Author name: Paul Patrick

nasa-still-doesn’t-understand-root-cause-of-orion-heat-shield-issue

NASA still doesn’t understand root cause of Orion heat shield issue

artemis, artemis II, human spaceflight, Lockheed Martin, moon, NASA, orion, Space / /

Flight rationale —

“When we stitch it all together, we’ll either have flight rationale or we won’t.”

–

NASA's Orion spacecraft descends toward the Pacific Ocean on December 11, 2021, at the end of the Artemis I mission.

Enlarge / NASA’s Orion spacecraft descends toward the Pacific Ocean on December 11, 2021, at the end of the Artemis I mission.

NASA

NASA officials declared the Artemis I mission successful in late 2021, and it’s hard to argue with that assessment. The Space Launch System rocket and Orion spacecraft performed nearly flawlessly on an unpiloted flight that took it around the Moon and back to Earth, setting the stage for the Artemis II, the program’s first crew mission.

But one of the things engineers saw on Artemis I that didn’t quite match expectations was an issue with the Orion spacecraft’s heat shield. As the capsule streaked back into Earth’s atmosphere at the end of the mission, the heat shield ablated, or burned off, in a different manner than predicted by computer models.

More of the charred material than expected came off the heat shield during the Artemis I reentry, and the way it came off was somewhat uneven, NASA officials said. Orion’s heat shield is made of a material called Avcoat, which is designed to burn off as the spacecraft plunges into the atmosphere at 25,000 mph (40,000 km per hour). Coming back from the Moon, Orion encountered temperatures up to 5,000° Fahrenheit (2,760° Celsius), hotter than a spacecraft sees when it reenters the atmosphere from low-Earth orbit.

Despite heat shield issue, the Orion spacecraft safely splashed down in the Pacific Ocean. Engineers discovered the uneven charring during post-flight inspections.

No answers yet

Amit Kshatriya, who oversees development for the Artemis missions in NASA’s exploration division, said Friday that the agency is still looking for the root cause of the heat shield issue. Managers want to be sure they understand the cause before proceeding with Artemis II, which will send astronauts Reid Wiseman, Victor Glover, Christina Koch, and Jeremy Hansen on a 10-day flight around the far side of the Moon.

This will be the first time humans fly near the Moon since the last Apollo mission in 1972. In January, NASA announced a delay in the launch of Artemis II from late 2024 until September 2025, largely due to the unresolved investigation into the heat shield issue.

“We are still in the middle of our investigation on the performance of the heat shield from Artemis I,” Kshatriya said Friday in a meeting with a committee of the NASA Advisory Council.

Engineers have performed sub-scale heat shield tests in wind tunnels and arc jet facilities to better understand what led to the uneven charring on Artemis I. “We’re getting close to the final answer in terms of that cause,” Kshatriya said.

NASA officials previously said it is unlikely they will need to make changes to the heat shield already installed on the Orion spacecraft for Artemis II, but haven’t ruled it out. A redesign or modifications to the Orion heat shield on Artemis II would probably delay the mission by at least a year.

Instead, engineers are analyzing all of the possible trajectories the Orion spacecraft could fly when it reenters the atmosphere at the end of the Artemis II mission. On Artemis I, Orion flew a skip reentry profile, where it dipped into the atmosphere, skipped back into space, and then made a final descent into the atmosphere, sort of like a rock skipping across a pond. This profile allows Orion to make more precise splashdowns near recovery teams in the Pacific Ocean and reduces g-forces on the spacecraft and the crew riding inside. It also splits up the heat load on the spacecraft into two phases.

The Apollo missions flew a direct reentry profile. There is also a reentry mode available called a ballistic entry, in which the spacecraft would fly through the atmosphere unguided.

Ground teams at NASA's Kennedy Space Center in Florida moved the Orion spacecraft for the Artemis II mission into an altitude chamber earlier this month.

Enlarge / Ground teams at NASA’s Kennedy Space Center in Florida moved the Orion spacecraft for the Artemis II mission into an altitude chamber earlier this month.

The charred material began flying off the heat shield in the first phase of the skip reentry. Engineers are looking at how the skip reentry profile affected the performance of the Orion heat shield. NASA wants to understand how the Orion heat shield would perform during each of the possible reentry trajectories for Artemis II.

“What we have the analysis teams off doing is saying, ‘OK, independent of what the constraints are going to be, what can we tolerate?” Kshatriya said.

Once officials understand the cause of the heat shield charring, engineers will determine what kind of trajectory Artemis II needs to fly on reentry to minimize risk to the crew. Then, managers will look at building what NASA calls flight rationale. Essentially, this is a process of convincing themselves the spacecraft is safe to fly.

“When we stitch it all together, we’ll either have flight rationale or we won’t,” Kshatriya said.

Assuming NASA approves the flight rationale for Artemis II, there will be additional discussions about how to ensure Orion heat shields are safe to fly on downstream Artemis missions, which will have higher-speed reentry profiles as astronauts return from landings on the Moon.

In the meantime, preparations on the Orion spacecraft for Artemis II continue at NASA’s Kennedy Space Center. The crew and service modules for Artemis II were mated together earlier this year, and the entire Orion spacecraft is now inside a vacuum chamber for environmental testing.

NASA still doesn’t understand root cause of Orion heat shield issue Read More »

putting-microsoft’s-cratering-xbox-console-sales-in-context

Putting Microsoft’s cratering Xbox console sales in context

gaming, microsoft, Nintendo, PlayStation, ps4, ps5, Sony, Switch, xbox / /

Down but not out —

Why declining quarterly numbers might not be awful news for Microsoft’s gaming business.

–

Scale is important, especially when talking about relative console sales.

Enlarge / Scale is important, especially when talking about relative console sales.

Aurich Lawson | Getty Images

Yesterday, Microsoft announced that it made 31 percent less off Xbox hardware in the first quarter of 2024 (ending in March) than it had the year before, a decrease it says was “driven by lower volume of consoles sold.” And that’s not because the console sold particularly well a year ago, either; Xbox hardware revenue for the first calendar quarter of 2023 was already down 30 percent from the previous year.

