Generating videos for projects can be difficult. Not only do you have to create the thing, but you film the process and cut it together in a story that a viewer can follow. Explaining complex topics to the viewer often involves a whiteboard of some sort, but as we all know, its not always a perfect solution. [Jacob] was working on a video game and making videos to document the progress and built a tool called Motion Canvas to help visualize topics like custom shaders. A few months ago, he decided to release it as an open source project.

Since then, it has seen quite a few forks and GitHub forks with a lively showcase on the community Discord. Looking at the docs, it is pretty easy to see why. The interface allows you to write procedural animations using the async semantics of TypeScript while still offering the GUI interface we expect from our video editors. In particular, the signal system allows dependencies to be defined between values. The system runs in Node, and the GUI runs in your browser locally while you edit the files in your terminal/notepad/IDE. CSS and Flexbox are available as the video is rendered to a web canvas and then compiled into a video via FFMPEG. The documentation is quite extensive, and...

Following last week's release of Chrome 114, Mozilla developers today uploaded the release binaries for Firefox 114 ahead of tomorrow's official announcement...

The material can self-heal in just 24 hours when warmed to 158F or in about a week at room temperature.

Stanford professor Zhenan Bao and his team have invented a multi-layer self-healing synthetic electronic skin.

This is according to a report by Fox News published on Friday.

---

Stanford scientists have invented a multi-layer self-healing synthetic electronic skin that can now self-recognize and align with each other when injured, allowing the skin to continue functioning while healing.

Its ideal for search and rescue missions.

Scientists at the ETH Zurich spinoff company Tethys Robotics have developed an underwater robot that can be deployed in situations that are too dangerous for human divers to undertake.

This is according to a report by InceptiveMind published on Saturday.

The new machine is an autonomous underwater vehicle that has been specifically engineered for use in challenging and dangerous environments like turbid channels and rivers. When conventional search and rescue techniques fail, the Tethys robot is there to take over.

Onurdongel/iStock.

This is according to an article by Sifted published this week.

Machine learning has an AI problem. With new breathtaking capabilities from generative AI released every several months and AI hype escalating at an even higher rate its high time we differentiate most of todays practical ML projects from those research advances. This begins by correctly naming such projects: Call them ML, not AI. Including all ML initiatives under the AI umbrella oversells and misleads, contributing to a high failure rate for ML business deployments. For most ML projects, the term AI goes entirely too far it alludes to human-level capabilities. In fact, when you unpack the meaning of AI, you discover just how overblown a buzzword it is: If it doesnt mean artificial general intelligence, a grandiose goal for technology, then it just doesnt mean anything at all.

Page-utils class= article-utilsvertical hide-for-print data-js-target= page-utils data-id= tag: blogs.harvardbusiness.org, 2007/03/31:999.357346 data-title= The AI Hype Cycle Is Distracting Companies data-url=/2023/06/the-ai-hype-cycle-is-distracting-companies data-topic= AI and machine learning data-authors= Eric Siegel data-content-type= Digital Article data-content-image=/resources/images/article_assets/2023/06/Jun23_02_Skizzomat-383x215.jpg data-summary=

By focusing on sci-fi goals, theyre missing out on projects that create real value right now.

hubie writes:

Woodpecker helps managers promote new life in burned forests:

"Gigantic, severe fires are becoming the new norm in California due to drought, longer burn seasons and dense forests. But birds do really well in landscapes that are 'pyrodiverse' areas where fire results in uneven patches burned at high, medium, and low severity," Stillman said.

Black-backed woodpeckers love pyrodiversity. They prefer to build their nest cavities in newly burned areas after high severity fires. But they also like to be adjacent to areas that burned at low intensity, where their young can hide from predators among living trees that still provide cover. Because of the species' unique habitat associations, they are sensitive to the removal of trees after fire, and forest managers use information on the woodpecker to guide their post-fire planning.

After a wildfire, forest managers face difficult decisions about how best to protect and restore the burned areas while balancing the needs of people and wildlife. Sometimes there isn't time to survey wildlife in burned areas, making it hard to choose where to invest in wildlife conservation. To address this need, the researchers developed an online tool to predict the potential abundance of black-backed woodpeckers after fire. Incorporating new information on the value of pyrodiversity made the underlying models more accurate.

