Author name: Mike M.

apple-blew-$10-billion-on-failed-car-project,-considered-buying-tesla

Apple blew $10 billion on failed car project, considered buying Tesla

talk about an RDF —

It took Apple’s board 10 years to see the obvious writing on the wall.

The apple logo with a stop sign in it, superimposed above the road

Aurich Lawson/Jonathan Gitlin/Getty Images

Apple spent roughly $1 billion a year on its car project before canceling it last month, according to a report in Bloomberg. The project, which apparently made as little sense to many inside Apple as it did to outside observers, began in 2014 as the tech giant looked for a new revenue stream to supplement its hardware and software businesses. But grand plans for a fully autonomous vehicle were never able to overcome the various technical challenges, and prototypes only ever ran on a closed-course test track.

During his tenure as CEO, the late Steve Jobs contemplated Apple getting into the automotive world, an idea that did not survive the global financial crisis of 2008. But by 2013, Apple executives thought this could be “one more example of Apple entering a market very late and vanquishing it.”

At first, the company considered simply acquiring Tesla—at the time the startup automaker was worth just under $28 billion, a fraction of the annual profit that Apple was raking in even then. It is suggested that Musk standing down from Tesla was a sticking point, and talks ended. Later, in 2017, Musk apparently tried to interest Apple in buying Tesla, which at the time was mired in Model 3 “production hell,” but current Apple CEO Tim Cook refused the meeting.

With a Tesla purchase off the table, in 2014 Apple instead decided to set up its own automotive R&D program, known internally as Project Titan. Almost immediately, Project Titan was the cause of arguments within Apple. The company’s CFO, Luca Maestri, was not a fan; having come from General Motors’ European arm, Maestri was all too familiar with the low profit margins enjoyed by automakers. Apple’s top software engineer, Craig Federighi, and its star designer, Jony Ive, were both skeptics, too.

But it seems the lure of a fully autonomous (level 5) vehicle, capable of driving anywhere without a human at the wheel, was too tempting to ignore.

By 2015, the plan was to bring an Apple EV to market by 2020, and with Ive in charge of the style, that vehicle was destined to be a minivan. Given some of the ideas Apple experimented with, it’s no surprise that Project Titan’s gestation proved problematic—touchscreens folding down from the roof as controllers and external microphones to pipe in outside sounds, to name but two.

In 2016, Apple decided to bet even more heavily on autonomous driving, as some in the company believed this could leave the company with a product to license to others, even if the car never materialized.

Though the Tesla deal never happened, Apple considered partnering with or buying other automakers, including BMW, Canoo, Ford, McLaren, Mercedes-Benz, and Volkswagen.

Apple prototypes were running on a private test track in Arizona in 2020. These were rounded minivans, painted white, with sliding doors and whitewall tires, apparently inspired by the VW microbus.—Ive must have been as enamored with VW ID. Buzz as pretty much everyone else on the planet. By this point, the company knew 2025 would be the earliest it could bring its car to market and planned to equip it with “a giant TV screen, a powerful audio system and windows that adjusted their own tint,” plus reclining seats for the passengers.

It wouldn’t feature a steering wheel, however, “just a video-game-style controller or iPhone app for driving at low speed as a backup,” an idea that is sure to horrify many Ars readers. There are longstanding reasons why the industry continues to use a steering wheel and pedals rather than joysticks or controllers, but the autonomous vehicle sector has been actively lobbying Congress to update federal regulations to allow for AVs sans steering wheel. In 2022, GM’s Cruise petitioned the National Highway Traffic Safety Administration for permission to build its Origin robotaxis without one.

By 2020, the prospect of achieving a fully autonomous vehicle capable of driving anywhere its user wanted to go—rather than one with a more limited design domain like a geofenced robotaxi—was still daunting. At the time, Project Titan was being run by Doug Field, formerly of Tesla, who suggested a conditionally automated driving feature, also known as “level 3,” was more realistic. This proved unwelcome advice, and in 2021, Field moved to Ford.

The Apple car continued to morph, apparently losing its front and rear windshields for some time as the design switched to a curved pod with gullwing doors. Finally, in 2023, visions of fully autonomous driving were downgraded to the same kind of advanced cruise control and lane keeping offered by most automakers, and the cabin now had a steering wheel. But it wouldn’t be cheap; estimates put Apple’s cost of building the car at $120,000.

The problem, according to Bloomberg, was Cook’s decadelong indecision.

“If Bob [Mansfield] or Doug ever had a reasonable set of objectives, they could have shipped a car,” says someone who was deeply involved in the project. “They’d ask to take the next step, and Tim would frequently say, ‘Get me more data, and let me think about it.'”

Kevin Lynch replaced Field and recently succeeded in piercing the reality distortion field, convincing the Apple board of something obvious to many of us: full autonomy you could sell to the public is at least a decade away, and the margins for selling cars are terrible. And at the end of February, the Apple car was no more.

Apple blew $10 billion on failed car project, considered buying Tesla Read More »

rocket-report:-starbase-will-expand-into-state-park;-another-japanese-rocket

Rocket Report: Starbase will expand into state park; another Japanese rocket

43 for 477 —

“Those launches are exciting the young minds that are watching them.”

This satellite view of SpaceX's Starbase facility shows a fully-stacked Starship rocket on the launch pad, just inland from the Gulf of Mexico.

Enlarge / This satellite view of SpaceX’s Starbase facility shows a fully-stacked Starship rocket on the launch pad, just inland from the Gulf of Mexico.

Welcome to Edition 6.34 of the Rocket Report! It’s Starship season again. Yes, SpaceX appears to be about a week away from launching the third full-scale Starship test flight from the company’s Starbase site in South Texas, pending final regulatory approval from the Federal Aviation Administration. Ars will be there. SpaceX plans to build a second Starship launch pad at Starbase, and the company’s footprint there is also about to get a little bigger, with the expected acquisition of 43 acres of Texas state park land.

As always, we welcome reader submissions, and if you don’t want to miss an issue, please subscribe using the box below (the form will not appear on AMP-enabled versions of the site). Each report will include information on small-, medium-, and heavy-lift rockets, as well as a quick look ahead at the next three launches on the calendar.