Those two data points speak to a console that is struggling to substantially increase its player base during a period that should, historically, be its strongest sales period. But getting wider context on those numbers is a bit difficult because of how Microsoft reports its Xbox sales numbers (i.e., only in terms of quarterly changes in total console hardware revenue). Comparing those annual shifts to the unit sales numbers that Nintendo and Sony report every quarter is not exactly simple.

Context clues

Significant declines in Xbox hardware revenue for four of the last five quarters stand out relative to competitors' unit sales.

Enlarge / Significant declines in Xbox hardware revenue for four of the last five quarters stand out relative to competitors’ unit sales.

Kyle Orland

To attempt some direct contextual comparison, we took unit sales numbers for some recent successful Sony and Nintendo consoles and converted them to Microsoft-style year-over-year percentage changes (aligned with the launch date for each console). For this analysis, we skipped over each console’s launch quarter, which contains less than three months of total sales (and often includes a lot of pent-up early adopter demand). We also skipped the first four quarters of a console’s life cycle, which don’t have a year-over-year comparison point from 12 months prior.

This still isn’t a perfect comparison. Unit sales don’t map directly to total hardware revenue due to things like inflation, remainder sales of Xbox One hardware, and price cuts/discounts (though the Xbox Series S/X, PS5, and Switch still have yet to see official price drops). It also doesn’t take into account the baseline sales levels from each console’s first year of sales, making total lifetime sales performance on the Xbox side hard to gauge (though recent data from a Take-Two investment call suggests the Xbox Series S/X has been heavily outsold by the PS5, at this point).

Even with all those caveats, the comparative data trends are pretty clear. At the start of their fourth full year on the market, recent successful consoles have been enjoying a general upswing in their year-over-year sales. Microsoft stands out as a major outlier, making less revenue from Xbox hardware in four of the last five quarters on a year-over-year basis.

Falling like dominoes.

Enlarge / Falling like dominoes.

Aurich Lawson

Those numbers suggest that the hardware sales rate for the Xbox Series S/X may have already peaked in the last year or two. That would be historically early for a console of this type; previous Ars analyses have shown PlayStation consoles generally see their sales peaks in their fourth or fifth year of life, and Nintendo portables have shown a similar sales trend, historically. The Xbox Series S/X progression, on the other hand, looks more similar to that of the Wii U, which was already deep in a “death spiral” at a similar point in its commercial life.

This is not the end

In the past, console sales trends like these would have been the sign of a hardware maker’s wider struggles to stay afloat in the gaming business. However, in today’s gaming market, Microsoft is in a place where console sales are not strictly required for overall success.

For instance, Microsoft’s total gaming revenue for the latest reported quarter was up 51 percent, thanks in large part to the “net impact from the Activision Blizzard acquisition.” Even before that (very expensive) merger was completed, Microsoft’s total gaming revenue was often partially buoyed by “growth in Game Pass” and strong “software content” sales across PC and other platforms.

Owning Call of Duty means being one of the biggest PS5 game publishers almost by definition.

Enlarge / Owning Call of Duty means being one of the biggest PS5 game publishers almost by definition.

Activision

Perhaps it’s no surprise that Microsoft has shown increasing willingness to take some former Xbox console exclusives to other platforms in recent months. In fact, following the Activision/Blizzard merger, Microsoft is now publishing more top-sellers on the PS5 than Sony. And let’s not forget the PC market, where Microsoft continues to sell millions of games above and beyond its PC Game Pass subscription business.

So, while the commercial future of Xbox hardware may look a bit uncertain, the future of Microsoft’s overall gaming business is in much less dire straits. That would be true even if Microsoft’s Xbox hardware revenue fell by 100 percent.

Putting Microsoft’s cratering Xbox console sales in context Read More »

court-upholds-new-york-law-that-says-isps-must-offer-$15-broadband

Court upholds New York law that says ISPs must offer $15 broadband

affordable broadband, Policy / /
A judge's gavel resting on a pile of one-dollar bills

Getty Images | Creativeye99

A federal appeals court today reversed a ruling that prevented New York from enforcing a law requiring Internet service providers to sell $15 broadband plans to low-income consumers. The ruling is a loss for six trade groups that represent ISPs, although it isn’t clear right now whether the law will be enforced.

New York’s Affordable Broadband Act (ABA) was blocked in June 2021 by a US District Court judge who ruled that the state law is rate regulation and preempted by federal law. Today, the US Court of Appeals for the 2nd Circuit reversed the ruling and vacated the permanent injunction that barred enforcement of the state law.

For consumers who qualify for means-tested government benefits, the state law requires ISPs to offer “broadband at no more than $15 per month for service of 25Mbps, or $20 per month for high-speed service of 200Mbps,” the ruling noted. The law allows for price increases every few years and makes exemptions available to ISPs with fewer than 20,000 customers.

“First, the ABA is not field-preempted by the Communications Act of 1934 (as amended by the Telecommunications Act of 1996), because the Act does not establish a framework of rate regulation that is sufficiently comprehensive to imply that Congress intended to exclude the states from entering the field,” a panel of appeals court judges stated in a 2-1 opinion.

Trade groups claimed the state law is preempted by former Federal Communications Commission Chairman Ajit Pai’s repeal of net neutrality rules. Pai’s repeal placed ISPs under the more forgiving Title I regulatory framework instead of the common-carrier framework in Title II of the Communications Act.

2nd Circuit judges did not find this argument convincing:

Second, the ABA is not conflict-preempted by the Federal Communications Commission’s 2018 order classifying broadband as an information service. That order stripped the agency of its authority to regulate the rates charged for broadband Internet, and a federal agency cannot exclude states from regulating in an area where the agency itself lacks regulatory authority. Accordingly, we REVERSE the judgment of the district court and VACATE the permanent injunction.

Be careful what you lobby for

The judges’ reasoning is similar to what a different appeals court said in 2019 when it rejected Pai’s attempt to preempt all state net neutrality laws. In that case, the US Court of Appeals for the District of Columbia Circuit said that “in any area where the Commission lacks the authority to regulate, it equally lacks the power to preempt state law.” In a related case, ISPs were unable to block a California net neutrality law.

Several of the trade groups that sued New York “vociferously lobbied the FCC to classify broadband Internet as a Title I service in order to prevent the FCC from having the authority to regulate them,” today’s 2nd Circuit ruling said. “At that time, Supreme Court precedent was already clear that when a federal agency lacks the power to regulate, it also lacks the power to preempt. The Plaintiffs now ask us to save them from the foreseeable legal consequences of their own strategic decisions. We cannot.”

