Author name: Paul Patrick

mini-neptune-turned-out-to-be-a-frozen-super-earth

Mini-Neptune turned out to be a frozen super-Earth

Like Earth, but super —

The density makes it look like a water world, but its dim host star keeps it cool.

Image of three planets on a black background, with the two on the left being mostly white, indicating an icy composition. The one on the right is much smaller, and represents Earth.

Enlarge / Renditions of a possible composition of LHS 1140 b, with a patch of ocean on the side facing its host star. Earth is included at right for scale.

Of all the potential super-Earths—terrestrial exoplanets more massive than Earth—out there, an exoplanet orbiting a star only 40 light-years away from us in the constellation Cetus might be the most similar to have been found so far.

Exoplanet LHS 1140 b was assumed to be a mini-Neptune when it was first discovered by NASA’s James Webb Space Telescope toward the end of 2023. After analyzing data from those observations, a team of researchers, led by astronomer Charles Cadieux, of Université de Montréal, suggest that LHS 1140 b is more likely to be a super-Earth.

If this planet is an alternate version of our own, its relative proximity to its cool red dwarf star means it would most likely be a gargantuan snowball or a mostly frozen body with a substellar (region closest to its star) ocean that makes it look like a cosmic eyeball. It is now thought to be the exoplanet with the best chance for liquid water on its surface, and so might even be habitable.

Cadieux and his team say they have found “tantalizing evidence for a [nitrogen]-dominated atmosphere on a habitable zone super-Earth” in a study recently published in The Astrophysical Journal Letters.

Sorry, Neptune…

In December 2023, two transits of LHS 1140 b were observed with the NIRISS (Near-Infrared Imager and Slitless Spectrograph) instrument aboard Webb. NIRISS specializes in detecting exoplanets and revealing more about them through transit spectroscopy, which picks up the light of an orbiting planet’s host star as it passes through the atmosphere of that planet and travels toward Earth. Analysis of the different spectral bands in that light can then tell scientists about the specific atoms and molecules that exist in the planet’s atmosphere.

To test the previous hypothesis that LHS 1140 b is a mini-Neptune, the researchers created a 3D global climate model, or GCM. This used complex math to explore different combinations of factors that make up the climate system of a planet, such as land, oceans, ice, and atmosphere. Several different GCMs of a mini-Neptune were compared with the light spectrum observed via transit spectroscopy. The model for a mini-Neptune typically involves a gas giant with a thick, cloudless or nearly cloudless atmosphere dominated by hydrogen, but the spectral bands of this model did not match NIRISS observations.

With the possibility of a mini-Neptune being mostly ruled out (though further observations and analysis will be needed to confirm this), Cadieux’s team turned to another possibility: a super-Earth.

An Earth away from Earth?

The spectra observed with NIRISS were more in line with GCMs of a super-Earth. This type of planet would typically have a thick nitrogen or CO2-rich atmosphere enveloping a rocky surface on which there was some form of water, whether in frozen or liquid form.

The models also suggested a secondary atmosphere, which is an atmosphere formed after the original atmosphere of light elements, (hydrogen and helium) escaped during early phases of a planet’s formation. Secondary atmospheres are formed from heavier elements released from the crust, such as water vapor, carbon dioxide, and methane. They’re usually found on warm, terrestrial planets (Earth has a secondary atmosphere).

The most significant Webb/NIRISS data that did not match the GCMs was that the planet has a lower density (based on measurements of its size and mass) than expected for a rocky world. This is consistent with a water world with a mass that’s about 10 to 20 percent water. Based on this estimate, the researchers think that LHS 1140 b might even be a hycean planet—an ocean planet that has most of the attributes of a super-Earth, but an atmosphere dominated by hydrogen instead of nitrogen.

Since it orbits a dim star closely enough to be tidally locked, some models suggest a mostly icy planet with a substellar liquid ocean on its dayside.

While LHS 1140 b may be a super-Earth, the hycean planet hypothesis might end up being ruled out. Hycean planets are prone to the runaway greenhouse effect, which occurs when enough greenhouse gases accumulate in a planet’s atmosphere and prevent heat from escaping. Liquid water will eventually evaporate on a planet that cannot cool itself off.

Though we are getting closer to finding out what kind of planet LHS 1140 b is, and whether it could be habitable, further observations are needed. Cadieux wants to continue this research by comparing NIRISS data with data on other super-Earths that had previously been collected by Webb’s Near-Infrared Spectrograph, or NIRSpec, instrument. At least three transit observations of the planet with Webb’s MIRI, or Mid-Infrared instrument, are also needed to make sure stellar radiation is not interfering with observations of the planet itself.

“Given the limited visibility of LHS 1140b, several years’ worth of observations may be required to detect its potential secondary atmosphere,” the researchers said in the same study.

So could this planet really be a frozen exo-earth? The suspense is going to last a few years.

The Astrophysical Journal Letters, 2024.  DOI:  10.3847/2041-8213/ad5afa

Mini-Neptune turned out to be a frozen super-Earth Read More »

apple-vision-pro’s-content-drought-improves-with-new-3d-videos

Apple Vision Pro’s content drought improves with new 3D videos

Immersive Video —

It’s still not the weekly cadence we expected, but it’s something.

  • Boundless premieres tonight, taking Vision Pro users on a hot air balloon ride in Turkey.

  • Submerged will be Apple’s first fictional short film for Vision Pro.

  • Users will get a glimpse into the 2024 NBA All-Star Weekend.