Astra’s founders take the company private. Astra’s three-year run as a public company is over. Chris Kemp and Adam London, Astra’s co-founders, are taking the company private after a string of rocket failures and funding shortfalls, Ars reports. Kemp and London bought the company for 50 cents a share. Astra’s board approved the transaction, the company announced Thursday, as the only alternative to bankruptcy. Kemp and London founded Astra in 2016. After emerging from stealth mode in 2020, Astra launched its light-class launcher, called Rocket 3, seven times, but five of those flights were failures. Astra went public via a special purpose acquisition company (or SPAC) in 2021, reaching a valuation of more than $2 billion. Today, its market cap sits at approximately $13 million.

What’s next for Astra? … Where Astra goes from here is anyone’s guess. The company abandoned its unreliable Rocket 3 vehicle in 2022 to focus on the larger Rocket 4 vehicle. But Rocket 4 is likely months or years from the launch pad. It faces stiff competition not just from established small launch players such as Rocket Lab and Firefly but also from new entrants as well, including ABL Space and Stoke Space. Additionally, all of these small launch companies have been undercut in price by SpaceX’s Transporter missions, which launch dozens of satellites at a time on the Falcon 9 booster. Additionally, Astra’s spacecraft engine business—acquired previously from Apollo Fusion—may or may not be profitable now, but there are questions about its long-term viability as well.

Virgin Galactic is retiring its only operational spaceship. Over the last year, Virgin Galactic has proven it has the technical acumen to pull off monthly flights of its VSS Unity rocket plane, each carrying six people on a suborbital climb to the edge of space. But VSS Unity has never been profitable. It costs too much and takes too much time to reconfigure between flights. Virgin Galactic plans to fly the suborbital spaceship one more time before taking a hiatus from flight operations, Ars reports. This, along with layoffs announced last year, will allow the company to preserve cash while focusing on the development of a new generation of rocket planes, called Delta-class ships, designed to fly more often and with more people. Michael Colglazier, Virgin Galactic’s president and CEO, says the first of the Delta ships is on track to begin ground and flight testing next year, with commercial service targeted for 2026 based out of Spaceport America in New Mexico.

Bigger and faster… The Delta ships will each carry six customers in the spacecraft’s pressurized passenger cabin, compared to a maximum of four passengers on each VSS Unity flight. Virgin Galactic’s goal is to fly each Delta ship eight times per month, and the company will do this by eliminating many of the inspections required between each VSS Unity flight. The company is building a Delta ship structural test article to put through extensive checks on the ground, validating component life and cycle limits for major components of the vehicle. This will give engineers enough confidence to forego many inspections, according to Mike Moses, president of Virgin Galactic’s spaceline operations. Virgin Galactic has nearly $1 billion in cash or cash equivalents on its balance sheet, so it’s not in any immediate financial trouble. But the company reported just $7 million in revenue last year, with a net loss of $502 million. So, there’s an obvious motivation to make a change.

The easiest way to keep up with Eric Berger’s space reporting is to sign up for his newsletter, we’ll collect his stories in your inbox.

A new Japanese rocket will launch this weekend. A privately held Japanese company named Space One is set to shoot for orbit with the first flight of its Kairos rocket Friday night (US time), News on Japan reports. Space One will attempt to become the first Japanese private company to launch a rocket into orbit. Japan’s existing launch vehicles, like the H-IIA, the H3, and the Epsilon, were developed with funding from the Japanese space agency. But there is some involvement from the Japanese government on this flight. The Kairos rocket will launch with a small “quick response” spacecraft for the Cabinet Intelligence and Research Office, which is responsible for Japan’s fleet of spy satellites. Kairos, which is the Ancient Greek word for “timeliness,” is made up of three solid-fueled stages and a liquid-fueled upper stage. It can place a payload of up to 550 pounds (250 kilograms) into low-Earth orbit.

Winning hearts and minds… The Kairos rocket will take off from Space One’s Space Port Kii, located on a south-facing peninsula on the main Japanese island of Honshu. This new launch site is hundreds of miles away from Japan’s existing spaceports. Local businesses see the arrival of the space industry in this remote part of Japan as a marketing opportunity. A local confectionery store, not wanting to miss the opportunity to attract visitors, is selling manju shaped like rockets. There are two paid viewing areas to watch the launch, and a total of 5,000 seats sold out in just two days, according to News on Japan. (submitted by tsunam)

UK spaceport project to get 10 million pounds from government. The UK government has pledged 10 million pounds in funding to SaxaVord Spaceport in Scotland, European Spaceflight reports. This funding is sorely needed for SaxaVord, which slowed construction last year after its developer ran into financial trouble. In the last couple of months, SaxaVord raised enough money to resume payments to the contractors building the launch site. The UK government’s pledge of 10 million pounds for SaxaVord apparently is not quite a done deal. The UK’s science minister posted on X that the funding was “subject to due diligence.” SaxaVord will eventually have three launch pads, one of which has been dedicated to German launch startup Rocket Factory Augsburg. This company’s rocket, RFA ONE, is expected to be the first orbital launch from SaxaVord later this year.

The UK spaceport scene… The UK government, local entities, and private industry are making a pretty serious effort to bring orbital launches to the British Isles. Spaceport Cornwall became the first UK facility to host an orbital attempt last year with the failed launch of Virgin Orbit’s LauncherOne rocket, which was released from a carrier jet that took off from Cornwall. There are several vertical launch spaceports under construction or in the concept development phase. SaxaVord appears to be among those closest to reality, along with Sutherland spaceport, also in Scotland, to be used by the UK launch startup Orbex Space. (submitted by Ken the Bin)

Rocket Report: Starbase will expand into state park; another Japanese rocket Read More »

ghouls,-gulpers,-and-general-mayhem-abound-in-fallout-official-trailer

Ghouls, gulpers, and general mayhem abound in Fallout official trailer

A story of haves and have-nots —

“Everyone wants to save the world. They just disagree on how.”

A Vault Dweller navigates a post-apocalyptic wasteland in Fallout, based on the bestselling gaming franchise.

Amazon Prime Video has dropped the full official trailer for Fallout, the streaming platform’s forthcoming post-apocalyptic sci-fi series. It’s based on the bestselling role-playing gaming franchise set in a satirical, 1950s-style future post-nuclear apocalypse. There’s plenty for gaming fans to be pleased about, judging by the trailer, but casting national treasure Walton Goggins (Justified) as a gunslinging Ghoul was quite simply a stroke of genius.