Judges noted that there are several options for ISPs to try to avoid regulation:

If they believe a requirement to provide Internet to low-income families at a reduced price is unfair or misguided, they have several pathways available to them. They could take it up with the New York State Legislature. They could ask Congress to change the scope of the FCC’s Title I authority under the Communications Act. They could ask the FCC to revisit its classification decision, as it has done several times before But they cannot ask this Court to distort well-established principles of administrative law and federalism to strike down a state law they do not like.

Coincidentally, the 2nd Circuit issued its opinion one day after current FCC leadership reclassified broadband again in order to restore net neutrality rules. ISPs might now have a better case for preempting the New York law. The FCC itself won’t necessarily try to preempt New York’s law, but the agency’s net neutrality order does specifically reject rate regulation at the federal level.

Court upholds New York law that says ISPs must offer $15 broadband Read More »

android-tv-has-access-to-your-entire-account—but-google-is-changing-that

Android TV has access to your entire account—but Google is changing that

Google, Tech / /

It’s all just Android —

Should sideloading Chrome on an old smart TV really compromise your entire account?

–

Android TV has access to your entire account—but Google is changing that

Google

Google says it has patched a nasty loophole in the Android TV account security system, which would grant attackers with physical access to your device access to your entire Google account just by sideloading some apps. As 404 Media reports, the issue was originally brought to Google’s attention by US Sen. Ron Wyden (D-Ore.) as part of a “review of the privacy practices of streaming TV technology providers.” Google originally told the senator that the issue was expected behavior but, after media coverage, decided to change its stance and issue some kind of patch.

“My office is mid-way through a review of the privacy practices of streaming TV technology providers,” Wyden told 404 Media. “As part of that inquiry, my staff discovered an alarming video in which a YouTuber demonstrated how with 15 minutes of unsupervised access to an Android TV set-top box, a criminal could get access to private emails of the Gmail user who set up the TV.”

The video in question was a PSA from YouTuber Cameron Gray, and it shows that grabbing any Android TV device and sideloading a few apps will grant access to the current Google account. This is obvious if you know how Android works, but it’s not obvious to most users looking at a limited TV interface.

The heart of the issue is how Android treats your Google account. Since the OS started on phones, every Android device starts with the assumption that it is a private, one-person device. Google has built on top of that feature with multiuser support and guest accounts, but these aren’t part of the default setup flow, can be hard to find, and are probably disabled on many Android TV boxes. The result is that signing in to an Android TV device often gives it access to your entire Google account.

Android has a centralized Google account system shared by a million Google-centric background and syncing processes, the Play Store, and nearly all Google apps. When you boot an Android device for the first time, the guided setup asks for a Google account, which is expected to live on the device forever as the owner’s primary account. Any new Google app you add to your device automatically gets access to this central Google account repository, so if you set up the phone and then install Google Keep, Keep automatically gets signed in and gains access to your notes. During the initial setup, where you might install 10 different apps that use a Google account, it would be annoying to enter your username and password over and over again.

This centralized account system is hungry for Google accounts, so any Google account you use to sign in to any Google app gets sucked into the central account system, even if you decline the initial setup. A common annoyance is to have a Google Workspace account at work, then sign into Gmail for work email and then have to deal with this useless work account showing up in the Play Store, Maps, Photos, etc.

For TVs, this presents a unique gotcha because, while you will still be forced to log in to download something from the Play Store, it’s not obvious to the user that you’re granting this device access to your entire Google account—including to potentially sensitive things like location history, emails, and messages. To the average user, a TV device just shows “TV stuff” like your YouTube recommendations and a few TV-specific Play Store apps, so you might not consider it to be a high-sensitivity sign-in. But if you just sideload a few more Google apps, you can get access to anything. Further confusing matters is Google’s OAuth strategy, which teaches users that there are things like scoped access to a Google account on third-party devices or sites, but Android does not work that way.

In the video, Gray simply grabs an Android TV device, goes to a third-party Android app site, then sideloads Chrome. Chrome automatically signs in to the TV owner’s Google account and has access to all passwords and cookies, which means access to Gmail, Photos, Chat history, Drive files, YouTube accounts, AdSense, any site that allows for Google sign-in, and partial credit card info. It’s all available in Chrome without any security checks. Individual apps like Gmail and Google Photos would immediately start working, too.

As Gray’s video points out, Android TV devices can be dongles, set-top boxes, or code installed right into a TV. In businesses and hotels, they can be semi-public devices. It’s also not hard to imagine a TV device falling into the hands of someone else. You might not worry too much about forgetting a $30 Chromecast in a hotel room, or you might sign in to a hotel TV and forget to delete your account, or you might throw out a TV and not think twice about what account it’s signed in to. If an attacker gets access to any of these devices later, it’s trivial to unlock your entire Google account.

Google says it has fixed this problem, though it doesn’t explain how. The company’s statement to 404 says, “Most Google TV devices running the latest versions of software already do not allow this depicted behavior. We are in the process of rolling out a fix to the rest of the devices. As a best security practice, we always advise users to update their devices to the latest software.”

Many Android TV devices, especially those built-in to TV sets, are abandonware and run an old version of the software, but Google’s account system is updatable via the Play Store, so there’s a good chance a fix can roll out to most devices.

Android TV has access to your entire account—but Google is changing that Read More »

hackers-try-to-exploit-wordpress-plugin-vulnerability-that’s-as-severe-as-it-gets

Hackers try to exploit WordPress plugin vulnerability that’s as severe as it gets

Biz & IT, Security, SQL injection, vulnerability, wordpress / /

GOT PATCHES? —

WP Automatic plugin patched, but release notes don’t mention the critical fix.

–

Hackers try to exploit WordPress plugin vulnerability that’s as severe as it gets

Getty Images

Hackers are assailing websites using a prominent WordPress plugin with millions of attempts to exploit a high-severity vulnerability that allows complete takeover, researchers said.

The vulnerability resides in WordPress Automatic, a plugin with more than 38,000 paying customers. Websites running the WordPress content management system use it to incorporate content from other sites. Researchers from security firm Patchstack disclosed last month that WP Automatic versions 3.92.0 and below had a vulnerability with a severity rating of 9.9 out of a possible 10. The plugin developer, ValvePress, silently published a patch, which is available in versions 3.92.1 and beyond.