"The tool we've created uses data from 11 years of surveys to predict where woodpeckers could be found in the greatest numbers using data available within months after a fire burns," Stillman said. "The birds move in to take advantage of a boom in juicy beetle larvae in the burned trees."

[...] "A burned forest is a unique, incredible and complicated ecosystem that bursts with new life," Stillman said. "At first you think everything is dead. The ground is ash. The trees are black. But as you start walking around, you find that the place is alive. It's not dead, just changed."

Journal Reference:
Andrew N. Stillman, Robert L. Wilkerson, Danielle R. Kaschube, et al., Incorporating pyrodiversity into wildlife habitat assessments for rapid post-fire management: A woodpecker case study, Ecol. App., 2023. DOI: https://doi.org/10.1002/eap.2853

---

Original Submission

Read more of this story at SoylentNews.

At the 2023 Linux Storage, Filesystem, Memory-Management and BPF Summit, Luis Chamberlain led a plenary session on kernel support for block sizes larger than 4KB. There are assumptions in the current kernel that the block size used by a block-layer device is less than or equal to the system's page sizeboth are usually 4KB today. But there have been efforts over the years to remove that restriction; that work may be heading toward fruition, in part because of the folio efforts of late, though there are still lots of areas that need attention.

The 6.3.6, 6.1.32, 5.15.115, 5.10.182, and 5.4.245 stable kernels have been released. They contain a relatively small number of important fixes throughout the kernel tree.

Developers learning the Unix (or POSIX in general) system-call set will quickly encounter file descriptors, which are used to represent open files and more. Developers also tend to learn early on that the first three file descriptors are special, with file descriptor zero being the standard input stream, one being standard output, and two being standard error. The kernel, though, does not normally attach any specific meaning to a given descriptor number, so it was somewhat surprising when a recent BPF patch series attempted to attach a special meaning to zero when used as a file descriptor.

<h2 class="wp-block-heading">Microsoft attributes the recent campaign exploiting a zero-day in the MOVEit Transfer platform to the Clop ransomware gang.</h2> <p>The <a href= "https://securityaffairs.com/142130/cyber-crime/clop-ransomware-goanywhere-mft.html"> Clop ransomware</a> gang (aka <a href= "https://securityaffairs.com/145952/apt/iranian-apt-papercut-exploitation.html"> Lace Tempest</a>) is credited by Microsoft for the recent campaign that exploits a zero-day vulnerability, tracked as <a href= "https://securityaffairs.com/146998/security/cisa-moveit-transfer-0day-catalog.html"> CVE-2023-34362</a>, in the <a href= "https://securityaffairs.com/146963/hacking/moveit-transfer-zero-day.html"> MOVEit Transfer</a> platform.</p> <blockquote class="twitter-tweet"> <p dir="ltr" lang="en">Microsoft is attributing attacks exploiting the CVE-2023-34362 MOVEit Transfer 0-day vulnerability to Lace Tempest, known for ransomware operations & running the Clop extortion site. The threat actor has used similar vulnerabilities in the past to steal data & extort victims. pic.twitter.com/q73WtGru7j

Microsoft Threat Intelligence (@MsftSecIntel) <a href= "https://twitter.com/MsftSecIntel/status/1665537730946670595?ref_src=twsrc%5Etfw"> June 5, 2023</a></blockquote> <p>The Microsoft Threat Intelligence team pointed out that the Lace Tempest group has already used similar vulnerabilities in the past to steal data from organizations worldwide and extort them.</p> <p>MOVEit Transfer is a managed file transfer that is used by enterprises to securely transfer files using SFTP, SCP, and HTTP-based uploads.</p> <p>The vulnerability is a SQL injection vulnerability, it an be exploited by an unauthenticated attacker to gain unauthorized access to MOVEit Transfers database.</p> <p><em>a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an un-authenticated attacker to gain unauthorized access to MOVEit Transfers database. reads the <a href= "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023"><strong>advisory</strong></a> published by the company. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.</em></p> <p>The vulnerability affects all MOVEit Transfer versions, it also shared Indicators of Compromise (IoCs) for this attack and urges customers that notice any of the indicators to immediately <a href= "https://community.progress.com/s/supportlink-landing">contact</a> its...