The first Fallout RPG was released in 1997, followed by several sequels and spinoffs. According to the game’s lore, modern civilization is destroyed in 2077 by a global nuclear war between the US and China. Survivors live in various underground vaults (fallout shelters). Each iteration of the game takes place somewhere across a post-apocalyptic US metro area and features a Vault Dweller—someone born and raised underground—as the protagonist. The first game takes place in 2161 and features a Vault Dweller from Vault 13, deep in the mountains of Southern California. The Vault Dweller must complete various missions to save the residents of Vault 13, which takes said protagonist to in-world places like Junktown; a merchant city called the Hub; and Necropolis, filled with Ghouls, i.e., humans badly mutated by exposure to nuclear radiation.

The series was announced in July 2020, with Westworld writers Jonathan Nolan and Lisa Joy serving as executive producers. In January 2022, it was revealed that Nolan would direct the first three episodes but that two other writers—Geneva Robertson-Dworet and Graham Wagner—would be the showrunners. Todd Howard, who directed several games in the franchise, is also an executive producer and has said the series is not an adaptation of any particular game, but it is set within the same continuity. Per the official premise:

Based on one of the greatest video game series of all time, Fallout is the story of haves and have-nots in a world in which there’s almost nothing left to have. Two hundred years after the apocalypse, the gentle denizens of luxury fallout shelters are forced to return to the irradiated hellscape their ancestors left behind—and are shocked to discover an incredibly complex, gleefully weird and highly violent universe waiting for them.

In addition to Goggins, Ella Purnell stars as a young Vault Dweller named Lucy, who must venture out into the wasteland on a mission to save her community in Vault 33. Aaron Moten plays a squire of the Brotherhood of Steel named Maximus; Kyle MacLachlan plays Lucy’s father, Hank, who is a Vault Overseer; Mike Doyle plays Mr. Spencer; Moises Arias plays Lucy’s brother, Norm; Michael Emerson plays an enigmatic wanderer named Wilzig; Johnny Pemberton plays Thaddeus; Cherien Dabis plays Birdie; Dale Dickey plays Ma June; Matty Cardarople plays Huey; Dave Register plays Chet; Rodrigo Luzzi plays Reg; and Annabel O’Hagan plays Steph. Sarita Choudhury and Leslie Uggams also appear in the series.

  • Nuclear weapons have devastated Los Angeles.

    YouTube/Prime Video

  • Ella Purnell stars as a young Vault Dweller named Lucy.

    YouTube/Prime Video

  • The Ghoul (Walton Goggins) is a mutated gunslinger and bounty hunter.

    YouTube/Prime Video

  • Aaron Moten plays Maximus, a squire with the Brotherhood of Steel.

    YouTube/Prime Video

  • Hey, it’s Michael Emerson of Lost fame, playing an enigmatic wanderer named Wilzig.

    YouTube/Prime Video

  • Kyle MacLachlan plays Lucy’s father, Hank, a Vault Overseer.

    YouTube/Prime Video

  • Sarita Choudhury looking fierce!

    YouTube/Prime Video

  • A glimpse of the Ghoul when he was still Cooper Howard, trying to save his daughter from a nuclear blast.

    YouTube/Prime Video

  • “I’m simply going to harvest your organs.”

    YouTube/Prime Video

  • Look out for Gulpers!

    YouTube/Prime Video

  • “There you are, you little killer.”

    YouTube/Prime Video

A teaser dropped in January, chock-full of details instantly recognizable to longtime fans of the games. The new trailer opens with a pre-apocalypse Goggins in a snazzy suit, pitching “a veritable Camelot of the nuclear age”: underground vaults housing residential communities, “because if the worst should happen tomorrow, the world is gonna need you to build a better day after.” The worst does happen, of course, and we catch glimpses of a devastated Los Angeles in the wake of a nuclear war, including a ruined Santa Monica Pier and Griffith Observatory. Then we see Lucy preparing to leave her Vault, despite warnings that “it isn’t like the Vault out there; it’s big.”

Lucy first encounters a hardened Ma June, who laughs derisively when Lucy naively asks what’s happened in the last 200 years. (Frankly, she thought all the Vault Dwellers were dead.) Lucy also has several run-ins with the Ghoul formerly known as Cooper Howard. Pretty much everyone she meets seems to want her dead, although the robot Mr. Handy helpfully informs her it just wants to harvest her organs. Maximus gets his share of screen time, both in and out of full Brotherhood of Steel armor, and we get a glimpse of the Brotherhood’s airships, as well as a mutant monster called a Gulper. It’s a violent, chaotic wasteland, but apparently, “there’s always somebody behind the wheel.”

All episodes of Fallout will premiere on Prime Video on April 11, 2024.

Listing image by YouTube/Prime Video

Ghouls, gulpers, and general mayhem abound in Fallout official trailer Read More »

visionos-1.1-tries-to-make-personas-less-unsettling,-plus-other-apple-os-updates

visionOS 1.1 tries to make Personas less unsettling, plus other Apple OS updates

persona non grata —

Apple starts picking low-hanging fruit in visionOS; other OSes see minor improvements.

A blurry, ghostly Persona in visionOS 1.0. They should at least look less bad in visionOS 1.1.

Enlarge / A blurry, ghostly Persona in visionOS 1.0. They should at least look less bad in visionOS 1.1.

Samuel Axon

Apple has released a long list of medium-sized software updates for most of its devices today. The macOS Sonoma 14.4, watchOS 10.4, tvOS 17.4, and visionOS 1.1 updates are all available now, and most of them add at least one or two major features as they fix multiple bugs and patch security vulnerabilities.

The visionOS 1.1 release is the first major update for Apple’s newest operating system, and as our coverage of the headset has demonstrated, there’s still plenty of low-hanging fruit to fix. Most notably for people who are trying to use the headset for work meetings, Apple says that there have been multiple changes to the look of Personas, the 3D avatars that show up in your place when you’re video chatting with the Vision Pro on your face. The update improves “hair and makeup appearance,” “neck and mouth representation,” and “rendering of the eyes,” and while it’s clear that it’s an improvement over the 1.0 release of Personas, the core uncanniness still seems to be intact. The Persona feature is still labeled as a beta.

Apple has also made tweaks to the appearance and functionality of the headset’s virtual keyboard, improved the Virtual Display feature’s Mac connectivity, and added a handful of mobile device management features for IT administrators.