Researchers have classified the flaw, tracked as CVE-2024-27956, as a SQL injection, a class of vulnerability that stems from a failure by a web application to query backend databases properly. SQL syntax uses apostrophes to indicate the beginning and end of a data string. By entering strings with specially positioned apostrophes into vulnerable website fields, attackers can execute code that performs various sensitive actions, including returning confidential data, giving administrative system privileges, or subverting how the web app works.

“This vulnerability is highly dangerous and expected to become mass exploited,” Patchstack researchers wrote on March 13.

Fellow web security firm WPScan said Thursday that it has logged more than 5.5 million attempts to exploit the vulnerability since the March 13 disclosure by Patchstack. The attempts, WPScan said, started slowly and peaked on March 31. The firm didn’t say how many of those attempts succeeded.

WPScan said that CVE-2024-27596 allows unauthenticated website visitors to create admin‑level user accounts, upload malicious files, and take full control of affected sites. The vulnerability, which resides in how the plugin handles user authentication, allows attackers to bypass the normal authentication process and inject SQL code that grants them elevated system privileges. From there, they can upload and execute malicious payloads that rename sensitive files to prevent the site owner or fellow hackers from controlling the hijacked site.

Successful attacks typically follow this process:

  • SQL Injection (SQLi): Attackers leverage the SQLi vulnerability in the WP‑Automatic plugin to execute unauthorized database queries.
  • Admin User Creation: With the ability to execute arbitrary SQL queries, attackers can create new admin‑level user accounts within WordPress.
  • Malware Upload: Once an admin‑level account is created, attackers can upload malicious files, typically web shells or backdoors, to the compromised website’s server.
  • File Renaming: Attacker may rename the vulnerable WP‑Automatic file, to ensure only he can exploit it.

WPScan researchers explained:

Once a WordPress site is compromised, attackers ensure the longevity of their access by creating backdoors and obfuscating the code. To evade detection and maintain access, attackers may also rename the vulnerable WP‑Automatic file, making it difficult for website owners or security tools to identify or block the issue. It’s worth mentioning that it may also be a way attackers find to avoid other bad actors to successfully exploit their already compromised sites. Also, since the attacker can use their acquired high privileges to install plugins and themes to the site, we noticed that, in most of the compromised sites, the bad actors installed plugins that allowed them to upload files or edit code.

The attacks began shortly after March 13, 15 days after ValvePress released version 3.92.1 without mentioning the critical patch in the release notes. ValvePress representatives didn’t immediately respond to a message seeking an explanation.

While researchers at Patchstack and WPScan are classifying CVE-2024-27956 as SQL injection, an experienced developer said his reading of the vulnerability is that it’s either improper authorization (CWE-285) or a subcategory of improper access control (CWE-284).

“According to Patchstack.com, the program is supposed to receive and execute an SQL query, but only from an authorized user,” the developer, who didn’t want to use his name, wrote in an online interview. “The vulnerability is in how it checks the user’s credentials before executing the query, allowing an attacker to bypass the authorization. SQL injection is when the attacker embeds SQL code in what was supposed to be only data, and that’s not the case here.”

Whatever the classification, the vulnerability is about as severe as it gets. Users should patch the plugin immediately. They should also carefully analyze their servers for signs of exploitation using the indicators of compromise data provided in the WPScan post linked above.

Hackers try to exploit WordPress plugin vulnerability that’s as severe as it gets Read More »

us’s-power-grid-continues-to-lower-emissions—everything-else,-not-so-much

US’s power grid continues to lower emissions—everything else, not so much

carbon emissions, coal, electric grid, Energy, natural gas, Science, solar, Sustainability, Wind / /

Down, but not down enough —

Excluding one pandemic year, emissions are lower than they’ve been since the 1980s.

–

Graph showing total US carbon emissions, along with individual sources. Most trends are largely flat or show slight declines.

On Thursday, the US Department of Energy released its preliminary estimate for the nation’s carbon emissions in the previous year. Any drop in emissions puts us on a path that would avoid some of the catastrophic warming scenarios that were still on the table at the turn of the century. But if we’re to have a chance of meeting the Paris Agreement goal of keeping the planet from warming beyond 2° C, we’ll need to see emissions drop dramatically in the near future.

So, how is the US doing? Emissions continue to trend downward, but there’s no sign the drop has accelerated. And most of the drop has come from a single sector: changes in the power grid.

Off the grid, on the road

US carbon emissions have been trending downward since roughly 2007, when they peaked at about six gigatonnes. In recent years, the pandemic produced a dramatic drop in emissions in 2020, lowering them to under five gigatonnes for the first time since before 1990, when the EIA’s data started. Carbon dioxide release went up a bit afterward, with 2023 marking the first post-pandemic decline, with emissions again clearly below five gigatonnes.

The DOE’s Energy Information Agency (EIA) divides the sources of carbon dioxide into five different sectors: electricity generation, transportation, and residential, commercial, and industrial uses. The EIA assigns 80 percent of the 2023 reduction in US emissions to changes in the electric power grid, which is not a shock given that it’s the only sector that’s seen significant change in the entire 30-year period the EIA is tracking.

With hydro in the rearview mirror, wind and solar are coming after coal and nuclear.

With hydro in the rearview mirror, wind and solar are coming after coal and nuclear.

What’s happening with the power grid? Several things. At the turn of the century, coal accounted for over half of the US’s electricity generation; it’s now down to 16 percent. Within the next two years, it’s likely to be passed by wind and solar, which were indistinguishable from zero percent of generation as recently as 2004. Things would be even better for them if not for generally low wind speeds leading to a decline in wind generation in 2023. The biggest change, however, has been the rise of natural gas, which went from 10 percent of generation in 1990 to over 40 percent in 2023.

A small contributor to the lower emissions came from lower demand—it dropped by a percentage point compared to 2022. Electrification of transport and appliances, along with the growth of AI processing, are expected to send demand soaring in the near future, but there’s no indication of that on the grid yet.