  • This cryptic image teases The Weeknd’s Vision Pro “experience.”

  • The new series Elevated will tour places of interest around the world from above.

  • Apple is partnering with Red Bull for a surfing documentary.

  • Wild Life returns with an episode about elephants in a wildlife preserve.

Today, Apple announced a slate of more than a dozen upcoming Immersive Videos for its Vision Pro spatial reality headset. The first, titled Boundless, launches tonight at 9 pm ET. More will follow in the coming weeks and months.

The announcement follows a long, slow period for new Vision Pro-specific video content from Apple. The headset launched in early February with a handful of Immersive Video episodes ranging from five to 15 minutes each. Since then, only three new videos have been added.

On March 28, Apple released a highlight reel of Major League Soccer plays from the season that had ended months prior. A second episode of Prehistoric Planet, Apple’s Immersive Video dinosaur nature documentary, went live on April 19. Likewise, a new episode of the Adventure series titled “Parkour” landed on May 24.

The MLS video played more like a short ad for Apple’s MLS programming than anything else, but other Immersive Videos have impressed with their quality if not their creative ambition. They’re all short videos that put the viewer inside a moment in space and time with either animals or people doing their thing. The videos are high-resolution, and the 3D is generally well done. The production values are high, even if the narratives are light. They come across as tech demos, as much as anything, but they are impressive.

Tonight’s Boundless episode will allow viewers to see what it’s like to ride in a hot air balloon over sweeping vistas. Another episode titled “Arctic Surfing” will arrive this fall, Apple says. Sometime next month, Apple will publish the second episode of its real wildlife documentary, simply titled Wild Life. The episode will focus on elephants in Kenya’s Sheldrick Wildlife Trust. Another episode is in the works, too. “Later this year,” Apple writes in its newsroom post, “viewers will brave the deep with a bold group of divers in the Bahamas, who come face-to-face with apex predators and discover creatures much more complex than often portrayed.”

More on the way

In September, we’ll see the debut of a new Immersive Video series titled Elevated. Apple describes it as an “aerial travel series” in which viewers will fly over places of interest. The first episode will take viewers to Hawaii, while another planned for later this year will go to New England.

Apple is additionally partnering with Red Bull for a look at surfing called Red Bull: Big-Wave Surfing.

In addition to those documentary episodes, there will be three short films by year’s end. One will be a musical experience featuring The Weeknd, and another will take basketball fans inside the 2024 NBA All-Star Weekend. There will also be Submerged, the first narrative fictional Immersive Video on the platform. It’s an action short film depicting struggles on a submarine during World War II.

It’s good to see Apple finally making some movement here; the drought of content after the launch didn’t inspire confidence in the platform. Many people with mixed reality headsets use them a bunch for a few weeks but either fail to find ways to fit them into their daily habits or run out of compelling content and taper off before long. To keep people invested in visionOS, Apple needs to keep a rapid cadence of new content that users look forward to at least every week. Otherwise, some users will see their headsets sit on shelves, forgotten.

When I reviewed the Vision Pro, I assumed that the Immersive Video episodes would roll out weekly. That hasn’t proven the case, and it still doesn’t look like it will. Apple is going to have to invest more in content (and take more risks with that content, moving beyond short tech demo documentaries) to make the Vision Pro stick with customers.

Listing image by Apple

Apple Vision Pro’s content drought improves with new 3D videos Read More »

netflix-is-kicking-us-subscribers-off-its-cheapest-ad-free-plan-soon

Netflix is kicking US subscribers off its cheapest ad-free plan soon

It was only a matter of time —

Subscribers will have to pay $15.49 for commercial-free Netflix.

cobra kai

Enlarge / Ad-free Basic subscribers will be crane-kicked off the plan soon.

Netflix/YouTube

Netflix today confirmed suspicions that it will stop letting people pay $12 per month to stream without commercials.

The ad-free Basic plan was the cheapest way to watch Netflix without commercials. The plan limits users to 720p resolution and one device and lets people download content. Netflix stopped offering the Basic plan to new subscribers in January. In June, Netflix started booting subscribers in the UK and Canada off the plan and automatically put them onto a cheaper subscription plan with ads.

In a letter to shareholders today [PDF], Netflix confirmed publicly for the first time that it “will now start” to phase out the ad-free Basic plan in the US and France. This will make the cheapest commercial-free Netflix plan $15.49/month in the US. That Standard plan supports up to two devices, downloads, and 1080p resolution.

Netflix thinks killing the Basic plan will help it gain more subscribers who watch commercials, which, on average, generates more revenue for the company.

As expected from a streaming company these days, Netflix touted its ad tier to shareholders, noting that the $7 tier now represents “over 45 percent” of new sign-ups in areas where it’s sold. Per Netflix’s letter, ads will only be an increasingly larger part of its strategy, as Netflix aims to “achieve critical ad subscriber scale for advertisers in our ad countries in 2025, creating a strong base from which we can further increase our ad membership in 2026 and beyond.”

The news comes as streamers grapple with increasing streaming subscription costs. Netflix most recently hiked pricing in October. In January, the company suggested to shareholders that more price hikes were possible, saying that it would “occasionally ask our members to pay a little extra to reflect” platform improvements.

Not cozying up with competition

If today’s news makes you hope for a convenient streaming-only deal that lets you subscribe to Netflix and another video streaming service for cheaper, you’re out of luck. Netflix today said it’s not interested in streaming-only bundles.