Apple’s headlining feature for macOS 14.4 is the addition of new Unicode 15.1 emoji, plus podcast transcriptions in the Apple Music app. It’s unclear whether this release enables multiple external displays for users of the $1,599 M3 MacBook Pro, a feature that Apple announced alongside the new M3 MacBook Airs.

Apple Watch owners can look forward to the resolution of one annoying bug I’ve run into a few times on my own watch: a bug that would make the screen act as though it was receiving touch input even when you weren’t touching it. Sometimes referred to as a “ghost touch” or “phantom touch” bug, the only way to get it to go away was to reboot the watch. I haven’t noticed the bug since I installed one of the later watchOS 10.4 betas a couple of weeks ago.

Version 17.4 of the HomePod operating system now allows users to set their preferred music service, so telling Siri to play music will automatically use whatever service you want instead of defaulting to Apple Music unless you specify. The tvOS 17.4 update doesn’t appear to include any particular features or fixes of note.

All of the new releases follow iOS 17.4 and iPadOS 17.4, which came out a few days ago with mostly minor changes unless you happened to live in the European Union. For European users, that update ushers in Apple’s first attempt at compliance with new regulations that require the company to allow the use of third-party app stores, alternate browsing engines, and sideloaded apps. These changes come with plenty of conditions and caveats, as Apple seeks to remain the ultimate arbiter of what software can and can’t run on iPhones and iPads.

visionOS 1.1 tries to make Personas less unsettling, plus other Apple OS updates Read More »

us-lawmakers-vote-50-0-to-force-sale-of-tiktok-despite-angry-calls-from-users

US lawmakers vote 50-0 to force sale of TikTok despite angry calls from users

Divest or get out —

Lawmaker: TikTok must “sever relationship with the Chinese Communist Party.”

A large TikTok ad at a subway station.

Getty Images | Bloomberg

The House Commerce Committee today voted 50-0 to approve a bill that would force TikTok owner ByteDance to sell the company or lose access to the US market.

The Protecting Americans from Foreign Adversary Controlled Applications Act “addresses the immediate national security risks posed by TikTok and establishes a framework for the Executive Branch to protect Americans from future foreign adversary controlled applications,” a committee memo said. “If an application is determined to be operated by a company controlled by a foreign adversary—like ByteDance, Ltd., which is controlled by the People’s Republic of China—the application must be divested from foreign adversary control within 180 days.”

If the bill passes in the House and Senate and is signed into law by President Biden, TikTok would eventually be dropped from app stores in the US if its owner doesn’t sell. It also would lose access to US-based web-hosting services.

“If the application is not divested, entities in the United States would be prohibited from distributing the application through an application marketplace or store and providing web hosting services,” the committee memo said.

Chair: “CCP weaponizes applications it controls”

The bill was introduced on Tuesday and had 20 sponsors split evenly between Democrats and Republicans. TikTok urged its users to protest the bill, sending a notification that said, “Congress is planning a total ban of TikTok… Let Congress know what TikTok means to you and tell them to vote NO.”

Many users called lawmakers’ offices to complain, congressional staffers told Politico. “It’s so so bad. Our phones have not stopped ringing. They’re teenagers and old people saying they spend their whole day on the app and we can’t take it away,” one House GOP staffer was quoted as saying.

House Commerce Committee Chair Cathy McMorris Rodgers (R-Wash.) said that TikTok enlisting users to call lawmakers showed “in real time how the Chinese Communist Party can weaponize platforms like TikTok to manipulate the American people.”

“This is just a small taste of how the CCP weaponizes applications it controls to manipulate tens of millions of people to further their agenda. These applications present a clear national security threat to the United States and necessitate the decisive action we will take today,” she said before the vote.

The American Civil Liberties Union opposes the TikTok bill, saying it “would violate the First Amendment rights of hundreds of millions of Americans who use the app to communicate and express themselves daily.”

Bill sponsor: “It’s not a ban”

Bill sponsor Rep. Mike Gallagher (R-Wis.) expressed anger at TikTok for telling its users that the bill would ban the app completely, pointing out that the bill would only ban the app if it isn’t sold.

“If you actually read the bill, it’s not a ban. It’s a divestiture,” Gallagher said, according to Politico. Gallagher also said his bill puts the decision “squarely in the hands of TikTok to sever their relationship with the Chinese Communist Party.”

TikTok issued a statement calling the bill “an outright ban of TikTok, no matter how much the authors try to disguise it.” The House Commerce Committee responded to TikTok’s claim, calling it “yet another lie.”

While the bill text could potentially wrap in other apps in the future, it specifically lists the ByteDance-owned TikTok as a “foreign adversary controlled application.”

“It shall be unlawful for an entity to distribute, maintain, or update (or enable the distribution, maintenance, or updating of) a foreign adversary controlled application,” the bill says. An app would be allowed to stay in the US market after a divestiture if the president determines that the sale “would result in the relevant covered company no longer being controlled by a foreign adversary.”

US lawmakers vote 50-0 to force sale of TikTok despite angry calls from users Read More »

attack-wrangles-thousands-of-web-users-into-a-password-cracking-botnet

Attack wrangles thousands of web users into a password-cracking botnet

DISTRIBUTED PASSWORD CRACKING —

Ongoing attack is targeting thousands of sites, continues to grow.

Attack wrangles thousands of web users into a password-cracking botnet

Getty Images

Attackers have transformed hundreds of hacked sites running WordPress software into command-and-control servers that force visitors’ browsers to perform password-cracking attacks.

A web search for the JavaScript that performs the attack showed it was hosted on 708 sites at the time this post went live on Ars, up from 500 two days ago. Denis Sinegubko, the researcher who spotted the campaign, said at the time that he had seen thousands of visitor computers running the script, which caused them to reach out to thousands of domains in an attempt to guess the passwords of usernames with accounts on them.

Visitors unwittingly recruited

“This is how thousands of visitors across hundreds of infected websites unknowingly and simultaneously try to bruteforce thousands of other third-party WordPress sites,” Sinegubko wrote. “And since the requests come from the browsers of real visitors, you can imagine this is a challenge to filter and block such requests.”