Currently, generating electricity accounts for 30 percent of the US’s carbon emissions. That places it as the second most significant contributor, behind transportation, which is responsible for 39 percent of emissions. The EIA rates transportation emissions as unchanged relative to 2022, despite seeing air travel return to pre-pandemic levels and a slight increase in gasoline consumption. Later in this decade, tighter fuel efficiency rules are expected to drive a decline in transportation emissions, which are only down about 10 percent compared to their 2006 peak.

Buildings and industry

The remaining sectors—commercial, residential, and industrial—have a more complicated relationship with fossil fuels. Some of their energy comes via the grid, so its emissions are already accounted for. Thanks to the grid decarbonizing, these would be going down, but for business and residential use, grid-dependent emissions are dropping even faster than that would imply. This suggests that things like more efficient lighting and appliances are having an impact.

Separately, direct use of fossil fuels for things like furnaces, water heaters, etc., has been largely flat for the entire 30 years the EIA is looking at, although milder weather led to a slight decline in 2023 (8 percent for residential properties, 4 percent for commercial).

In contrast, the EIA only tracks the direct use of fossil fuels for industrial processes. These are down slightly over the 30-year period but have been fairly stable since the 2008 economic crisis, with no change in emissions between 2022 and 2023. As with the electric grid, the primary difference in this sector has been due to the growth of natural gas and the decline of coal.

Overall, there are two ways to look at this data. The first is that progress at limiting carbon emissions has been extremely limited and that there has been no progress at all in several sectors. The more optimistic view is that the technologies for decarbonizing the electric grid and improving building electrical usage are currently the most advanced, and the US has focused its decarbonization efforts where they’ll make the most difference.

From either perspective, it’s clear that the harder challenges are still coming, both in terms of accelerating decarbonization, and in terms of tackling sectors where decarbonization will be harder. The Biden administration has been working to put policies in place that should drive progress in this regard, but we probably won’t see much of their impact until early in the following decade.

Listing image by Yaorusheng

US’s power grid continues to lower emissions—everything else, not so much Read More »

message-scraping,-user-tracking-service-spy-pet-shut-down-by-discord

Message-scraping, user-tracking service Spy Pet shut down by Discord

chat, discord, discord servers, Kiwi Farms, Policy, privacy, Security, spy pet, Tech / /

Discord message privacy —

Bot-driven service was also connected to targeted harassment site Kiwi Farms.

–

Image of various message topics locked away in a wireframe box, with a Discord logo and lock icon nearby.

Discord

Spy Pet, a service that sold access to a rich database of allegedly more than 3 billion Discord messages and details on more than 600 million users, has seemingly been shut down.

404 Media, which broke the story of Spy Pet’s offerings, reports that Spy Pet seems mostly shut down. Spy Pet’s website was unavailable as of this writing. A Discord spokesperson told Ars that the company’s safety team had been “diligently investigating” Spy Pet and that it had banned accounts affiliated with it.

“Scraping our services and self-botting are violations of our Terms of Service and Community Guidelines,” the spokesperson wrote. “In addition to banning the affiliated accounts, we are considering appropriate legal action.” The spokesperson noted that Discord server administrators can adjust server permissions to prevent future such monitoring on otherwise public servers.

Kiwi Farms ties, GDPR violations

The number of servers monitored by Spy Pet had been fluctuating in recent days. The site’s administrator told 404 Media’s Joseph Cox that they were rewriting part of the service while admitting that Discord had banned a number of bots. The administrator had also told 404 Media that he did not “intend for my tool to be used for harassment,” despite a likely related user offering Spy Pet data on Kiwi Farms, a notorious hub for doxxing and online harassment campaigns that frequently targets trans and non-binary people, members of the LGBTQ community, and women.

Even if Spy Pet can somehow work past Discord’s bans or survive legal action, the site’s very nature runs against a number of other Internet regulations across the globe. It’s almost certainly in violation of the European Union’s General Data Protection Regulation (GDPR). As pointed out by StackDiary, Spy Pet and services like it seem to violate at least three articles of the GDPR, including the “right to be forgotten” in Article 17.

In Article 8 of the GDPR and likely in the eyes of the FTC, gathering data from what could be children’s accounts and profiting from them is almost certainly to draw scrutiny, if not legal action.

Ars was unsuccessful in reaching the administrator of Spy Pet by email and Telegram message. Their last message on Telegram stated that their domain had been suspended and a backup domain was being set up. “TL;DR: Never trust the Germans,” they wrote.

Message-scraping, user-tracking service Spy Pet shut down by Discord Read More »

tiktok-owner-has-strong-first-amendment-case-against-us-ban,-professors-say

TikTok owner has strong First Amendment case against US ban, professors say

Policy, TikTok ban, tiktok bytedance / /
Illustration of the United States flag and a phone with a cracked screen running the TikTok app

Getty Images | NurPhoto

TikTok owner ByteDance is preparing to sue the US government now that President Biden has signed into law a bill that will ban TikTok in the US if its Chinese owner doesn’t sell the company within 270 days. While it’s impossible to predict the outcome with certainty, law professors speaking to Ars believe that ByteDance will have a strong First Amendment case in its lawsuit against the US.

One reason for this belief is that just a few months ago, a US District Court judge blocked a Montana state law that attempted to ban TikTok. In October 2020, another federal judge in Pennsylvania blocked a Trump administration order that would have banned TikTok from operating inside the US. TikTok also won a preliminary injunction against Trump in US District Court for the District of Columbia in September 2020.

“Courts have said that a TikTok ban is a First Amendment problem,” Santa Clara University law professor Eric Goldman, who writes frequent analysis of legal cases involving technology, told Ars this week. “And Congress didn’t really try to navigate away from that. They just went ahead and disregarded the court rulings to date.”

The fact that previous attempts to ban TikTok have failed is “pretty good evidence that the government has an uphill battle justifying the ban,” Goldman said.

TikTok users engage in protected speech

The Montana law “bans TikTok outright and, in doing so, it limits constitutionally protected First Amendment speech,” US District Judge Donald Molloy wrote in November 2023 when he granted a preliminary injunction that blocks the state law.

“The Montana court concluded that the First Amendment challenge would be likely to succeed. This will give TikTok some hope that other courts will follow suit with respect to a national order,” Georgetown Law Professor Anupam Chander told Ars.