Bundle deals, which combine streaming and other services for a cheaper subscription rate, have become the streaming industry’s answer to high cancellation rates among subscribers, including those who quickly cancel and resubscribe depending on what’s available to stream that month.

In its letter, Netflix noted that although cable or mobile providers or device-makers may offer deals combining Netflix and another streaming service, Netflix does not make deals that bundle it with another rival streamer, like Disney+ or Max. The company claimed that Netflix is already “a go-to destination,” which “limits the benefit to Netflix of bundling directly with other streamers.”

That means if you’re hoping to save money on your Netflix subscription, which keeps getting more expensive, the only options are to watch Netflix with commercials or get a cable-reminiscent bundle that includes a different kind of service, like Comcast or Verizon Wireless.

We know which option Netflix would like you to pick. But for frustrated streamers, finding a reasonable way to watch all the stuff you want online the way you want keeps getting harder.

Netflix added 8 million subscribers in Q2 2024, it said today. It’s still the biggest video streaming service by subscriber count at 278 million. Amazon Prime Video, which claimed “over 200 million” users in April, follows.

Netflix is kicking US subscribers off its cheapest ad-free plan soon Read More »

Navigating the CrowdStrike Outage: Insights from a Tech Industry Veteran

As a seasoned CIO/CISO and tech industry analyst with 35 years of experience, I’ve seen my fair share of cybersecurity incidents. However, the recent CrowdStrike outage stands out due to its extensive impact across multiple sectors. Here’s a deep dive into what happened, the repercussions, and the lessons we can all learn from this incident.

Background and Initial Reaction

I started my journey in IT in the late ’80s when I wrote a piece of software called PleadPerfect. Over the years, I’ve worn many hats—engineer, architect, and executive at both large and small companies. For the last 18 years, I’ve been a CIO/CISO for organizations ranging from 8-11 figures in revenue.

When I first heard about the CrowdStrike-related outage, my initial reaction was one of deep concern. I took a moment of silence in honor of the lost hours my peers and fellow IT pros sacrificed with their families to fix a problem that should never have occurred. The lack of good QA practices shown by CrowdStrike is deeply upsetting. They should have caught this issue in testing before releasing it to the public. The fact that it affected every Windows OS since 2008 is inexcusable.

Understanding the Incident

CrowdStrike’s Falcon software is installed at the core of the OS, which is how it protects machines so effectively. However, this tight integration also causes significant problems when updates are not properly tested. The faulty update led to widespread instances of the “Blue Screen of Death” (BSOD), causing machines to crash and not automatically recover. The recovery process involved booting machines in safe mode and deleting a CrowdStrike file—a task complicated by the inability to remotely enter safe mode on every device/OS. Additionally, best practices dictate securing the boot drive with BitLocker, which requires a key to unlock and enter safe mode. These keys are often stored in systems also affected by this flaw, greatly increasing the effort and time required for recovery.

Such incidents are not uncommon in the cybersecurity industry, but this one is particularly damaging because it stems from a QA and testing issue, not a cybersecurity breach. The tight integration between Falcon and the OS made the damage far more widespread and the recovery process far more onerous.

Impact on Businesses and Services

All sectors and industries were affected, but critical infrastructure sectors were hit the hardest. Transportation (airlines), banking/financial services, and healthcare (hospitals and emergency rooms) pose the most risk to world economies when disrupted. The three biggest US airlines, as well as those around the world, experienced grounded flights and communication issues. Banks in many countries went offline, and hospital networks faced significant disruptions.

Response and Resolution

CrowdStrike’s response to the incident was swift, but I am not sure what more they can do at this point. I did not feel George Kurtz’s (the CEO) apology was “full-throated” and took sufficient responsibility for the incident. This is nobody else’s fault but CrowdStrike’s. While they have committed to helping everyone affected, they have 24,000 customers, all of whom are impacted, so they cannot give each the attention they need. Billions of dollars in damage are being done to those companies from this outage.

Lessons Learned

The key lessons from this incident are clear: Be careful where you place your trust in other companies and partners. Ensure your contracts allow you to seek damages, as that may be the only recourse in such situations. Have a comprehensive disaster recovery (DR) plan and test it regularly. The number of companies having to rebuild their backup infrastructure just to restore systems because they cannot access (or do not have) their BitLocker keys is far too great.

To better prepare for and prevent similar issues, develop and thoroughly test your recovery plans. Consider using a completely different set of security tools for backup and recovery to avoid similar attack vectors. Treat backup and recovery infrastructure as a critical business function and harden it as much as possible.

Future of Cybersecurity

Time will tell how this incident influences future cybersecurity practices and policies. Between the SolarWinds and CrowdStrike issues, both being failures of best practices by the companies themselves, something has to change.

Emerging technologies like AI and machine learning could help predict and prevent similar issues by identifying potential vulnerabilities before they become problems. However, the real fix may lie in revamping processes and possibly having independent bodies audit and certify the practices of technology companies.

Personal Insights

As someone deeply involved in the tech industry, I stay updated with the latest cybersecurity trends and threats by reading extensively, following industry developments, consuming relevant content, talking to peers, and moving out of my silo to share and learn from others.

My advice to fellow CIOs and CISOs is simple: Plan for the worst and test for the worst. If you fail to prepare for these kinds of incidents, you will be in the worst possible position when the board asks for your response.

Final Thoughts

The recent CrowdStrike outage was a wake-up call for many in the tech industry. It highlighted the vulnerabilities inherent in our interconnected world and underscored the need for robust cybersecurity measures. By learning from this incident and implementing the lessons outlined above, we can better prepare for and prevent similar issues in the future.