Like the hacked websites hosting the malicious JavaScript, all the targeted domains are running the WordPress content management system. The script—just 3 kilobits in size—reaches out to an attacker-controlled getTaskURL, which in turn provides the name of a specific user on a specific WordPress site, along with 100 common passwords. When this data is fed into the browser visiting the hacked site, it attempts to log in to the targeted user account using the candidate passwords. The JavaScript operates in a loop, requesting tasks from the getTaskURL, reporting the results to the completeTaskURL, and then performing the steps again and again.

A snippet of the hosted JavaScript appears below, and below that, the resulting task:

const getTaskUrl = 'hxxps://dynamic-linx[.]com/getTask.php';  const completeTaskUrl = 'hxxps://dynamic-linx[.]com/completeTask.php';    
[871,"https://REDACTED","redacted","60","junkyard","johncena","jewish","jakejake","invincible","intern","indira","hawthorn","hawaiian","hannah1","halifax","greyhound","greene","glenda","futbol","fresh","frenchie","flyaway","fleming","fishing1","finally","ferris","fastball","elisha","doggies","desktop","dental","delight","deathrow","ddddddd","cocker","chilly","chat","casey1","carpenter","calimero","calgary","broker","breakout","bootsie","bonito","black123","bismarck","bigtime","belmont","barnes","ball","baggins","arrow","alone","alkaline","adrenalin","abbott","987987","3333333","123qwerty","000111","zxcv1234","walton","vaughn","tryagain","trent","thatcher","templar","stratus","status","stampede","small","sinned","silver1","signal","shakespeare","selene","scheisse","sayonara","santacruz","sanity","rover","roswell","reverse","redbird","poppop","pompom","pollux","pokerface","passions","papers","option","olympus","oliver1","notorious","nothing1","norris","nicole1","necromancer","nameless","mysterio","mylife","muslim","monkey12","mitsubishi"]

With 418 password batches as of Tuesday, Sinegubko has concluded the attackers are trying 41,800 passwords against each targeted site.

Sinegubko wrote:

Attack stages and lifecycle

The attack consists of five key stages that allow a bad actor to leverage already compromised websites to launch distributed brute force attacks against thousands of other potential victim sites.

  • Stage 1: Obtain URLs of WordPress sites. The attackers either crawl the Internet themselves or use various search engines and databases to obtain lists of target WordPress sites.
  • Stage 2: Extract author usernames. Attackers then scan the target sites, extracting real usernames of authors that post on those domains.
  • Stage 3: Inject malicious scripts. Attackers then inject their dynamic-linx[.]com/chx.js script to websites that they have already compromised.
  • Stage 4: Brute force credentials. As normal site visitors open infected web pages, the malicious script is loaded. Behind the scenes, the visitors’ browsers conduct a distributed brute force attack on thousands of target sites without any active involvement from attackers.
  • Stage 5: Verify compromised credentials. Bad actors verify brute forced credentials and gain unauthorized access to sites targeted in stage 1.

So, how do attackers actually accomplish a distributed brute force attack from the browsers of completely innocent and unsuspecting website visitors? Let’s take a look at stage 4 in closer detail.

Distributed brute force attack steps:

  1. When a site visitor opens an infected web page, the user’s browser requests a task from the hxxps://dynamic-linx[.]com/getTask.php URL.
  2. If the task exists, it parses the data and obtains the URL of the site to attack along with a valid username and a list of 100 passwords to try.
  3. For every password in the list, the visitor’s browser sends the wp.uploadFile XML-RPC API request to upload a file with encrypted credentials that were used to authenticate this specific request. That’s 100 API requests for each task! If authentication succeeds, a small text file with valid credentials is created in the WordPress uploads directory.
  4. When all the passwords are checked, the script sends a notification to hxxps://dynamic-linx[.]com/completeTask.php that the task with a specific taskId (probably a unique site) and checkId (password batch) has been completed.
  5. Finally, the script requests the next task and processes a new batch of passwords. And so on indefinitely while the infected page is open.

As of Tuesday, the researcher had observed “dozens of thousands of requests” to thousands of unique domains that checked for files uploaded by the visitor browsers. Most files reported 404 web errors, an indication that the login using the guessed password failed. Roughly 0.5 percent of cases returned a 200 response code, leaving open the possibility that password guesses may have been successful. On further inspection, only one of the sites was compromised. The others were using non-standard configurations that returned the 200 response, even for pages that weren’t available.

Over a four-day span ending Tuesday, Sinegubko recorded more than 1,200 unique IP addresses that tried to download the credentials file. Of those, five addresses accounted for over 85 percent of the requests:

IP % ASN
146.70.199.169 34.37% M247, RO
138.199.60.23 28.13% CDNEXT, GB
138.199.60.32 10.96% CDNEXT, GB
138.199.60.19 6.54% CDNEXT, GB
87.121.87.178 5.94% SOUZA-AS, BR

Last month, the researcher observed one of the addresses—87.121.87.178—hosting a URL used in a cryptojacking attack. One possibility for the change is that the earlier campaign failed because the malicious URL it relied on wasn’t hosted on enough hacked sites and, in response, the same attacker is using the password-cracking script in an attempt to recruit more sites.

As Sinegubko notes, the more recent campaign is significant because it leverages the computers and Internet connections of unwitting visitors who have done nothing wrong. One way end users can stop this is to use NoScript or another tool that blocks JavaScript from running on unknown sites. NoScript breaks enough sites that it’s not suitable for less experienced users, and even those with more experience often find the hassle isn’t worth the benefit. One other possible remedy is to use certain ad blockers.

Attack wrangles thousands of web users into a password-cracking botnet Read More »

after-astra-loses-99-percent-of-its-value,-founders-take-rocket-firm-private

After Astra loses 99 percent of its value, founders take rocket firm private

What goes up must come down —

First you burn the cash, then comes the crash.

Image of a rocket launch.

Enlarge / Liftoff of Astra’s Rocket 3.0 from Cape Canaveral, Florida.

Astra’s long, strange trip in the space business is taking another turn. The company announced Thursday that it is going private at an extremely low valuation.

Four years ago, the rocket company, based in Alameda, California, emerged from stealth with grand plans to develop a no-frills rocket that could launch frequently. “The theme that really makes this company stand out, which will capture the imagination of our customers, our investors, and our employees, is the idea that every day we will produce and launch a rocket,” Astra co-founder Chris Kemp said during a tour of the factory in February 2020.