Molloy’s ruling said that without TikTok, “User Plaintiffs are deprived of communicating by their preferred means of speech, and thus First Amendment scrutiny is appropriate.” TikTok’s speech interests must be considered “because the application’s decisions related to how it selects, curates, and arranges content are also protected by the First Amendment,” the ruling said.

Banning apps that let people talk to each other “is categorically impermissible,” Goldman said. While the Chinese government engaging in propaganda is a problem, “we need to address that as a government propaganda problem, and not just limited to China,” he said. In Goldman’s view, a broader approach should also be used to stop governments from siphoning user data.

TikTok and opponents of bans haven’t won every case. A federal judge in Texas ruled in favor of Texas Governor Greg Abbott in December 2023. But that ruling only concerned a ban on state employees using TikTok on government-issued devices rather than a law that potentially affects all users of TikTok.

Weighing national security vs. First Amendment

US lawmakers have alleged that the Chinese Communist Party can weaponize TikTok to manipulate public opinion and access user data. But Chander was skeptical of whether the US government could convincingly justify its new law in court on national security grounds.

“Thus far, the government has refused to make public its evidence of a national security threat,” he told Ars. “TikTok put in an elaborate set of controls to insulate the app from malign foreign influence, and the government hasn’t shown why those controls are insufficient.”

The ruling against Trump by a federal judge in Pennsylvania noted that “the Government’s own descriptions of the national security threat posed by the TikTok app are phrased in the hypothetical.”

Chander stressed that the outcome of ByteDance’s planned case against the US is difficult to predict, however. “I would vote against the law if I were a judge, but it’s unclear how judges will weigh the alleged national security risks against the real free expression incursions,” he said.

Montana case may be “bellwether”

There are at least three types of potential plaintiffs that could lodge constitutional challenges to a TikTok ban, Goldman said. There’s TikTok itself, the users of TikTok who would no longer be able to post on the platform, and app stores that would be ordered not to carry the TikTok app.

Montana was sued by TikTok and users. Lead plaintiff Samantha Alario runs a local swimwear business and uses TikTok to market her products.

Montana Attorney General Austin Knudsen appealed the ruling against his state to the US Court of Appeals for the 9th Circuit. The Montana case could make it to the Supreme Court before there is any resolution on the enforceability of the US law, Goldman said.

“It’s possible that the Montana ban is actually going to be the bellwether that’s going to set the template for the constitutional review of the Congressional action,” Goldman said.

TikTok owner has strong First Amendment case against US ban, professors say Read More »

microsoft-open-sources-infamously-weird,-ram-hungry-ms-dos-4.00-release

Microsoft open-sources infamously weird, RAM-hungry MS-DOS 4.00 release

MS-DOS, Open Source, Tech / /

a road not traveled —

DOS 4.00 was supposed to add multitasking to the OS, but it was not to be.

–

A DOS prompt.

Enlarge / A DOS prompt.

Microsoft has open-sourced another bit of computing history this week: The company teamed up with IBM to release the source code of 1988’s MS-DOS 4.00, a version better known for its unpopularity, bugginess, and convoluted development history than its utility as a computer operating system.

The MS-DOS 4.00 code is available on Microsoft’s MS-DOS GitHub page along with versions 1.25 and 2.0, which Microsoft open-sourced in cooperation with the Computer History Museum back in 2014. All open-source versions of DOS have been released under the MIT License.

Initially, MS-DOS 4.00 was slated to include new multitasking features that allow software to run in the background. This release of DOS, also sometimes called “MT-DOS” or “Mutitasking MS-DOS” to distinguish it from other releases, was only released through a few European PC OEMs and never as a standalone retail product.

The source code Microsoft released this week is not for that multitasking version of DOS 4.00, and Microsoft’s Open Source Programs Office was “unable to find the full source code” for MT-DOS when it went to look. Rather, Microsoft and IBM have released the source code for a totally separate version of DOS 4.00, primarily developed by IBM to add more features to the existing non-multitasking version of DOS that ran on most IBM PCs and PC clones of the day.

Microsoft never returned to its multitasking DOS idea in subsequent releases. Multitasking would become the purview of graphical operating systems like Windows and OS/2, while MS-DOS versions 5.x and 6.x continued with the old one-app-at-a-time model of earlier releases.

Microsoft has released some documentation and binary files for MT-DOS and “may update this release if more is discovered.” The company credits English researcher Connor “Starfrost” Hyde for shaking all of this source code loose as part of an ongoing examination of MT-DOS that he is documenting on his website. Hyde has posted many screenshots of a 1984-era build of MT-DOS, including of the “session manager” that it used to track and switch between running applications.

Confidential copies of the obscure, abandoned multitasking-capable version of MS-DOS 4.00. Microsoft has been unable to locate source code for this release, sometimes referred to as

Confidential copies of the obscure, abandoned multitasking-capable version of MS-DOS 4.00. Microsoft has been unable to locate source code for this release, sometimes referred to as “MT-DOS” or “Multitasking MS-DOS.”

Microsoft

The publicly released version of MS-DOS 4.00 is known less for its new features than for its high memory usage; the 4.00 release could consume as much as 92KB of RAM, way up from the roughly 56KB used by MS-DOS 3.31, and the 4.01 release reduced this to about 86KB. The later MS-DOS 5.0 and 6.0 releases maxed out at 72 or 73KB, and even IBM’s PC DOS 2000 only wanted around 64KB.

These RAM numbers would be rounding errors on any modern computer, but in the days when RAM was pricey, systems maxed out at 640KB, and virtual memory wasn’t a thing, such a huge jump in system requirements was a big deal. Today’s retro-computing enthusiasts still tend to skip over MS-DOS 4.00, recommending either 3.31 for its lower memory usage or later versions for their expanded feature sets.

Microsoft has open-sourced some other legacy code over the years, including those older MS-DOS versions, Word for Windows 1.1a, 1983-era GW-BASIC, and the original Windows File Manager. While most of these have been released in their original forms without any updates or changes, the Windows File Manager is actually actively maintained. It was initially just changed enough to run natively on modern 64-bit and Arm PCs running Windows 10 and 11, but it’s been updated with new fixes and features as recently as March 2024.

The release of the MS-DOS 4.0 code isn’t the only new thing that DOS historians have gotten their hands on this year. One of the earliest known versions of 86-DOS, the software that Microsoft would buy and turn into the operating system for the original IBM PC, was discovered and uploaded to the Internet Archive in January. An early version of the abandoned Microsoft-developed version of OS/2 was also unearthed in March.