Stay vigilant, stay prepared, and let’s continue to fortify our defenses against the ever-evolving landscape of cybersecurity threats.

Navigating the CrowdStrike Outage: Insights from a Tech Industry Veteran Read More »

illegal-drug-found-in-diamond-shruumz-candies-linked-to-severe-illnesses

Illegal drug found in Diamond Shruumz candies linked to severe illnesses

More drugs —

New testing finds psilocin, related to psilocybin, in gummies purchased in 2023.

Illegal drug found in Diamond Shruumz candies linked to severe illnesses

Newly released testing data of Diamond Shruumz-brand gummies purchased in 2023 identified the presence of psilocin, a hallucinogenic drug closely related to the magic-mushroom drug psilocybin that is classified as a Schedule I drug, alongside psilocybin, heroin, and LSD.

The finding comes as Diamond Shruumz’s current line of gummies, chocolates, and candy cones is being recalled and are under active investigation in connection to a nationwide rash of severe illnesses, which have involved seizures, intubation, and intensive care. As of the latest update on July 15, 69 people in 28 states have been sickened after eating a Diamond Shruumz product. Sixty of the 69 sought medical care, 36 were hospitalized, and there is one potentially associated death under investigation.

The new finding of psilocin in the products, published by researchers at the University of Virginia, adds to growing concern about psychedelic mushroom candies generally. Although the candies are marketed as being legal, they have often been found to contain various undisclosed illegal drugs, gray market synthetic versions of drugs, as well as dangerous adulterants and contaminants.

In the ongoing investigation of Diamond Shruumz candies—led by the Food and Drug Administration and the Centers for Disease Control and Prevention, with the help of America’s Poison Centers and state and local partners—researchers have not identified psilocin in products linked to the illnesses. Instead, they have found a closely related synthetic hallucinogenic compound called 4-acetoxy-N,N-dimethyltryptamine, also known as psilacetin or 4-AcO-DMT. Psilacetin is thought to be metabolized into psilocin in the body and is said to have similar effects as taking magic mushrooms or psilocybin. The different testing results between the FDA-led investigation and the new UVA study may be due to possible formulation changes between 2023 and 2024 or simply differences in the products or batches of candies tested so far.

The UVA researchers, who published their findings in the CDC’s Morbidity and Mortality Weekly Report, looked into the mushroom candies after four adults reported illnesses to a local poison control center between September and November 2023. The people went to the emergency department with tachycardia, confusion, anxiety or somnolence, and nausea after eating gummy candies labeled as containing Amanita muscaria mushrooms. Amid their investigation into those cases, a 3-year-old also fell ill in June 2024 after accidentally eating two gummies sold as containing A. muscaria. All of the adults and the toddler recovered from their illnesses quickly, though the toddler was hospitalized for a day for observation.

Not legal or safe

A. muscaria is a legal hallucinogenic mushroom that contains psychoactive compounds ibotenic acid and muscimol. These resemble neurotransmitters in the brain and can cause gastrointestinal symptoms, agitation, and seizures.

The UVA researchers couldn’t track down the specific brands or products the sickened adults took, but they collected six similar products from nearby gas stations and smoke shops. Those six products included two Diamond Shruumz products, which were not sold as containing A. muscaria. Using liquid chromatography-mass spectrometry, the researchers found that the two Diamond Shruumz gummy products (Sour Peach Apple and Rainbow flavors) contained psilocin. The Rainbow flavor also contained caffeine.

In addition, a product labeled as “Wonderland Legal Psychedelics Cherry Nirvana” contained psilocin, the synthetic hallucinogen N,N-dimethyltryptamine, a compound found in kratom called mitragynine, and caffeine.  A product labeled as “Urb Magic Amanita Mushroom Watermelon” contained psilocybin, psilocin, and the stimulant 2-phenethylamine. A product called “Psilly’s Legal Psychedelic Mushrooms Fruit Punch” contained the stimulant ephedrine, and the product “Tryp mushroom gummies” wasn’t found to contain any concerning compounds.

The UVA study was not able to test for ibotenic acid or muscimol. In Diamond Shruumz’s recall notice, the company said it had found higher than normal levels of muscimol in its products. FDA testing has not identified muscimol in product testing, according to results released so far.

“People tend to equate ‘legal’ with ‘safe,’ which is not necessarily the case. These products are not regulated and can contain any number of unlabeled substances which, when consumed, can cause undesired symptoms,” lead author of the UVA study Avery Michienzi said in a statement. “Some packages will have QR codes showing that the products were tested in a lab and contain only what they are labeled to contain. These have been found to be inaccurate.”

The FDA this week warned that even though all of Diamond Shruumz’s products have been recalled, they remain on the shelves of stores nationwide. The agency said it is reaching out to industry partners to raise awareness of the recall and monitoring the effectiveness of Diamond Shruumz’s recall efforts.

Illegal drug found in Diamond Shruumz candies linked to severe illnesses Read More »

formula-e-wraps-its-10th-season-this-weekend—what’s-next-for-the-sport?

Formula E wraps its 10th season this weekend—what’s next for the sport?

gen3 eco sounds good —

Team bosses and Formula E’s CEO tell us what has worked and where things go next.

Antonio Felix da Costa, TAG Heuer Porsche Formula E Team, Porsche 99X Electric Gen3

Enlarge / Antonio Felix da Costa leads the way into turn one at Portland International Raceway.