Almost exactly a year later, on February 2, 2021, Astra went public via a special purpose acquisition company (or SPAC). “The transaction reflects an implied pro-forma enterprise value for Astra of approximately $2.1 billion,” the company stated at the time. For a time, the company’s stock even traded above this valuation.

But then, rockets started failing. Only two of the seven launches of the company’s “Rocket 3” vehicle were successful. In August 2022, the company announced a pivot to the larger Rocket 4 vehicle. It planned to begin conducting test launches in 2023, but that did not happen. Accordingly, the company’s stock price plummeted.

Last November Kemp and the company’s co-founder, Adam London, proposed to buy Astra shares at $1.50, approximately double their price. The company’s board of directors did not accept the deal. Then, in late February, Kemp and London sharply cut their offer to take the company private, warning of “imminent bankruptcy” if the company doesn’t accept their new proposal. They offered $0.50 a share, well below the trading value of approximately $0.80 a share.

On Thursday, Astra said that this deal was being consummated.

“Astra Space, Inc. announced today that it has entered into a definitive merger agreement pursuant to which the acquiring entity has agreed, subject to customary closing conditions, to acquire all shares of Astra common stock not already owned by it for $0.50 per share in cash,” the company stated. The acquiring entity consists of Kemp, London, and other long-term investors.

Where Astra goes from here is anyone’s guess. Rocket 4 is likely months or years from the launch pad. It faces stiff competition not just from established small launch players such as Rocket Lab and Firefly but also from new entrants as well, including ABL Space and Stoke Space. Additionally, all of these small launch companies have been undercut in price by SpaceX’s Transporter missions, which launch dozens of satellites at a time on the Falcon 9 booster.

Additionally, Astra’s spacecraft engine business—acquired previously from Apollo Fusion—may or may not be profitable now, but there are questions about its long-term viability as well.

“I don’t fault management for seizing the opportunity to raise hundreds of millions of dollars by SPAC’ing, but a pre-revenue launch company without a proven rocket was probably never a good match for the public markets,” said Case Taylor, investor and author of the Case Closed newsletter.

Taylor added that he hopes that Astra spacecraft engines find a way to thrive in the new Astra, as the space industry values their performance. “I hope to see that diamond survive and thrive,” he said.

After Astra loses 99 percent of its value, founders take rocket firm private Read More »

“disgraceful”:-messy-tos-update-allegedly-locks-roku-devices-until-users-give-in

“Disgraceful”: Messy ToS update allegedly locks Roku devices until users give in

Show’s over —

Users are opted in automatically unless they write a letter to Roku by March 21.

A promotional image for a Roku TV.

Enlarge / A promotional image for a Roku TV.

Roku customers are threatening to stop using, or to even dispose of, their low-priced TVs and streaming gadgets after the company appears to be locking devices for people who don’t conform to the recently updated terms of service (ToS).

This month, users on Roku’s support forums reported suddenly seeing a message when turning on their Roku TV or streaming device reading: “We’ve made an important update: We’ve updated our Dispute Resolution Terms. Select ‘Agree’ to agree to these updated Terms and to continue enjoying our products and services. Press to view these updated Terms.” A large button reading “Agree” follows. The pop-up doesn’t offer a way to disagree, and users are unable to use their device unless they hit agree.

Customers have left pages of complaints on Roku’s forum. One user going by “rickstanford” said they were “FURIOUS!!!!” and expressed interest in sending their reported six Roku devices back to the company since “apparently I don’t own them despite spending hundreds of dollars on them.”

Another user going by Formercustomer, who, I suspect, is aptly named, wrote:

So, you buy a product, and you use it. And they want to change the terms limiting your rights, and they basically brick the device … if you don’t accept their new terms. … I hope they get their comeuppance here, as this is disgraceful.

Roku has further aggravated customers who have found that disagreeing to its updated terms is harder than necessary. Roku is willing to accept agreement to its terms with a single button press, but to opt out, users must jump through hoops that include finding that old book of stamps.

To opt out of Roku’s ToS update, which primarily changes the “Dispute Resolution Terms,” users must send a letter to Roku’s general counsel in California mentioning: “the name of each person opting out and contact information for each such person, the specific product models, software, or services used that are at issue, the email address that you used to set up your Roku account (if you have one), and, if applicable, a copy of your purchase receipt.” Roku required all this to opt out of its terms previously, as well.

But the new update means that while users read this information and have their letter delivered, they’re unable to use products they already paid for and used, in some cases for years, under different “dispute resolution terms.”

“I can’t watch my TV because I don’t agree to the Dispute Resolution Terms. Please help,” a user going by Campbell220 wrote on Roku’s support forum.

Based on the ToS’s wording, users could technically choose to agree to the ToS on their device and then write a letter saying they’d like to opt out. But opting into an agreement only to use a device under terms you don’t agree with is counterintuitive.

Even more pressing, Roku’s ToS states that users only have “within 30 days of you first becoming subject to” Roku’s updated terms, which was February 20, to opt out. Otherwise, you’re opted in automatically.

Archived records of Roku’s ToS website seem to show the new ToS being online since at least August. But it was only this month that users reported that their TVs were useless unless they accepted the terms via an on-screen message. Roku declined to answer Ars Technica’s questions about the changes, including why it didn’t alert users about them earlier. But a spokesperson shared a statement saying:

Like many companies, Roku updates its terms of service from time to time. When we do, we take steps to make sure customers are informed of the change.

What Roku changed

Customers are criticizing Roku for aggressively pushing them to accept ToS changes. The updates focus on Roku’s terms for dispute resolution, which prevent users from suing Roku. The terms have long forced a described arbitration process for dispute resolution. The new ToS is more detailed, including specifics for “mass arbitrations.” The biggest change is the introduction of a section called “Required Informal Dispute Resolution.” It states that except for a small number of described exceptions (which include claims around intellectual property), users must make “a good-faith effort” to negotiate with Roku, or vice versa, for at least 45 days before entering arbitration.

Roku is also taking heat for using forced arbitration at all, which some argue can have one-sided benefits. In a similar move in December, for example, 23andMe said users had 30 days to opt out of its new dispute resolution terms, which included mass arbitration rules (the genetics firm let customers opt out via email, though). The changes came after 23andMe user data was stolen in a cyberattack. Forced arbitration clauses are frequently used by large companies to avoid being sued by fed-up customers.

