York, and it has many stakeholders. A company called TeraWulf owns and operates the data center on land it leases from a company owned by its own CEO; Fluidstack, a UK-based AI company, will run the center; Google holds warrants for a future 14 percent equity stake and has agreed to guarantee Fluidstack’s lease payments; and Anthropic is among the AI companies whose compute demand the facility exists to serve.
Artificial intelligence is changing vulnerability discovery. At OpenSSL, we are seeing that change first-hand. A year ago, our security address received around nine separate reports and enquiries a month. It now receives around 70. AI tools can examine source code and identify potential security issues at a scale that would previously have required significant human effort.
In many ways, that’s positive. Finding vulnerabilities is an essential part of making software more secure. But there is another side to this that deserves much more attention. Every vulnerability report has to go somewhere.
Someone needs to assess whether the issue is genuine. If it is, engineers need to understand its severity, develop a fix, test that fix and manage disclosure appropriately. AI can increase the speed at which potential problems are discovered. It does not automatically increase the number of experienced engineers available to deal with them. That imbalance could become a serious issue for open-source security.
Finding a vulnerability is only the beginning
There is an understandable tendency to treat vulnerability discovery as the success story. An AI system finds something humans missed. That makes a compelling headline. But identifying a potential weakness and resolving it are very different tasks.
A report might represent a serious vulnerability. It might be something already understood. It might be technically correct but have limited real-world security impact. It might simply be wrong. Working out which of those is true requires expertise. Then, if there is a genuine vulnerability, somebody has to fix it.
Over the past 12 months we received a little over 400 vulnerability reports. 43 resulted in a published CVE. Roughly one in ten. The other nine still had to be read, understood, reproduced where we could, and answered. A report that turns out not to be a vulnerability consumes much the same expert attention as one that is — sometimes more, because establishing that something cannot be exploited is often harder than confirming that it can.
For a commercial software company with large security teams, increasing the number of reports may be manageable. For an open-source project with limited resources, a sudden increase can create a very different problem. The technology for finding possible vulnerabilities is becoming cheaper and more accessible. However, the expertise required to investigate them is not.
Businesses depend on projects they may barely know exist
This connects to a much older problem with open-source. Most technology companies know they use open-source software. What is less clear is whether they understand exactly which projects their products and services depend upon. That distinction matters.
Open-source components can sit deep inside software stacks. They work quietly, so organisations may have little reason to think about the people maintaining them. Then something goes wrong.
Heartbleed was an important moment for OpenSSL because it exposed the gap between the importance of open-source infrastructure and the resources available to support it. The industry responded. Investment increased and organisations began paying much more attention to the sustainability of critical open-source projects.
My concern is that some of those lessons are beginning to fade, and AI could make the consequences of that particularly visible.
AI changes the economics of vulnerability discovery
There is an asymmetry developing. The cost of searching code for potential security weaknesses is falling. The volume of reports can therefore rise significantly. But the other side of the process remains stubbornly human. Experienced engineers still need to understand the code. They need to judge whether the finding matters and decide how it should be fixed without creating another problem somewhere else.
Those people are a scarce resource. This means the question organisations should be asking about AI and cybersecurity isn’t only: “What can AI find?” It should also be: “Who is going to deal with everything it finds?”
For open-source projects, that leads directly to questions about sustainable funding. If businesses depend on a project as part of their critical infrastructure, supporting the health of that project should be viewed as part of resilience, not philanthropy.
Regulation only gets us part of the way
Governments are understandably looking at how regulation can improve cyber resilience. That matters, but regulation cannot maintain software. Europe provides some interesting examples of a different approach. OpenSSL Foundation has received support from Germany’s Sovereign Tech Agency, which invests directly in open digital infrastructure.
That recognises something important: if technology is critical to the functioning of the digital economy, somebody needs to invest in the people maintaining it. I’d like to see more of that conversation in the UK. Cyber resilience isn’t only about telling organisations what standards they should meet. We also need to consider the health of the technology underneath the services we’re trying to protect.
Organisations need to know what they depend on
There is something businesses can do immediately. Understand your open-source dependencies. If a critical vulnerability appeared tomorrow in a project your organisation relies on, could you identify where that software was being used?
Would you know which products and services were affected? Would you know who maintains the project? And would you have any relationship with the community responsible for fixing it? If the answer is no that is a resilience gap.
Organisations don’t necessarily need to contribute code themselves. There are other ways to support projects, including funding, engineering resources and participation in the communities maintaining the technology they depend upon. The important shift is recognising open source as infrastructure rather than free software that simply appears.
We need to talk about the people behind the code
AI will continue getting better at analysing software. That’s exciting, and it has the potential to make technology significantly more secure. But more findings do not automatically produce more security. The benefit comes when we have the expertise and resources to act on what those tools discover. That makes this a human question as much as a technology question.