Sam Bagnall/Formula E

PORTLAND, Ore.—Formula E wraps up its 10th series with a pair of races in London this weekend. It’s been a competitive manufacturer’s championship between Porsche and Jaguar. This weekend, seven drivers are still in contention to win the driver’s title after a double-header in Portland on June 29-30 that saw cars going five-wide down the main straight as they reached the highest top speeds of the season. It was the second visit by Formula E to the picturesque Portland International Raceway, and Ars spoke with some of the sport’s bigwigs to see what they think it’s getting right and where the technical evolution of the cars is headed.

Formula E has come a long way since 2014. Racing then exclusively in city centers, the cars were slow at first. And even as they developed, they carried too small a battery to complete even a relatively short race distance. There was a big upgrade in 2018 with the start of season five: The Gen2 car now has battery packs sufficient for 45 minutes-plus-a-lap races. The Gen2 car raced well, too, even putting on a better show at Monaco than Formula 1 has been able to muster for decades.

We expected another big improvement in lap times when the Gen3 car arrived at the start of last season. The Gen3 car featured much less weight and much more power, but also a change of tire supplier. Originally meant to last multiple race weekends, the rubber supplied by Hankook this season and last has much less grip than the Michelins it replaced. That’s kept cornering speeds relatively low and made the cars even harder to drive.

There are no bad drivers in Formula E, but the cars are hard to handle.

Enlarge / There are no bad drivers in Formula E, but the cars are hard to handle.

Sam Bagnall/Getty Images.

That is not necessarily a bad thing, as the series has always written the rules to make things hard on the drivers and teams. For example, while the battery packs are larger now, they still don’t actually have quite enough charge to complete a race distance without careful energy management. But while the race officials get data-rich telemetry streams from all the cars during a race, the teams have to rely on each driver keeping tabs on their own state of charge and reporting that back via radio to the engineers in the garage so the boffins can calculate the optimal strategy.

More technical changes are in store. In 2025 and 2026, the series will move to the Gen3 Evo car, which will have on-demand all-wheel drive and more grip from better tires, among other tweaks. Meanwhile, everyone in Formula E has been thinking hard about Gen4, which is due to arrive for season 13.

What has worked?

I asked Formula E CEO Jeff Dodds, as well as some of the team principals, to start off by blowing their own horns a bit—what’s Formula E been doing right? “We’ve just announced our Gen3 Evo car, which gets to 60 miles an hour in 1.8 seconds, and we’re still an infancy business, only 10 years old, still playing around with early tech. So I think over time, a massive strength of ours is how that technology allows performance of the car to improve,” Dodds said.

At Portland, we saw pack racing down the main straight.

Enlarge / At Portland, we saw pack racing down the main straight.

Simon Galloway/Formula E

McLaren team principal Ian James, who previously led Mercedes to a Formula E championship before it quit the sport, was proud of how far Formula E has come over the last decade. “Gen2 really saw a step forward in that respect and a professionalization of the whole series. I think with Gen3 we’re really starting to unlock the performance potential of electric motorsport. And we’re going to see that take another notch up in Gen3 Evo,” James said.

Existing as a relevant arena for electric vehicle R&D is Formula E’s big strength, according to Nissan team principal Tommaso Volpe. “Representing a big car manufacturer in the sport I think the main strength is how relevant it is for a big transformation that is happening in mobility… using electrification as a key technology,” Volpe said. This is something that the motorsports cannot claim. They have other strengths, but they can not claim to be that relevant, purely speaking from the R&D perspective,” Volpe said.

For a company like Nissan, the primary benefit is still getting its EV tech in front of eyeballs, something Formula E’s deal to stream races live over Roku has no doubt helped. But there are other benefits to participation. “You cannot use the same motor, but the efforts that we put in place when we develop a Formula E car, in maximizing the energy efficiency of the hardware—so the materials we use, the solutions, the design—is something that is absolutely relevant for the core business and you can transfer some of these ideas and experience,” Volpe said.

Formula E wraps its 10th season this weekend—what’s next for the sport? Read More »

crowdstrike-fixes-start-at-“reboot-up-to-15-times”-and-get-more-complex-from-there

CrowdStrike fixes start at “reboot up to 15 times” and get more complex from there

turning it off and back on again, and again, and again —

Admins can also restore backups or manually delete CrowdStrike’s buggy driver.

CrowdStrike fixes start at “reboot up to 15 times” and get more complex from there

Airlines, payment processors, 911 call centers, TV networks, and other businesses have been scrambling this morning after a buggy update to CrowdStrike’s Falcon security software caused Windows-based systems to crash with a dreaded blue screen of death (BSOD) error message.

We’re updating our story about the outage with new details as we have them. Microsoft and CrowdStrike both say that “the affected update has been pulled,” so what’s most important for IT admins in the short term is getting their systems back up and running again. According to guidance from Microsoft, fixes range from annoying but easy to incredibly time-consuming and complex, depending on the number of systems you have to fix and the way your systems are configured.

Microsoft’s Azure status page outlines several fixes. The first and easiest is simply to try to reboot affected machines over and over, which gives affected machines multiple chances to try to grab CrowdStrike’s non-broken update before the bad driver can cause the BSOD. Microsoft says that some of its customers have had to reboot their systems as many as 15 times to pull down the update.

Early guidance for fixing the CrowdStrike bug is simply to reboot systems over and over again so that they can try to grab a non-broken update.

Enlarge / Early guidance for fixing the CrowdStrike bug is simply to reboot systems over and over again so that they can try to grab a non-broken update.