LogicGate introduced a new OpenAI integration that will help automate and inform GRC processes, including policy generation. Founded in 2015 by seasoned risk consultants, LogicGate automates and centralizes tedious, time-consuming governance, risk, and compliance (GRC) workflows with Risk Cloud, its integrated and scalable GRC platform. Organizations are looking for ways to leverage the new crop of generative AI models to make their risk management and GRC processes much more efficient and automated, said Jon Siegler, More

The post LogicGate accelerates policy management processes with OpenAI integration appeared first on Help Net Security.

Security updates have been issued by Debian (chromium, cpio, mariadb-10.3, nbconvert, sofia-sip, and wireshark), Fedora (ImageMagick, mingw-python-requests, openssl, python3.6, texlive-base, and webkitgtk), Red Hat (apr-util, git, gnutls, kernel, kernel-rt, and kpatch-patch), Slackware (cups and ntp), and Ubuntu (linux-azure-fde, linux-azure-fde-5.15 and perl).

Posted by cpe_dictionary on Jun 05

Good morning,

Thank you for bringing this to our attention. We appreciate community input in order to provide the most accurate and
up-to-date information as possible. After reviewing publicly available information we have made the appropriate
modifications in addition to adding missing versions for the codebase. Please allow up to 24 hours for the changes to
be reflected on the website and in the data feeds.

V/r,
Common Platform Enumeration...

After making passkeys available for consumers in early May, Google is now rolling them out for Google Workspace and Google Cloud accounts. This feature will soon be available (in open beta) for more than 9 million organizations and aims to provide users with a hassle-free sign-in experience without the need for traditional passwords. While users can still continue using passwords to sign in to their work and personal Google Accounts, passkeys can offer a simpler More

The post Google extends passkeys to Google Workspace accounts appeared first on Help Net Security.

A couple years ago, I watched all the movies on the Sight & Sound 2012 Directors Poll Top 100, and that was a lot of fun lots of great movies I hadnt seen before, and lots of stuff I hadnt seen in a long time.

But then there was a new poll in 2022, so I had to watch all the new movies, right?

Right.

So project completed, and heres the new list, and Ill continue nattering on in a random way after the list.

Pos		Year	Title		Prev
#1		1968	2001: A Space Odyssey		#2
#2		1941	Citizen Kane		#2
#3		1972	The Godfather		#7
#4	...

The future, as seen in the popular culture of half a century or more ago, was usually depicted as quite rosy. Technology would have rendered every possible convenience at our fingertips, and wed all live in futuristic automated homes no doubt while wearing silver clothing and dreaming about our next vacation on Mars.

Of course, its not quite worked out this way. A family from 1965 whisked here in a time machine would miss a few things such as a printed newspaper, the landline telephone, or receiving a handwritten letter; they would probably marvel at the possibilities of the Internet, but theyd recognise most of the familiar things around us. We still sit on a sofa in front of a television for relaxation even if the TV is now a large LCD that plays a streaming service, we still drive cars to the supermarket, and we still cook our food much the way they did. George Jetson has not yet even entered the building.

The Future is Here, and it Responds to Alexa

...

Traceable AI announced API Security Reference Architecture for Zero Trust. This reference architecture serves as a guide for security leaders as the industry addresses the urgency of integrating API Security into zero trust security initiatives. Zero trust, a cybersecurity framework that emphasizes continuous verification and helps to minimize the attack surface, has proven effective in enhancing security for many organizations, from large enterprises, to the US Government. However, traditional zero trust approaches have primarily focused More

The post Traceable AI unveils API Security Reference Architecture for Zero Trust appeared first on Help Net Security.

Codeplay Software, which was acquired by Intel last June, has an exciting announcement to make today in the form of the oneAPI Construction Kit. This open-source project aims to help ease bringing up SYCL on new processor/accelerator architectures, particularly around HPC and AI. The oneAPI Construction Kit also has a reference implementation for RISC-V...

Researchers have trained a robotic chef to watch and learn from cooking videos, and recreate the dish itself.