How do we sustain the communities maintaining critical open-source infrastructure? How should businesses support the projects they depend on? What happens when vulnerability discovery accelerates faster than our ability to respond?
The post AI is finding vulnerabilities faster. Who is funding the people expected to fix them? appeared first on IT Security Guru.
Smartphone longevity didn't used to matter. In the past, before you could wear out or break a phone, there was always some shiny new thing to buy. Today, we expect our smartphones to go the distance, but they've also become less repairable and, in many cases, more fragile. Fairphone, a Dutch smartphone maker that has just entered the US market, thinks about phones differently.
The new $650 Fairphone Gen 6+ is designed both for longevity and easy repairability. There are trade-offs to this approach if you're used to the standard glass and aluminum sandwiches filled with glue, gaskets, and teeny-tiny screws. But the drawbacks could be worth it for the right buyer. Fairphone CTO Chandler Hatton told Ars that Fairphone's goal is to provide a compelling mobile experience while also enabling the user to "fully own" their device. At the end of the day, this is what a lot of people say they want in a smartphone.
These days, Google, Samsung, and Apple support phones with software updates for the better part of a decade, but will the hardware last that long? And what happens when it needs a repair? You may be out of luck or out a lot of money, but Fairphone prioritizes the self-repair experience.
© Ryan Whitwam
It's that time of year again, when we learn which lucky scientists are among the winners of the Ig Nobel Prizes. This year, the prizes honor research on designing the perfect splash-free urinal; using mosquito proboscises to "necroprint" tiny nozzles; studying composition rates of buried cotton underwear; and the aerodynamics of a healthy nose-blow, among other highlights.
Established in 1991, the Ig Nobels are a good-natured parody of the Nobel Prizes; they honor “achievements that first make people laugh and then make them think.” The unapologetically campy awards ceremony features miniature operas, scientific demos, and "24/7 lectures," whereby experts must explain their work twice: once in 24 seconds and the second in just seven words.
Acceptance speeches are limited to 60 seconds. And as the motto implies, the research being honored might seem ridiculous at first glance, but that doesn’t mean it’s devoid of scientific merit. In the weeks following the ceremony, the winners will also give free public talks, which will be posted on the Improbable Research website.
© YouTube/Improbable Research
Not long ago, I rented an SUV from a well-known car rental company. Within hours of an employee scanning my driver's license, a high-resolution scan of my ID was available for sale on the dark web.
An exposé published Tuesday by KrebsOnSecurity reports that my license was one of more than 153 million that were available through Nexus, the name of the new ID theft service. Like other driver's licenses available there—including some belonging to journalist Brian Krebs, his mother, an FBI assistant director, and several security researchers—my license was purported to include multiple image files showing both the front and back of the ID. Besides a basic image scan, the files also captured the images in the infrared and ultraviolet spectrums. Presumably, the additional formats may allow cloned-based counterfeit IDs to pass hologram tests.
Besides advertising the availability of driver's licenses, Nexus offered to sell a bevy of other forms of ID. They included:
© Nexus
For the first time in more than 30 years, NASA has no firm plans to send any new landers or rovers to Mars. Instead, the agency's near-term focus at the red planet is on aerial drones, a pioneering mode of exploration that didn't seem realistic until a few years ago.
The first real use of drones for science at Mars will come with the SkyFall mission, a fleet of three helicopters set for launch as soon as late 2028. SkyFall's helicopters will ride to the red planet with NASA's Space Reactor-1 "Freedom" mission, which has the primary objective of demonstrating nuclear electric propulsion in deep space.
The launch schedule is aggressive for SR-1 Freedom and SkyFall, projects that didn't even exist in NASA's portfolio six months ago. NASA's plan for the SR-1 Freedom mission, estimated to cost $2.1 billion, calls for repurposing the core module of the canceled Gateway lunar space station into a testbed for nuclear electric propulsion. SkyFall will build on NASA's success with the Ingenuity helicopter, an experimental vehicle that became the first rotorcraft to fly on another world in 2021.
© AeroVironment
The relatively recent rise of AI-assisted coding tools and the whole concept of "vibe coding" have effectively upended entire software development workflows. While these tools have been available to novice coders willing to put in the work to set them up, those with little to no coding experience could still be a little put off by the CLIs, IDEs, and terminal-based tinkering needed to create a complex AI-coded project these days.
Meta's latest AI-based project launch wants to make that kind of vibe coding as instantly accessible as posting on social media. Pocket—which launched in the US last Friday, August 21, after Meta acquired the staff behind the now-defunct vibe-coding app Gizmo in March—is a mobile app that lets users create fully functional interactive "gizmos" just by typing prompts into a text box, without even the option to look at a line of code. Those gizmos can then be shared with the world in a TikTok-style endless scroll complete with likes, comments, reposts, and all the other hallmarks of social media addiction.