Microsoft

If rebooting doesn’t work

If rebooting multiple times isn’t fixing your problem, Microsoft recommends restoring your systems using a backup from before 4: 09 UTC on July 18 (just after midnight on Friday, Eastern time), when CrowdStrike began pushing out the buggy update. Crowdstrike says a reverted version of the file was deployed at 5: 27 UTC.

If these simpler fixes don’t work, you may need to boot your machines into Safe Mode so you can manually delete the file that’s causing the BSOD errors. For virtual machines, Microsoft recommends attaching the virtual disk to a known-working repair VM so the file can be deleted, then reattaching the virtual disk to its original VM.

The file in question is a CrowdStrike driver located at Windows/System32/Drivers/CrowdStrike/C-00000291*.sys. Once it’s gone, the machine should boot normally and grab a non-broken version of the driver.

Deleting that file on each and every one of your affected systems individually is time-consuming enough, but it’s even more time-consuming for customers using Microsoft’s BitLocker drive encryption to protect data at rest. Before you can delete the file on those systems, you’ll need the recovery key that unlocks those encrypted disks and makes them readable (normally, this process is invisible, because the system can just read the key stored in a physical or virtual TPM module).

This can cause problems for admins who aren’t using key management to store their recovery keys, since (by design!) you can’t access a drive without its recovery key. If you don’t have that key, Cryptography and infrastructure engineer Tony Arcieri on Mastodon compared this to a “self-inflicted ransomware attack,” where an attacker encrypts the disks on your systems and withholds the key until they get paid.

And even if you do have a recovery key, your key management server might also be affected by the CrowdStrike bug.

We’ll continue to track recommendations from Microsoft and CrowdStrike about fixes as each company’s respective status pages are updated.

“We understand the gravity of the situation and are deeply sorry for the inconvenience and disruption,” wrote CrowdStrike CEO George Kurtz on X, formerly Twitter. “We are working with all impacted customers to ensure that systems are back up and they can deliver the services their customers are counting on.”

CrowdStrike fixes start at “reboot up to 15 times” and get more complex from there Read More »

major-outages-at-crowdstrike,-microsoft-leave-the-world-with-bsods-and-confusion

Major outages at CrowdStrike, Microsoft leave the world with BSODs and confusion

Y2K24 —

Nobody’s sure who’s at fault for each outage: Microsoft, CrowdStrike, or both.

A passenger sits on the floor as long queues form at the check-in counters at Ninoy Aquino International Airport, on July 19, 2024 in Manila, Philippines.

Enlarge / A passenger sits on the floor as long queues form at the check-in counters at Ninoy Aquino International Airport, on July 19, 2024 in Manila, Philippines.

Ezra Acayan/Getty Images

Millions of people outside the IT industry are learning what CrowdStrike is today, and that’s a real bad thing. Meanwhile, Microsoft is also catching blame for global network outages, and between the two, it’s unclear as of Friday morning just who caused what.

After cybersecurity firm CrowdStrike shipped an update to its Falcon Sensor software that protects mission-critical systems, blue screens of death (BSODs) started taking down Windows-based systems. The problems started in Australia and followed the dateline from there.

TV networks, 911 call centers, and even the Paris Olympics were affected. Banks and financial systems in India, South Africa, Thailand, and other countries fell as computers suddenly crashed. Some individual workers discovered that their work-issued laptops were booting to blue screens on Friday morning. The outages took down not only Starbucks mobile ordering, but also a single motel in Laramie, Wyoming.

Airlines, never the most agile of networks, were particularly hard-hit, with American Airlines, United, Delta, and Frontier among the US airlines overwhelmed Friday morning.

CrowdStrike CEO “deeply sorry”

Fixes suggested by both CrowdStrike and Microsoft for endlessly crashing Windows systems range from “reboot it up to 15 times” to individual driver deletions within detached virtual OS disks. The presence of BitLocker drive encryption on affected devices further complicates matters.

CrowdStrike CEO George Kurtz posted on X (formerly Twitter) at 5: 45 am Eastern time that the firm was working on “a defect found in a single content update for Windows hosts,” with Mac and Linux hosts unaffected. “This is not a security incident or cyberattack. The issue has been identified, isolated and a fix has been deployed,” Kurtz wrote. Kurtz told NBC’s Today Show Friday morning that CrowdStrike is “deeply sorry for the impact that we’ve caused to customers.”

As noted on Mastodon by LittleAlex, Kurtz was the Chief Technology Officer of security firm McAfee when, in April 2010, that firm sent an update that deleted a crucial Windows XP file that caused widespread outages and required system-by-system file repair.

The costs of such an outage will take some time to be known, and will be hard to measure. Cloud cost analyst CloudZero estimated mid-morning Friday that the CrowdStrike incident had already cost $24 billion, based on a previous estimate.

Multiple outages, unclear blame

Microsoft services were, in a seemingly terrible coincidence, also down overnight Thursday into Friday. Multiple Azure services went down Thursday evening, with the cause cited as “a backend cluster management workflow [that] deployed a configuration change causing backend access to be blocked between a subset of Azure Storage clusters and compute resources in the Central US region.”

A spokesperson for Microsoft told Ars in a statement Friday that the CrowdStrike update was not related to its July 18 Azure outage. “That issue has fully recovered,” the statement read.

News reporting on these outages has so far blamed either Microsoft, CrowdStrike, or an unclear mixture of the two as the responsible party for various outages. It may be unavoidable, given that the outages are all happening on one platform, Windows. Microsoft itself issued an “Awareness” regarding the CrowdStrike BSOD issue on virtual machines running Windows. The firm was frequently updating it Friday, with a fix that may or may not surprise IT veterans.