The researchers, from the University of Cambridge, programmed their robotic chef with a cookbook of eight simple salad recipes. After watching a video of a human demonstrating one of the recipes, the robot was able to identify which recipe was being prepared and make it.

In addition, the videos helped the robot incrementally add to its cookbook. At the end of the experiment, the robot came up with a ninth recipe on its own. Their results, reported in the journal IEEE Access, demonstrate how video content can be a valuable and rich source of data for automated food production, and could enable easier and cheaper deployment of robot chefs.

According to 81% of hospital CIOs surveyed by my company, security vulnerability is the leading pain point driving legacy data management decisions. Thats no surprise as healthcare continues to rank as one of the most cyber-attacked industries year over year. In a study by the Health Information and Management Systems Society (HIMSS), 80% of healthcare organizations reported having legacy operating systems in place. Cybersecurity in healthcare is increasingly becoming a chronic condition.

The Cybersecurity and Infrastructure Security Agency (CISA), which measures risk to critical national infrastructure, says legacy software ranks as a dangerous bad practice. Thats because the use of unsupported or end-of-life legacy systems offers some of the easiest entry points for bad actors to gain access and cause havoc within a medical environment. With the average price tag for a healthcare data breach at an all-time high of $10.1 million, the overall cost to a breached organization is high in terms of economic loss and reputation repair.

To fortify defenses against cyberattacks, here are some tips for addressing out-of-production software in healthcare facilities.

In a recent study published in Nature Medicine, researchers conducted a genome-wide analysis of prostate-specific antigen (PSA) levels of men without prostate cancer to understand the non-cancer-related variation in PSA levels to improve decision-making during the diagnosis of prostate cancer.

Study: Genetically adjusted PSA levels for prostate cancer screening. Image Credit: luchschenF/Shutterstock.com.

A new, high-performance all-electric motorcycle just hit the streets, bringing an incredible 250-mile (400-km) NEDC range, in addition to a few tricks that may, thanks to a reported capability to self-balance and actually follow you around, according to a new webpage from Da Vinci Dynamics.

From the surreal world of AI-generated films to a nanoscale robotic hand, check out this weeks awesome tech stories from around the web.

I believe that every function in trade book publishing today can be automated with the help of generative AI. And, if this is true, then the trade book publishing industry as we know it will soon be obsolete. We will need to move on.

There are two quick provisos, however. The first is straightforward: this is not just about ChatGPTor other GPTs (generative pretrained transformers) and LLMs (large language models). A range of associated technologies and processes can and will be brought into play that augment the functionality of generative AI. But generative AI is the key ingredient. Without it, what Im describing is impossible.

The second proviso is of a different flavor. When you make absolutist claims about a technology, people will invariably try to defeat you with another absolute. If you claim that one day all cars will be self-driving, someone will point out that this wont apply to Formula One race cars. Point taken.

With the availability of the BigID Data Classification App on the ServiceNow Store, this expanded relationship provides more advanced security and privacy capabilities for workflow automations. BigID automates the discovery and classification of personal, regulated, critical, and sensitive data in the Now Platform. ServiceNow Vault enables anonymization based on the intelligence about what is sensitive and who should have access. Together, the integration enables advanced data security, privacy, and governance by protecting sensitive data. The More

The post BigID Integrates with ServiceNow to help customers protect sensitive data appeared first on Help Net Security.

SoylentNews PBC had a proper business meeting on Friday, to discuss events since the shutdown notice was posted.

This meeting was attended by myself, Matt Angel, and kolie. I was on the phone for about two hours, combined with multiple follow ups in DMs.

Let's get the good news out first.

SN PBC has agreed to continue operations for SoylentNews.

We also had a very long extended discussion on what the future may look like and some points brought up by staff or members of the community were discussed.

Let's cover all the major points below.

Read more of this story at SoylentNews.

upstart writes:

Amazon workers walk out to protest return to office mandates and the company's climate impact:

Two employee groups at Amazon have joined together to stage a corporate walk out today, uniting to protest the company's return-to-office policy and to raise concerns about Amazon's climate impact.