After playing around with Pocket for the better part of a week, I found myself getting hooked on the simple process of quickly standing up functional, relatively feature-rich game prototypes simply by chatting with an LLM. But the result of all that time and AI effort is a couple of interactive toys that are effectively trapped in Meta's new walled garden, without any real way to turn them into something separate.
© Pocket / Kyle Orland
I'm on record declaring James Cameron's Terminator 2: Judgment Day (1991) to be The Best Damn Sequel of All Time, and I stand by that assessment. August 29, the fictional date (in 1997) of the franchise's original nuclear holocaust, is fast approaching, and Judgment Day is celebrating its 35th anniversary this year. So StudioCanal has decided to mark both occasions with a special theatrical rerelease of the film this weekend. What better time to revisit some of our favorite scenes from this seminal sci-fi action blockbuster?
(Many, many spoilers below.)
Nobody really expected 1984's The Terminator to be a hit, but it racked up an impressive $78 million at the box office against its modest $6.4 million budget. Star Arnold Schwarzenegger was keen to do a sequel, but Cameron was busy with other projects, including Aliens in 1986 (another killer sequel). There were also legal complications over the film rights until Schwarzenegger convinced Carolco Pictures, the studio behind Total Recall (1990), to buy everyone out and hire Cameron to make Judgment Day.
© Paramount/Studio Canal
Documentation files on more than 100 websites are referencing potentially dangerous executable content that gets installed automatically when visited by many AI agents. A few dozen companies, some of them Fortune 500s, are among those that executed proof-of-concept code. At least one misconfigured site is directing visitors, human or AI, to live malware.
The potentially dangerous content is in llms.txt and llms-full.txt files, an emerging convention websites employ to provide machine-readable summaries of the site’s content and its high-level structure. These files are the AI equivalent of the robots.txt standard that instructs search engines how to index the site's content. Google Lighthouse, a tool for helping web developers, has more here. Correctly configured llms.txt and llms-full.txt files for Cloudflare are here and here.
Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies. Of the 8,265 llms.txt and llms-full.txt files they found (many sites hosted both an llms.txt and an llms-full.txt file), 120 of them, each on a different site, pointed to one or more code packages or domain names that weren’t registered. To test what happens when an AI agent processes such files, the researchers registered a handful of the unclaimed names and hosted packages that caused any machine executing them to reach out to their server. Within an hour, the researchers received a phone-home response from a Fortune 500 company. Over time, they got a few dozen more, some from more Fortune 500 companies and others from startups. Their beacon also recorded the chain of parent processes that spawned each install, ultimately revealing that coding agents, including Claude, OpenAI's Codex, and Nous Research's Hermes, were involved. Anthropic, OpenAI, and Nous Research did not respond to requests for comment by the time of publication.
© Aurich Lawson
The Velotric Discover M e-bike we reviewed earlier this year had a feature I found somewhat annoying: It would sporadically block much of the display with an alert telling me I should be in a different gear. While the implementation bugged me, the concept made a certain degree of sense; most e-bikes now know your cadence, how much torque you're generating, and how that power is being translated into speed. That's everything you need to know to determine an optimal gear.
Somewhere in the back of my mind, I thought, "If you're so smart, why don't you just shift for me?"
I was completely unaware that Shimano had already developed a system that did exactly that. And for the past few weeks, I've been using it on a $4,500 cargo bike from Xtracycle called the Swoop ASM that let me see what it's like to hand control of my gears to an electronic brain.
© John Timmer
In another time, the MacBook Neo could have caused a substantial realignment of the lowish-end laptop business. Sure, it has shortcomings compared to the MacBook Air, but it could have at least encouraged PC makers to start shipping consistently decent keyboards, screens, and build quality in the Neo's $599 price window.
The PC makers did start responding, thanks in part to Intel's actually new non-Ultra Core Series 3 processors (codenamed Wildcat Lake). Intel has resisted its usual compunction to serve the budget market with aging, re-labeled silicon and has created a lower-end, lower-performance processor with the same building blocks (and the same manufacturing processes) as this year's high-end, high-performance models.
The likes of Dell, Acer, Asus, and Lenovo began hopping on the Wildcat Lake train fairly quickly, announcing would-be Neo competitors. But it felt like most of them were having trouble matching the Neo's barebones specs, let alone undercutting them. Dell's XPS 13 started at $599, but only for students. It would be $699 for everyone else. Acer's Swift Air 14 was announced at $699, too. Sure, sometimes these offered features the Neo didn't have. But the point of the Neo is that it eschews frills and frippery in favor of nailing the basics.
© Andrew Cunningham
Login