Microsoft open-sources infamously weird, RAM-hungry MS-DOS 4.00 release Read More »

tesla’s-2-million-car-autopilot-recall-is-now-under-federal-scrutiny

Tesla’s 2 million car Autopilot recall is now under federal scrutiny

Cars, NHTSA recall, tesla autopilot, Tesla recall / /

maybe ban it instead —

NHTSA has tested the updated system and still has questions.

–

A 2014 Tesla Model S driving on Autopilot rear-ended a Culver City fire truck that was parked in the high-occupancy vehicle lane on Interstate 405.

Enlarge / A 2014 Tesla Model S driving on Autopilot rear-ended a Culver City fire truck that was parked in the high-occupancy vehicle lane on Interstate 405.

Tesla’s lousy week continues. On Tuesday, the electric car maker posted its quarterly results showing precipitous falls in sales and profitability. Today, we’ve learned that the National Highway Traffic Safety Administration is concerned that Tesla’s massive recall to fix its Autopilot driver assist—which was pushed out to more than 2 million cars last December—has not actually made the system that much safer.

NHTSA’s Office of Defects Investigation has been scrutinizing Tesla Autopilot since August 2021, when it opened a preliminary investigation in response to a spate of Teslas crashing into parked emergency responder vehicles while operating under Autopilot.

In June 2022, the ODI upgraded that investigation into an engineering analysis, and in December 2023, Tesla was forced to recall more than 2 million cars after the analysis found that the car company had inadequate driver-monitoring systems and had designed a system with the potential for “foreseeable misuse.”

NHTSA has now closed that engineering analysis, which examined 956 crashes. After excluding crashes where the other car was at fault, where Autopilot wasn’t operating, or where there was insufficient data to make a determination, it found 467 Autopilot crashes that fell into three distinct categories.

First, 221 were frontal crashes in which the Tesla hit a car or obstacle despite “adequate time for an attentive driver to respond to avoid or mitigate the crash.” Another 111 Autopilot crashes occurred when the system was inadvertently disengaged by the driver, and the remaining 145 Autopilot crashes happened under low grip conditions, such as on a wet road.

As Ars has noted time and again, Tesla’s Autopilot system has a more permissive operational design domain than any comparable driver-assistance system that still requires the driver to keep their hands on the wheel and their eyes on the road, and NHTSA’s report adds that “Autopilot invited greater driver confidence via its higher control authority and ease of engagement.”

The result has been disengaged drivers who crash, and those crashes “are often severe because neither the system nor the driver reacts appropriately, resulting in high-speed differential and high energy crash outcomes,” NHTSA says. Tragically, at least 13 people have been killed as a result.

NHTSA also found that Tesla’s telematics system has plenty of gaps in it, despite the closely held belief among many fans of the brand that the Autopilot system is constantly recording and uploading to Tesla’s servers to improve itself. Instead, it only records an accident if the airbags deploy, which NHTSA data shows only happens in 18 percent of police-reported crashes.

The agency also criticized Tesla’s marketing. “Notably, the term “Autopilot” does not imply an L2 assistance feature but rather elicits the idea of drivers not being in control. This terminology may lead drivers to believe that the automation has greater capabilities than it does and invite drivers to overly trust the automation,” it says.

But now, NHTSA’s ODI has opened a recall query to assess whether the December fix actually made the system any safer. From the sounds of it, the agency is not convinced it did, based on additional Autopilot crashes that have happened since the recall and after testing the updated system itself.

Worryingly, the agency writes that “Tesla has stated that a portion of the remedy both requires the owner to opt in and allows a driver to readily reverse it” and wants to know why subsequent updates have addressed problems that should have been fixed with the December recall.

Tesla’s 2 million car Autopilot recall is now under federal scrutiny Read More »

The Quest for Extended Detection and Response (XDR): Unraveling Cybersecurity’s Next Generation

quest / /

Embarking on an exploration of the extended detection and response (XDR) sector wasn’t just another research project for me; it was a dive back into familiar waters with an eye on how the tide has turned. Having once been part of a team at a vendor that developed an early XDR prototype, my return to this evolving domain was both nostalgic and eye-opening. The concept we toyed with in its nascent stages has burgeoned into a cybersecurity imperative, promising to redefine threat detection and response across the digital landscape.

Discovering XDR: Past and Present

My previous stint in developing an XDR prototype was imbued with the vision of creating a unified platform that could offer a panoramic view of security threats, moving beyond siloed defenses. Fast forward to my recent exploration, and it’s clear that the industry has taken this vision and run with it—molding XDR into a comprehensive solution that integrates across security layers to offer unparalleled visibility and control.

The research process was akin to piecing together a vast jigsaw puzzle. Through a blend of reading industry white papers, diving deep into knowledge-base articles, and drawing from my background, I charted the evolution of XDR from a promising prototype to a mature cybersecurity solution. This deep dive not only broadened my understanding but also reignited my enthusiasm for the potential of integrated defense mechanisms against today’s sophisticated cyberthreats.

The Adoption Challenge: Beyond Integration

The most formidable challenge that emerged in adopting XDR solutions is integration complexity—a barrier we had anticipated in the early development days and has only intensified. Organizations today face the Herculean task of intertwining their diversified security tools with an XDR platform, where each tool speaks a different digital language and adheres to distinct protocols.

However, the adoption challenges extend beyond the technical realm. There’s a strategic dissonance in aligning an organization’s security objectives with the capabilities of XDR platforms. This alignment is crucial, yet often elusive, as it demands a top-down reevaluation of security priorities, processes, and personnel readiness. Organizations must not only reconcile their current security infrastructure with an XDR system but also ensure their teams are adept at leveraging this integration to its fullest potential.

Surprises and Insights

The resurgence of AI and machine learning within XDR solutions echoed the early ambitions of prototype development. The sophistication of these technologies in predicting and mitigating threats in real time was a revelation, showcasing how far the maturation of XDR has come. Furthermore, the vibrant ecosystem of partnerships and integrations underscored XDR’s shift from a standalone solution to a collaborative security framework, a pivot that resonates deeply with the interconnected nature of digital threats today.