Standing in front of Amazon's Seattle Headquarters, the group streamed the event live on Twitter featuring speakers for both groups advocating for their united cause. Some speakers vented their frustrations with the company's policy to have workers return to the office for at least three days a week, telling stories about how the remote work kicked off by the COVID pandemic bought them precious hours at home with their family and saved them from hours of daily commute time. Another speaker married this idea to the company's climate goals, highlighting how remote work allowed more families to become one-car households. This dovetails into some of the groups' complaints that Amazon is failing to meet its own goals in its climate pledge of reaching zero emissions by 2040.

[...] "We continue to push hard on getting to net carbon zero by 2040, and we have over 400 companies who've joined us in our Climate Pledge. While we all would like to get there tomorrow, for companies like ours who consume a lot of power, and have very substantial transportation, packaging, and physical building assets, it'll take time to accomplish. We remain on track to get to 100% renewable energy by 2025, and will continue investing substantially, inventing and collaborating both internally and externally to reach our goal.

[...] Amazon also estimated that about 300 of the 65,000 corporate and tech employees in the Puget Sound HQ participated in the walkout; it doesn't look like the Amazon Employees for Climate Justice account has yet provided their own estimate for how many people participated.

---

Original Submission

Read more of this story at SoylentNews.

Microsoft has officially linked the ongoing active exploitation of a critical flaw in the Progress Software MOVEit Transfer application to a threat actor it tracks as Lace Tempest. "Exploitation is often followed by deployment of a web shell with data exfiltration capabilities," the Microsoft Threat Intelligence team said in a series of tweets today. "CVE-2023-34362 allows attackers to

Last week two eastern Idaho hospitals and their clinics were hit by a cyberattack that temporarily impacted their operations.

Last week the Idaho Falls Community Hospital was hit by a cyber attack that impacted its operations. Officials at the hospital confirmed that some clinics closed due to the cyber attack and some ambulances have been diverted to nearby hospitals.

Another hospital in the same region, the Mountain View Hospital, suffered a cyber attack. Officials confirmed that a malware infected some systems of the hospitals IT infrastructure.

The good news is that defense systems at the Hospital quickly identifies the threat and contained the attack, which did not impact patient medical records.

Both hospitals remain open and are safely caring for all their patients and the vast majority of clinics are seeing patients as usual, reads a blog post published on the website of the Idaho Falls Community Hospital.

Both eastern Idaho hospitals and their clinics are working to resume full operations after the cyberattack on their computer systems.

Officials in the Idaho attack have only referred to the problem as a virus that needs to be removed.

At this time it is not clear if the hospitals were targeted by a ransomware attack.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs  hacking, Idaho Hospitals)

The post Idaho Hospitals hit by a cyberattack that impacted their operations appeared first on Security Affairs.

The zero-day vulnerability attackers have exploited to compromise vulnerable Progress Softwares MOVEit Transfer installations finally has an identification number: CVE-2023-34362. Based on information shared by Mandiant, Rapid7 and other security researchers, the attackers seem to have opportunistically targeted as many exposed organizations as possible, including US government agencies and banks. Microsoft is attributing the initial attacks to the Cl0p ransomware group (aka FIN11, or Lace Tempest according to its new threat actor taxonomy). Mandiant More

The post MOVEit Transfer zero-day was exploited by Cl0p gang (CVE-2023-34362) appeared first on Help Net Security.

Over 55% of security executives report that they have experienced a SaaS security incident in the past two years ranging from data leaks and data breaches to SaaS ransomware and malicious apps (as seen in figures 1 and 2). Figure 1. How many organizations have experienced a SaaS security incident within the past two years The SaaS Security Survey Report: Plans and Priorities for 2024,

AntChain announced a new collaboration with Intel to launch AntChain Massive Data Privacy-Preserving Computing Platform (MAPPIC), a new privacy-preserving computing platform that brings a data privacy protection solution for large-scale AI machine learning. As a Software-as-a-Service (SaaS) platform, MAPPIC is based on the Trusted Execution Environment (TEE) technology and provides petabyte-scale AI training data protection capability. Powered by Ant Groups open-source TEE operating system Occlum and Intels open-source framework BigDL PPML, MAPPIC enables developers to More

The post AntChain and Intel launch a privacy-preserving computing platform appeared first on Help Net Security.