Roku’s forced arbitration rules aren’t new but are still making customers question their streaming hardware, especially considering that there are rivals, like Amazon, Apple, and Google, that don’t force arbitration on users.

Based on comments in Roku’s forums, some users were unaware they were already subject to arbitration rules and only learned this as a result of Roku’s abrupt pop-up.

But with the functionality of already-owned devices blocked until users give in, Roku’s methods are questionable, and Roku may lose customers over it. Per an anonymous user on Roku’s forum:

I’m unplugging right now.

“Disgraceful”: Messy ToS update allegedly locks Roku devices until users give in Read More »

rivian-reveals-three-new,-smaller-electric-suvs:-the-r2,-r3,-and-r3x

Rivian reveals three new, smaller electric SUVs: The R2, R3, and R3X

no astromech droids were hurt in the making of this post —

The new EVs use Rivian’s new midsize platform, and R2 deliveries begin in 2026.

Rivian R2, R3, and R3X SUVs parked together

Enlarge / From left to right, the Rivian R2, Rivian R3, and Rivian R3X.

Rivian

Today in California, Rivian CEO and founder RJ Scaringe unveiled new additions to the electric vehicle startup’s model lineup. Details of the new R2 had leaked earlier this week, although not entirely accurately—the new smaller EV will start at $45,000 (not $47,000) when it goes on sale in 2026.

At first glance of the R2, you might be excused for thinking you’re looking at a Rivian R1S, for both SUVs share a lot of styling details—not just Rivian’s distinctive daylight running lights but also the overall shape of the vehicle. But the new car is shorter in both length (by 15.7 inches/400 mm) and height, and only offers two rows of seating, not three.

Convenience improvements include a pair of gloveboxes under the dashboard and a flashlight that’s stored in the door. At the back, the glass rear window can drop down to allow access to the cargo area. Both rows of seats fold flat, in case you want to camp in your car.

Rivian will build three different powertrain configurations of the R2: a single-motor, rear-wheel drive version, a twin-motor, all-wheel drive model, and a tri-motor option. Scaringe said that all three will have at least 300 miles (482 km) of range. The tri-motor R2 can accelerate from 0–60 mph in under three seconds.

The battery pack uses larger-format 4695 cylindrical cells, and Scaringe says that the R2 will go into production at the company’s first factory in Normal, Illinois. Reservations for the R2 opened today with a $100 deposit. Deliveries are scheduled for the first half of 2026.

  • The Rivian R2 looks a lot like the larger R1S.

    Rivian

  • Rivian says it will save $2.5 billion by starting R2 production in Illinois instead of waiting for the plant in Georgia.

    Rivian

  • A size comparison with the R1S.

    Rivian

  • Here’s the R2 interior

    Rivian

  • The addition of gloveboxes is a welcome touch.

    Rivian

  • The R2’s seats all fold flat.

    Rivian

  • A look at the R2 door cards.

    Rivian

  • The center console has plenty of cubbies.

    Rivian

  • Rivian plans a range of R2 accessories, including a camp kitchen and a tent.

    Rivian

Although details on the R2 had already leaked, the company prevented that from happening for another new model, introduced by Scaringe with a Steve Jobs-like “one more thing…” toward the end of the presentation. In fact, it was two new things: a pair of even smaller electric crossovers called the R3 and R3X.

Like the R2, these two new models use the same new midsize platform (as opposed to the larger platform that underpins the R1S, R1T, and the Rivian Delivery Van). The R3 and R3X keep Rivian’s distinctive light signature but eschew copying the larger SUV’s silhouette for a shape that looks more like a Fiat Panda or Lada Niva, at least to this observer.

The R3 has a wheelbase that is 5 inches (125 mm) shorter than the R2 but will also be offered with the same three choices of powertrains and have more than 300 miles of range. The R3X is much like the R3 but with wheel arch extensions and a rear spoiler.

Like the bigger R1 and R2, the R3 and R3X have a cargo frunk up front. Similar to the R2, the front and rear seats fold flat. The rear hatch glass opens independently of the hatch, which allows you to carry larger payloads.

The R3 and R3X will be built at Rivian’s new factory in Georgia, but for now, we can’t tell you when deliveries will start or how much you’ll have to pay to have one in your driveway or garage.

  • The same adorable face but in a small new package—the Rivian R3.

    Rivian

  • The glass in the hatch opens independently for large loads like a surfboard.

    Rivian

  • I’ll be honest, if Rivian was taking R3 deposits today I’d have sent in my $100.

    Rivian

  • The Rivian R3X is off-road coded.

    Rivian

  • Rivian

  • A look at the Rivian R3 interior.

    Rivian

  • The R3’s back seat will be a bit more cramped than the R2.

    Rivian

  • The R3’s door card, which also has a flashlight stored in it.

    Rivian

  • The R3X interior has the same layout as the R3 but with different materials.

    Rivian

  • The rear seats in the R3 and R3X are split 40: 20: 40.

    Rivian

DC fast-charging for all three models should take under 30 minutes to charge from 10–80 percent, Rivian tells us, and the cars will feature native J3400 charging ports. We also learned that later this month, existing Rivian owners will gain access to the Tesla Supercharger network, although these EVs will need to use a CCS1-J3400 adapter.

“I have never been more excited to launch new products—R2 and R3 are distinctly Rivian in terms of performance, capability and usability yet with pricing that makes them accessible to a lot of people. Our design and engineering teams are extremely focused on driving innovation into not only the product features but also our approach to manufacturing to achieve dramatically lower costs,” said Scaringe. “R2 provides buyers starting in the $45,000 price range with a much-needed choice with a thoroughly developed technology platform that is bursting with personality. I can’t wait to get these to customers.”

Rivian reveals three new, smaller electric SUVs: The R2, R3, and R3X Read More »

de-extinction-company-manages-to-generate-first-elephant-stem-cells

De-extinction company manages to generate first elephant stem cells

Large collection of cells with a red outline and white nucleus.

Enlarge / Elephant stem cells turned out to be a hassle to generate. (credit: Colossal.)

A company called Colossal plans on pioneering the de-extinction business, taking species that have died within the past few thousand years and restoring them through the use of DNA editing and stem cells. It’s grabbed headlines recently by announcing some compelling targets: the tylacine, an extinct marsupial predator, and an icon of human carelessness, the dodo. But the company was formed to tackle an even more audacious target: the mammoth, which hasn’t roamed the northern hemisphere for thousands of years.