Reflecting on the Evolution

Since venturing into XDR prototype development, the sector’s evolution has been marked by a nuanced understanding of adoption complexities and an expansion in threat coverage. The emphasis on refining integration strategies and enhancing customization signifies a market that’s not just growing but maturing—ready to tackle the diversifying threat landscape with innovative solutions.

The journey back into the XDR landscape, juxtaposed against my early experiences, was a testament to the sector’s dynamism. As adopters navigate the complexities of integrating XDR into their security arsenals, the path ahead is illuminated by the promise of a more resilient, unified defense mechanism against cyber adversaries. The evolution of XDR from an emerging prototype to a cornerstone of modern cybersecurity strategies mirrors the sector’s readiness to confront the future—a future where the digital well-being of organizations is shielded by the robust, integrated, and intuitive capabilities of XDR platforms.

Next Steps

To learn more, take a look at GigaOm’s XDR Key Criteria and Radar reports. These reports provide a comprehensive overview of the market, outline the criteria you’ll want to consider in a purchase decision, and evaluate how a number of vendors perform against those decision criteria.

If you’re not yet a GigaOm subscriber, you can access the research using a free trial.

The Quest for Extended Detection and Response (XDR): Unraveling Cybersecurity’s Next Generation Read More »

russia-stands-alone-in-vetoing-un-resolution-on-nuclear-weapons-in-space

Russia stands alone in vetoing UN resolution on nuclear weapons in space

anti-satellite tests, military space, Nuclear weapons, russia, Science, Space, United Nations / /

ASAT —

“The United States assesses that Russia is developing a new satellite carrying a nuclear device.”

–

A meeting of the UN Security Council on April 14.

Enlarge / A meeting of the UN Security Council on April 14.

Russia vetoed a United Nations Security Council resolution Wednesday that would have reaffirmed a nearly 50-year-old ban on placing weapons of mass destruction into orbit, two months after reports Russia has plans to do just that.

Russia’s vote against the resolution was no surprise. As one of the five permanent members of the Security Council, Russia has veto power over any resolution that comes before the body. China abstained from the vote, and 13 other members of the Security Council voted in favor of the resolution.

If it passed, the resolution would have affirmed a binding obligation in Article IV of the 1967 Outer Space Treaty, which says nations are “not to place in orbit around the Earth any objects carrying nuclear weapons or any other kinds of weapons of mass destruction.”

Going nuclear

Russia is one of 115 parties to the Outer Space Treaty. The Security Council vote Wednesday follows reports in February that Russia is developing a nuclear anti-satellite weapon.

“The United States assesses that Russia is developing a new satellite carrying a nuclear device,” said Jake Sullivan, President Biden’s national security advisor. “We have heard President Putin say publicly that Russia has no intention of deploying nuclear weapons in space. If that were the case, Russia would not have vetoed this resolution.”

The United States and Japan proposed the joint resolution, which also called on nations not to develop nuclear weapons or any other weapons of mass destruction designed to be placed into orbit around the Earth. In a statement, US and Japanese diplomats highlighted the danger of a nuclear detonation in space. Such an event would have “grave implications for sustainable development, and other aspects of international peace and security,” US officials said in a press release.

With its abstention from the vote, “China has shown that it would rather defend Russia as its junior partner, than safeguard the global nonproliferation regime,” said Linda Thomas-Greenfield, the US ambassador to the UN.

US government officials have not offered details about the exact nature of the anti-satellite weapon they say Russia is developing. A nuclear explosion in orbit would destroy numerous satellites—from many countries—and endanger astronauts. Space debris created from a nuclear detonation could clutter orbital traffic lanes needed for future spacecraft.

The Soviet Union launched more than 30 military satellites powered by nuclear reactors. Russia’s military space program languished in the first couple of decades after the fall of the Soviet Union, and US intelligence officials say it still lags behind the capabilities possessed by the US Space Force and the Chinese military.

Russia’s military funding has largely gone toward the war in Ukraine for the last two years, but Putin and other top Russian officials have raised threats of nuclear force and attacks on space assets against adversaries. Russia’s military launched a cyberattack against a commercial satellite communications network when it invaded Ukraine in 2022.

Russia has long had an appetite for anti-satellite (ASAT) weapons. The Soviet Union experimented with “co-orbital” ASATs in the 1960s and 1970s. When deployed, these co-orbital ASATs would have attacked enemy satellites by approaching them and detonating explosives or using a grappling arm to move the target out of orbit.

Russian troops at the Plesetsk Cosmodrome in far northern Russia prepare for the launch of a Soyuz rocket with the Kosmos 2575 satellite in February.

Enlarge / Russian troops at the Plesetsk Cosmodrome in far northern Russia prepare for the launch of a Soyuz rocket with the Kosmos 2575 satellite in February.

Russian Ministry of Defense

In 1987, the Soviet Union launched an experimental weapons platform into orbit to test laser technologies that could be used against enemy satellites. Russia shot down one of its own satellites in 2021 in a widely condemned “direct ascent” ASAT test. This Russian direct ascent ASAT test followed demonstrations of similar capability by China, the United States, and India. Russia’s military has also demonstrated satellites over the last decade that could grapple onto an adversary’s spacecraft in orbit, or fire a projectile to take out an enemy satellite.

These ASAT capabilities could destroy or disable one enemy satellite at a time. The US Space Force is getting around this threat by launching large constellations of small satellites to augment the military’s much larger legacy communications, surveillance, and missile warning spacecraft. A nuclear ASAT weapon could threaten an entire constellation or render some of space inaccessible due to space debris.

Russia’s ambassador to the UN, Vasily Nebenzya, called this week’s UN resolution “an unscrupulous play of the United States” and a “cynical forgery and deception.” Russia and China proposed an amendment to the resolution that would have banned all weapons in space. This amendment got the support of about half of the Security Council but did not pass.

Outside the 15-member Security Council, the original resolution proposed by the United States and Japan won the support of more than 60 nations as co-sponsors.

“Regrettably, one permanent member decided to silence the critical message we wanted to send to the present and future people of the world: Outer space must remain a domain of peace, free of weapons of mass destruction, including nuclear weapons,” said Kazuyuki Yamazaki, Japan’s ambassador to the UN.

Russia stands alone in vetoing UN resolution on nuclear weapons in space Read More »