Month: September 2023

Enlarge (credit: Getty Images)

Incomplete information included in recent disclosures by Apple and Microsoft reporting critical zero-day vulnerabilities under active exploitation in their products has created a “huge blindspot” that’s causing a large number of offerings from other developers to go unpatched, researchers said Thursday.

Two weeks ago, Apple reported that threat actors were actively exploiting a critical vulnerability in iOS so they could install espionage spyware known as Pegasus. The attacks used a zero-click method, meaning they required no interaction on the part of targets. Simply receiving a call or text on an iPhone was enough to become infected by the Pegasus, which is among the world’s most advanced pieces of known malware.

“Huge blindspot”

Apple said the vulnerability, tracked as CVE-2023-41064, stemmed from a buffer overflow bug in ImageIO, a proprietary framework that allows applications to read and write most image file formats, which include one known as WebP. Apple credited the discovery of the zero-day to Citizen Lab, a research group at the University of Toronto’s Munk School that follows attacks by nation-states targeting dissidents and other at-risk groups.

Enlarge (credit: Getty | picture alliance)

Americans will again have an opportunity to receive free at-home COVID-19 rapid tests from the US government, with orders beginning next Monday, September 25, the Biden administration announced Wednesday.

Households will be eligible to receive four free rapid tests that will "detect the currently circulating COVID-19 variant," the Department of Health and Human Services said in an announcement. The tests, available next week via COVIDTests.gov and expected to start shipping on October 2, are meant to help Americans detect COVID-19 and keep from spreading it for the rest of the year—especially during holiday gatherings.

"At this point, our focus is getting through the holidays and making sure folks can take a test if they’re going to see Grandma for Thanksgiving,” Dawn O’Connell, assistant secretary for preparedness and response at the HHS, told the Associated Press.

Enlarge / The fate of a mission to return samples from Mars hangs in the balance. (credit: NASA)

An independent review of NASA's ambitious mission to return about half a kilogram of rocks and soil from the surface of Mars has found that the program is unworkable in its current form.

NASA had been planning to launch the critical elements of its Mars Sample Return mission, or MSR, as soon as 2028, with a total budget for the program of $4.4 billion. The independent review board's report, which was released publicly on Thursday, concludes that both this timeline and budget are wildly unrealistic.

The very earliest the mission could launch from Earth is 2030, and this opportunity would only be possible with a total budget of $8 billion to $11 billion.

Enlarge / A pendant, espresso cups, and flower planters 3D-printed from used coffee grounds. (credit: Michael Rivera)

Most coffee lovers typically dump the used grounds from their morning cuppa straight into the trash; those more environmentally inclined might use them for composting. But if you're looking for a truly novel application for coffee grounds, consider using them as a sustainable material for 3D printing, as suggested by a recent paper published in DIS '23: Proceedings of the 2023 ACM Designing Interactive Systems Conference.

“You can make a lot of things with coffee grounds,” said co-author Michael Rivera of the University of Colorado, Boulder, and the ATLAS Institute, who specializes in digital fabrication and human-computer interactions. “And when you don’t want it anymore, you can throw it back into a coffee grinder and use the grounds to print again. Our vision is that you could just pick up a few things at a supermarket and online and get going.”

As 3D printers have moved into more widespread use, it has sparked concerns about environmental sustainability, from the high energy consumption to the thermoplastics used as a printing material—most commonly polylactic acid (PLA). PLA waste usually ends up in a landfill where it can take as long as 1,000 years to decompose, per Rivera. While there have been efforts to recycle PLA in the same way plastic (PET) soda bottles are typically recycled, it's an energy-intensive process that can't be done by the average user at home. Adding biomass fillers (bamboo or hemp fiber, oyster shells, and yes, spent coffee grounds) makes recycling even more labor and energy intensive.

Enlarge (credit: Bloomberg / Contributor | Bloomberg)

Yelp has started publicly naming and shaming businesses that pay for reviews. The review site's new index documents businesses offering everything from a crisp $100 bill for leaving the best review to a $400 Home Depot gift card for a five-star review. It also lists every business whose reviews have ever been suspected of suspicious activity, like spamming the site with multiple reviews from a single IP address.

Engadget dubbed Yelp's new index a "wall of shame," suggesting that the information may be used by federal agencies who have spent the past few years cracking down on paid fake reviews. This year, the Federal Trade Commission proposed a ban on "the use of deceptive reviews and testimonials," with penalties up to $50,000 for businesses "caught buying, selling or manipulating online reviews," Engadget reported.

Yelp wants to see the Federal Trade Commission enact the ban, Yelp's head of user operations, Noorie Malik, told Engadget. The FTC noted that Yelp reported 950 suspicious posts, users, or groups facilitating fake reviews in 2021 alone.

Enlarge

In the wake of Unity's sudden fee structure change announcement last week, a European trade group representing thousands of game developers is calling on governments to "update their regulatory framework" to curb what they see as a "looming market failure" caused by "potentially anti-competitive market behavior."

In an open letter published last week, the European Games Developer Federation goes through a lot of the now-familiar arguments for why Unity's decision to charge up to $0.20 per game install will be bad for the industry. The federation of 23 national game developer trade associations argues that the new fee structure will make it "much harder for [small and midsize developers] to build reliable business plans" by "significantly increas[ing] the game development costs for most game developers relying on [Unity's] services."

The organization also publicly worries about "professional game education institutions" that may need to update their curriculums wholesale if there is a mass exodus from Unity's engine. "Many young industry professionals who have built their career plans on mastering Unity’s tools [will be put] in a very difficult position."

• 

  The front of the Pixel Fold display. [credit: iFixit ]

We have more Pixel parts. The Pixel Fold, Google's biggest and most expensive phone, now has a whole parts selection up at iFixit.

The big-ticket item is a repair kit for the 7.6-inch inner display. If you were to somehow break the flexible OLED panel (who would ever do that?), the part will cost you a whopping $900. That's a lot for the display, but you're not actually buying just the top display. Even the "part only" option for $900 is the entire top half of the Pixel Fold. We're talking the display, the bezels around it, the entire metal frame and sides of the phone, the all-important hinge, side buttons, fingerprint sensor, and a whole bunch of wires. You wouldn't buy this and connect it to your original phone; you would part out your original phone and move a few pieces over into this, like the motherboard, batteries, cameras, and back plate.

There's also a flexible display "Fix Kit" for just $10 more that includes a bevy of iFixit tools, like screwdrivers, a few soft-pry tools, a heat pad, a suction cup, 14 different custom-cut adhesive strips, the heat-dissipating graphite sheet, and thermal paste; and for some reason there are even two brand-new batteries.