The caterpillar drive in The Hunt for Red October allowed the sub to travel virtually undetected through the ocean, but real examples of magnetohydrodynamic drives (MHDs) are rare. The US Navys recently announced Principles of Undersea Magnetohydrodynamic Pumps (PUMP) intends to jump-start the technology for a new era.

Dating back to the 1960s, research on MHDs has been stymied by lower efficiencies when compared with driving a propeller from the same power source. In 1992 the Japanese Yamato-1 prototype, pictured at the top of the page, was able to hit a blistering 6.6 knots (thats 12 kph or 7.4 mph for you landlubbers) with a 4 Tesla liquid helium-cooled MHD. Recent advances courtesy of fusion research have resulted in magnets capable of generating fields up to 20 Telsa, which should provide a...

Last month Linux's sound subsystem maintainer Takashi Iwai published a set of Linux driver patches for MIDI 2.0 support for the USB Audio and Raw MIDI drivers. That roughly six thousand lines of new code for the MIDI 2.0 driver coverage is now expected to be mainlined with the upcoming Linux 6.5 cycle...

VMwares Carbon Black Managed Detection and Response (MDR) team observed a surge of TrueBot activity in May 2023.

Researchers at VMwares Carbon Black Managed Detection and Response (MDR) team warn of a surge of TrueBot activity in May 2023.

Truebot has been active since 2017 and some researchers linked it to the Silence Group, while a recent investigation linked it to threat actor TA505 (aka Evil Corp).

TrueBot is a downloader that gathers information on compromised systems and uses infected systems to carry out other malicious activities, as observed recently with Clop Ransomware

In recent TrueBot attacks, operators exploited a critical vulnerability, tracked as CVE-2022-31199 (CVSS score: 9.8) in Netwrix auditor, as well as Raspberry Robin as delivery vectors.

The attack chain commences with a drive-by-download from Chrome for the executable update.exe. The threat actors attempt to trick users into downloading and executing the above executable masquerading it as a software update.

Once executed the above file, it connected to 94[.]142.138.61, which is a Russian IP address that is known to be attributed to TrueBot. Then a second-stage executable 3ujwy2rz7v.exe was downloaded and executed via cmd.ex...

For those running HP or HP-Compaq business-class systems whether they be desktops or laptops, improved hardware sensor reporting is expected for the upcoming Linux 6.5 kernel thanks to a new HP WMI Sensors driver set to be mainlined...

Today marks nineteen years since I started Phoronix.com for covering the Linux hardware space. It's been a wild ride from the days of 56K modems, graphics driver pains, and having to use NDISWrapper for WiFi device driver support on Linux, among many other Linux hardware pains in the early days. These days the open-source GPU driver scene is far better off, Linux hardware support overall is great, companies continue investing massively into Linux/open-source thanks to the success in the server space over the past two decades, and the Steam Deck has proven to be one of the most interesting Linux-powered consumer devices in recent years...

Manga comics are popular around the globe in a content category that has seen piracy grow significantly in recent years.

This popularity is also apparent in mangas home country Japan, where several dedicated pirate sites are active.

Publishers are working hard to counter this trend and last month they turned to a U.S. court for help. Working with the Japanese anti-piracy group CODA, manga publisher Shueisha obtained a DMCA subpoena that required Cloudflare to uncover the identities of several pirate site operators.

13DL.to Folds

This legal strategy doesnt always pay off as some site operators use strawmen and fake data, but in this case, the publisher struck gold. Soon after the subpoena was issued, Japans largest manga piracy site 13DL.to stopped releasing new content.

New uploads stopped appearing three days after the DMCA subpoena to Cloudflare was issued and the sites operator later confirmed that the site has shut down for good. At the time of writing, its no longer operational.

This is a major win for the publishers as 13DL.to had an estimated 25 million monthly visits, mostly from Japan. The site listed links to fresh manga releases which were distributed through external file-hosting platforms such as RapidGator, TakeFile, Novafile, WupFile, and HexUpload.

Cyberlocker Targets

Several of these hosting sites were also targeted in the DMCA subpoena obtained by the publisher, after they were first targeted in a regular DMCA notice, listed below.

According to CODA, the operator of 13DL was responsible for uploading the pirated comics to t...