“We’ve received feedback from customers that several reboots (as many as 15 have been reported) may be required, but overall feedback is that reboots are an effective troubleshooting step at this stage,” Microsoft wrote in the bulletin. Alternately, Microsoft recommend customers that have a backup from “before 19: 00 UTC on the 18th of July” restore it, or attach the OS disk to a repair VM to then delete the file (Windows/System32/Drivers/CrowdStrike/C00000291*.sys) at the heart of the boot loop.

Security consultant Troy Hunt was quoted as describing the dual failures as “the largest IT outage in history,” saying, “basically what we were all worried about with Y2K, except it’s actually happened this time.”

United Airlines told Ars that it was “resuming some flights, but expect schedule disruptions to continue throughout Friday,” and had issued waivers for customers to change travel plans. American Airlines posted early Friday that it had re-established its operations by 5 am Eastern, but expected delays and cancellations throughout Friday.

Ars has reached out to CrowdStrike for comment and will update this post with response.

This is a developing story and this post will be updated as new information is available.

Major outages at CrowdStrike, Microsoft leave the world with BSODs and confusion Read More »

fcc-closes-“final-loopholes”-that-keep-prison-phone-prices-exorbitantly-high

FCC closes “final loopholes” that keep prison phone prices exorbitantly high

A telephone on a wall inside a prison.

Enlarge / A telephone in a prison.

The Federal Communications Commission today voted to lower price caps on prison phone calls and closed a loophole that allowed prison telecoms to charge high rates for intrastate calls. Today’s vote will cut the price of interstate calls in half and set price caps on intrastate calls for the first time.

The FCC said it “voted to end exorbitant phone and video call rates that have burdened incarcerated people and their families for decades. Under the new rules, the cost of a 15-minute phone call will drop to $0.90 from as much as $11.35 in large jails and, in small jails, to $1.35 from $12.10.”

The new rules are expected to take effect in January 2025 for all prisons and for jails with at least 1,000 incarcerated people. The rate caps would take effect in smaller jails in April 2025.

Worth Rises, a nonprofit group advocating for prison reform, said it “estimates that the new rules will impact 83 percent of incarcerated people (about 1.4 million) and save impacted families at least $500 million annually.”

New power over intrastate calls

The FCC has taken numerous votes to lower prison phone rates over the years, but today’s is particularly significant. While the FCC was previously able to cap prices of interstate calls, an attempt to set prices for intrastate calls was struck down in court in 2017.

Prison phone companies could sue again. But the FCC said it now has authority over intrastate prison phone prices because of the Martha Wright-Reed Just and Reasonable Communications Act, which was approved by Congress and signed by President Biden in January 2023. The new law “empowered the FCC to close the final loopholes in the communications system,” the commission said.

The 2023 law—named for a grandmother who campaigned for lower prison phone rates—”removes the principal statutory limitations that had prevented the Commission from setting comprehensive just and reasonable rates,” the FCC said. Specifically, the law removed “limits to the Commission’s ability to regulate rates for intrastate calls and video communications.”

More than half of prison audio call traffic is intrastate, with the calling and called parties both in the same state, according to data in a draft of the FCC order released before the meeting.

The FCC’s work to reduce prison phone rates “was not always embraced by the courts,” Chairwoman Jessica Rosenworcel said today. “We were told—over and over again—that the commission did not have the authority to address every aspect of these rates, because while interstate calls fell within our jurisdiction, intrastate calls did not.”

Previously, the FCC imposed price caps on interstate calls ranging from $0.14 to $0.21 per minute for audio calls, depending on the size of the facility. Going forward, a uniform set of price caps ranging from $0.06 to $0.12 per minute will apply to both interstate and intrastate calls.

FCC closes “final loopholes” that keep prison phone prices exorbitantly high Read More »

the-next-nvidia-driver-makes-even-more-gpus-“open,”-in-a-specific,-quirky-way

The next Nvidia driver makes even more GPUs “open,” in a specific, quirky way

You know open when you see it —

You can’t see inside the firmware, but more open code can translate it for you.

GeForce RTX 4060 cards on display in a case

Getty Images

You have to read the headline on Nvidia’s latest GPU announcement slowly, parsing each clause as it arrives.

“Nvidia transitions fully” sounds like real commitment, a burn-the-boats call. “Towards open-source GPU,” yes, evoking the company’s “first step” announcement a little over two years ago, so this must be progress, right? But, back up a word here, then finish: “GPU kernel modules.”

So, Nvidia has “achieved equivalent or better application performance with our open-source GPU kernel modules,” and added some new capabilities to them. And now most of Nvidia’s modern GPUs will default to using open source GPU kernel modules, starting with driver release R560, with dual GPL and MIT licensing. But Nvidia has moved most of its proprietary functions into a proprietary, closed-source firmware blob. The parts of Nvidia’s GPUs that interact with the broader Linux system are open, but the user-space drivers and firmware are none of your or the OSS community’s business.

Is it better than what existed before? Certainly. AMD and Intel have maintained open source GPU drivers, in both the kernel and user space, for years, though also with proprietary firmware. This brings Nvidia a bit closer to the Linux community and allows for community debugging and contribution. There’s no indication that Nvidia aims to go further with its open source moves, however, and its modules remain outside the main kernel, packaged up for users to install themselves.