Obviously, there are a host of ethical and conservation issues that would need to be worked out before Colossal’s plans go forward. But there are some major practical hurdles as well, most of them the product of the distinct and extremely slow reproductive biology of the mammoth’s closest living relatives, the elephants. At least one of those has now been cleared, as the company is announcing the production of the first elephant stem cells. The process turned out to be extremely difficult, suggesting that the company still has a long road ahead of it.

Lots of hurdles

Colossal’s basic road map for de-extinction is pretty straightforward. We have already obtained the genomes of a number of species that have gone extinct recently, as well as those of their closest living relatives. By comparing the two, we can identify key genetic differences that make the extinct species distinct. We can then edit those differences into stem cells obtained from the living species and use that species as a surrogate for embryos produced from these stem cells. This will have to be done using stem cells from a number of individuals to ensure that the resulting population has sufficient genetic diversity to be stable.

Read 17 remaining paragraphs | Comments

De-extinction company manages to generate first elephant stem cells Read More »

openai-clarifies-the-meaning-of-“open”-in-its-name,-responding-to-musk-lawsuit

OpenAI clarifies the meaning of “open” in its name, responding to Musk lawsuit

The OpenAI logo as an opening to a red brick wall.

Enlarge (credit: Benj Edwards / Getty Images)

On Tuesday, OpenAI published a blog post titled “OpenAI and Elon Musk” in response to a lawsuit Musk filed last week. The ChatGPT maker shared several archived emails from Musk that suggest he once supported a pivot away from open source practices in the company’s quest to develop artificial general intelligence (AGI). The selected emails also imply that the “open” in “OpenAI” means that the ultimate result of its research into AGI should be open to everyone but not necessarily “open source” along the way.

In one telling exchange from January 2016 shared by the company, OpenAI Chief Scientist Illya Sutskever wrote, “As we get closer to building AI, it will make sense to start being less open. The Open in openAI means that everyone should benefit from the fruits of AI after its built, but it’s totally OK to not share the science (even though sharing everything is definitely the right strategy in the short and possibly medium term for recruitment purposes).”

In response, Musk replied simply, “Yup.”

Read 8 remaining paragraphs | Comments

OpenAI clarifies the meaning of “open” in its name, responding to Musk lawsuit Read More »

spain-tells-sam-altman,-worldcoin-to-shut-down-its-eyeball-scanning-orbs

Spain tells Sam Altman, Worldcoin to shut down its eyeball-scanning orbs

Only for real humans —

Cryptocurrency launched by OpenAI’s Altman is drawing scrutiny from regulators.

A spherical device that scans people's eyeballs.

Enlarge / Worldcoin’s “Orb,” a device that scans your eyeballs to verify that you’re a real human.

Spain has moved to block Sam Altman’s cryptocurrency project Worldcoin, the latest blow to a venture that has raised controversy in multiple countries by collecting customers’ personal data using an eyeball-scanning “orb.”

The AEPD, Spain’s data protection regulator, has demanded that Worldcoin immediately ceases collecting personal information in the country via the scans and that it stops using data it has already gathered.

The regulator announced on Wednesday that it had taken the “precautionary measure” at the start of the week and had given Worldcoin 72 hours to demonstrate its compliance with the order.

Mar España Martí, AEPD director, said Spain was the first European country to move against Worldcoin and that it was impelled by special concern that the company was collecting information about minors.

“What we have done is raise the alarm in Europe. But this is an issue that affects… citizens in all the countries of the European Union,” she said. “That means there has to be coordinated action.”

Worldcoin, co-founded by Altman in 2019, has been offering tokens of its own cryptocurrency to people around the world, in return for their consent to have their eyes scanned by an orb.

The scans are used as a form of identification as it seeks to create a reliable mechanism to distinguish between humans and machines as artificial intelligence becomes more advanced.

Worldcoin was not immediately available for comment.

The Spanish regulator’s decision is the latest blow to the aspirations of the OpenAI boss and his Worldcoin co-founders Max Novendstern and Alex Blania following a series of setbacks elsewhere in the world.

At the point of its rollout last summer, the San Francisco and Berlin headquartered start-up avoided launching its crypto tokens in the US on account of the country’s harsh crackdown on the digital assets sector.

The Worldcoin token is also not available in major global markets such as China and India, while watchdogs in Kenya last year ordered the project to shut down operations. The UK’s Information Commissioner’s Office has previously said it would be making inquiries into Worldcoin.

While some jurisdictions have raised concerns about the viability of a Worldcoin cryptocurrency token, Spain’s latest crackdown targets the start-up’s primary efforts to establish a method to prove customers’ “personhood”—work that Altman characterizes as essential in a world where sophisticated AI is harder to distinguish from humans.

In the face of growing scrutiny, Altman told the Financial Times he could imagine a world where his start-up could exist without its in-house cryptocurrency.

Worldcoin has registered 4 million users, according to a person with knowledge of the matter. Investors poured roughly $250 million into the company, including venture capital groups Andreessen Horowitz and Khosla Ventures, internet entrepreneur Reid Hoffman and, prior to the collapse of his FTX empire, Sam Bankman-Fried.

The project attracted media attention and prompted a handful of consumer complaints in Spain as queues began to grow at the stands in shopping centers where Worldcoin is offering cryptocurrency in exchange for eyeball scans.

In January, the data protection watchdog in the Basque country, one of Spain’s autonomous regions, issued a warning about the eye-scanning technology Worldcoin was using in a Bilbao mall. The watchdog, the AVPD, said it fell under biometric data protection rules and that a risk assessment was needed.

España Martí said the Spanish agency was acting on concerns that the Worldcoin initiative did not comply with biometric data laws, which demand that users be given adequate information about how their data will be used and that they have the right to erase it.

Sharing such biometric data, she said, opened people up to a variety of risks ranging from identity fraud to breaches of health privacy and discrimination.

“I want to send a message to young people. I understand that it can be very tempting to get €70 or €80 that sorts you out for the weekend,” España Martí said, but “giving away personal data in exchange for these derisory amounts of money is a short, medium and long-term risk.”

Spain tells Sam Altman, Worldcoin to shut down its eyeball-scanning orbs Read More »