RunningWithWind writes:

https://www.bluesnews.com/

Imagine firing up your brand-new Intel 486DX and waiting those several minutes to show Windows, Open American Online and connect to go to your favorite site about Quake Blue's News. One of the oldest and still operated Gaming Websites in the world, it is using crowd sourcing for it's articles and editors similar to SoylentNews to share what is happening in the gaming community. Passing it's 25 year anniversary recently, Blue's News continues to give the latest on Diablo to Science related news. Congrats Blue's News!

[Editor's Comment: There are certainly some news items that we haven't covered that will be of interest to our community. But I am never sure - how big IS our gaming community? Hands up please... JR]

---

Original Submission

Read more of this story at SoylentNews.

The open-source uutils project that is striving to be a drop-in replacement to GNU Coreutils but written within the Rust programming language is out today with a new feature update...

For fans of the lightweight IceWM X11 window manager, released on Sunday was IceWM 3.4 as the newest feature release...

Also available via the Gemini protocol at:

• gemini://gemini.techrights.org/irc-gmi/irc-log-techrights-040623.gmi
• gemini://gemini.techrights.org/irc-gmi/irc-log-040623.gmi
• gemini://gemini.techrights.org/irc-gmi/irc-log-social-040623.gmi
• gemini://gemini.techrights.org/irc-gmi/irc-log-techbytes-040623.gmi

Over HTTP:

#techrights log as HTML5	#boycottnovell log as HTML5
#boycottnovell-social log as HTML5	#techbytes log as HTML5
#techrights log as text	...

Having acquired some piece of old electronic equipment, be it a computer, radio, or some test gear, the temptation is there to plug it in as soon as youve lugged it into the shop. Dont be so hasty. Those power supplies and analog circuits often have a number of old aluminium electrolytic capacitors of unknown condition, and bad things can happen if they suddenly get powered back up again. After a visual inspection, to remove and replace any with obvious signs of leakage and corrosion, those remaining may still not be up to their job, with the oxide layers damaged over time when sat idle, they can exhibit lower than spec capacitance, voltage rating or even be a dead short circuit. [TechTangents] presents for us a guide to detecting and reforming these suspect capacitors to hopefully bring them, safely, back to service once more.

...

A new ongoing Magecart web skimmer campaign abuse legitimate websites to act as makeshift command and control (C2) servers.

Akamai researchers discovered a new ongoing Magecart web skimmer campaign aimed at stealing personally identifiable information (PII) and credit card information from users in North America, Latin America, and Europe.

Magecart attacks target e-commerce websites, the name Magecart is derived from the malicious code (JavaScript) typically injected by the attackers into compromised websites.

In the recent campaign uncovered by Akamai, threat actors hijack legitimate websites to act as makeshift C2 servers and use them to distribute malware.

Attackers employ a number of evasion techniques during the campaign, including obfuscating Base64 and masking the attack to resemble popular third-party services, such as Google Analytics or Google Tag Manager. reads the analysis published by Akamai.

Some of the victim organizations have hundreds of thousands of visitors per month, this implies that their compromise impacted up to tens of thousands of victims. The researchers pointed out that many victims uncovered the attack more than a month after the initial compromise.

The attack chain commences by scanning the web for vulnerable legitimate sites and hacking them to inject malicious code. Attackers used the compromised websites as C2 servers to avoid detection.

Rather than using the attackers own C2 server to host malicious code, which may be flagged as a malicious domain, attackers hack into (using vulnerabilities or any other means at their disposal) a vulnerable, legitimate site, such as a small or medium-sized retail website, and stash their code within it. continues the analysis. In this way, the attackers create a seemingly healthy host for their malicious code, and can deliver it to any victim they choose.

Attackers employ small JavaScript code snippets that act as loaders to fetch the final software skimmer from the victims websites previously compromised.

Threat actors likely compromised the websites by exploiting known vulnerabilities in popular CMS (such as Magento, WooCommerce, WordPress, Shopify, etc.) or in vulnerable third-party services and components used by the website.

The researchers identified two distinct variations of the skimmer code employed in this ongoing campaign. 

contains a list of CSS selectors which explicitly indicated that the skimmer targeted input fields...