Not all GPUs will be able to use the open source drivers: a number of chips from the Maxwell, Pascal, and Volta lines; GPUs from the Turing, Ampere, Ada Lovelace, and Hopper architectures are recommended to switch to the open bits; and Grace Hopper and Blackwell units must do so.

As noted by Hector Martin, a developer on the Asahi Linux distribution, at the time of the first announcement, this shift makes it easier to sandbox closed-source code while using Nvidia hardware. But the net amount of closed-off code is about the same as before.

Nvidia’s blog post has details on how to integrate its open kernel modules onto various systems, including CUDA setups.

The next Nvidia driver makes even more GPUs “open,” in a specific, quirky way Read More »

nintendo-world-championships:-nes-edition-gave-me-new-respect-for-gaming-speedrunners

Nintendo World Championships: NES Edition gave me new respect for gaming speedrunners

Get ready to repeat this ~25-second slice of <em>Mario</em> over and over… and over… and over.” src=”https://cdn.arstechnica.net/wp-content/uploads/2024/07/nwc3-800×450.png”></img><figcaption>
<p><a data-height=Enlarge / Get ready to repeat this ~25-second slice of Mario over and over… and over… and over.

If you’ve ever seen a record-breaking video game speedrun or watched a Games Done Quick marathon, you may have entertained fantasies that you, too, could put up some decent times on your favorite old games. Sure, it would probably take a bit of practice, but what these speedrunners are doing doesn’t look that difficult, does it? How hard can it be to press a few buttons with good timing for a few minutes?

After spending a few weeks with Nintendo World Championships: NES Edition, I no longer think that way. The game’s bite-size chunks of classic Nintendo games highlight the level of precision needed for even a few minutes of speedrunning perfection, not to mention the tedium of practicing the same in-game motions dozens of times to build up the needed muscle memory. In the process, I gained a newfound respect for the skill displayed by the best speedrunners and found a fresh way to experience some classic NES games that I felt I knew backward and forward.

Gotta go fast

While Nintendo World Championships draws its name from a series of competitions dating back to 1990, it draws its inspiration much more directly from the more recent rise of the online speedrunning community. Thus, the game’s main single-player mode is named “Speedrun,” tasking players with putting up the fastest times in 150 mini-challenges spread across 13 different Nintendo-developed NES titles.

Really? Get the Morph Ball? That's all you want me to do here?

Enlarge / Really? Get the Morph Ball? That’s all you want me to do here?

Nintendo

The earliest of these many unlockable challenges seem almost insultingly easy on their face—collecting the first Super Mushroom in Super Mario Bros. or collecting the sword in The Legend of Zelda, for instance. When you first dive in, you may be more than a little bemused to find yourself showered with in-game rewards for spending just a few seconds completing such basic tasks.

But then you look at how much time that challenge took you—which is thrown up in huge numbers on the screen—alongside an even bigger letter grade. The “A” you got for collecting that Mushroom might seem pretty good, at first, but you know you could do better if you didn’t miss the item box with your first few jumps. So you quickly restart the challenge (and breathe deep through a helpful three-second countdown) and trim off half a second on your second attempt, earning an “A+” for your efforts.

If you are a certain type of player, you might say, “Alright, that’s good enough,” rather than repeating this cycle yet again (if so, I’d argue this game is not for you). But if you’re a different type of gamer, the mere knowledge that you could achieve an S rank with some combination of strategy and execution will propel you through entire minutes of repeated attempts, looking to optimize the perfect few seconds of button presses.

The fact that Nintendo doesn’t reveal the specific timing cutoffs for the different letter grades is equal parts frustrating and subtly encouraging, here. There were plenty of challenges where I felt I played as optimally as I could only to be greeted with a mere “A++” rank next to my new best time. The S rank’s mere existence often inspired me to redouble my efforts and look for new ways to trim even more time off my personal best.

Nintendo World Championships: NES Edition gave me new respect for gaming speedrunners Read More »

vulnerability-in-cisco-smart-software-manager-lets-attackers-change-any-user-password

Vulnerability in Cisco Smart Software Manager lets attackers change any user password

GET YER PATCH —

Yep, passwords for administrators can be changed, too.

Vulnerability in Cisco Smart Software Manager lets attackers change any user password

Cisco on Wednesday disclosed a maximum-security vulnerability that allows remote threat actors with no authentication to change the password of any user, including those of administrators with accounts, on Cisco Smart Software Manager On-Prem devices.

The Cisco Smart Software Manager On-Prem resides inside the customer premises and provides a dashboard for managing licenses for all Cisco gear in use. It’s used by customers who can’t or don’t want to manage licenses in the cloud, as is more common.

In a bulletin, Cisco warns that the product contains a vulnerability that allows hackers to change any account’s password. The severity of the vulnerability, tracked as CVE-2024-20419, is rated 10, the maximum score.

“This vulnerability is due to improper implementation of the password-change process,” the Cisco bulletin stated. “An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.”

There are no workarounds available to mitigate the threat.

It’s unclear precisely what an attacker can do after gaining administrative control over the device. One possibility is that the web user interface and application programming interface the attacker gains administrative control over make it possible to pivot to other Cisco devices connected to the same network and, from there, steal data, encrypt files, or perform similar actions. Cisco representatives didn’t immediately respond to an email. This post will be updated if a response comes later.

A security update linked to the bulletin fixes the vulnerability. Cisco said it isn’t aware of any evidence that the vulnerability is being actively exploited.

Vulnerability in Cisco Smart Software Manager lets attackers change any user password Read More »