Mike M. – Page 12

Greening of Antartica shows how climate change affects the frozen continent

Antarctica, climate change, Science, syndication / Mike M. / October 6, 2024

Plant growth is accelerating on the Antarctic Peninsula and nearby islands.

Moss and rocks cover the ground on Robert Island in Antarctica. Photographer: Isadora Romero/Bloomberg Credit: Bloomberg via Getty

When satellites first started peering down on the craggy, glaciated Antarctic Peninsula about 40 years ago, they saw only a few tiny patches of vegetation covering a total of about 8,000 square feet—less than a football field.

But since then, the Antarctic Peninsula has warmed rapidly, and a new study shows that mosses, along with some lichen, liverworts and associated algae, have colonized more than 4.6 square miles, an area nearly four times the size of New York’s Central Park.

The findings, published Friday in Nature Geoscience, based on a meticulous analysis of Landsat images from 1986 to 2021, show that the greening trend is distinct from natural variability and that it has accelerated by 30 percent since 2016, fast enough to cover nearly 75 football fields per year.

Greening at the opposite end of the planet, in the Arctic, has been widely studied and reported, said co-author Thomas Roland, a paleoecologist with the University of Exeter who collects and analyzes mud samples to study environmental and ecological change. “But the idea,” he said, “that any part of Antarctica could, in any way, be green is something that still really jars a lot of people.”

illustration of Antarctica and satellite photos — Credit: Inside Climate News

As the planet heats up, “even the coldest regions on Earth that we expect and understand to be white and black with snow, ice, and rock are starting to become greener as the planet responds to climate change,” he said.

The tenfold increase in vegetation cover since 1986 “is not huge in the global scheme of things,” Roland added, but the accelerating rate of change and the potential ecological effects are significant. “That’s the real story here,” he said. “The landscape is going to be altered partially because the existing vegetation is expanding, but it could also be altered in the future with new vegetation coming in.”

In the Arctic, vegetation is expanding on a scale that affects the albedo, or the overall reflectivity of the region, which determines the proportion of the sun’s heat energy that is absorbed by the Earth’s surface as opposed to being bounced away from the planet. But the spread of greenery has not yet changed the albedo of Antarctica on a meaningful scale because the vegetated areas are still too small to have a regional impact, said co-author Olly Bartlett, a University of Hertfordshire researcher who specializes in using satellite data to map environmental change.

“The real significance is about the ecological shift on the exposed land, the land that’s ice-free, creating an area suitable for more advanced plant life or invasive species to get a foothold,” he said.

Bartlett said Google Earth Engine enabled the scientists to process a massive amount of data from the Landsat images to meet a high standard of verification of plant growth. As a result, he added, the changes they reported may actually be conservative.

“It’s becoming easier for life to live there,” he said. “These rates of change we’re seeing made us think that perhaps we’ve captured the start of a more dramatic transformation.”

In the areas they studied, changes to the albedo could have a small local effect, Roland said, as more land free of reflective ice “can feed into a positive feedback loop that creates conditions that are more favorable for vegetation expansion as well.”

Antarctic forests at similar CO₂ levels

Other research, including fossil studies, suggests that beech trees grew on Antarctica as recently as 2.5 million years ago, when carbon dioxide levels in the atmosphere were similar to today, another indicator of how unchecked greenhouse gas emissions can rapidly warm Earth’s climate.

Currently, there are only two species of flowering plants native to the Antarctic Peninsula, Antarctic hair grass, and Antarctic pearlwort. “But with a few new grass seeds here and there, or a few spores, and all of a sudden, you’ve got a very different ecosystem,” he said.

And it’s not just plants, he added. “Increasingly, we’re seeing evidence that non-native insect life is taking hold in Antarctica. And that can dramatically change things as well.”

The study shows how climate warming will shake up Antarctic ecosystems, said conservation scientist Jasmine Lee, a research fellow with the British Antarctic Survey who was not involved in the new study.

“It is clear that bank-forming mosses are expanding their range with warmer and wetter conditions, which is likely facilitating similar expansions for some of the invertebrate communities that rely on them for habitat,” she said. “At the same time, some specialist species, such as the more dry-loving mosses and invertebrates, might decline.”

She said the new study is valuable because it provides data across a broad region showing that Antarctic ecosystems are already rapidly altering and will continue to do so as climate change progresses.

“We focus a lot on how climate change is melting ice sheets and changing sea ice,” she said. “It’s good to also highlight that the terrestrial ecosystems are being impacted.”

The study shows climate impacts growing in “regions previously thought nearly immune to the accelerated warming we’re seeing today,” said climate policy expert Pam Pearson, director of the International Cryosphere Climate Initiative.

“It’s as important a signal as the loss of Antarctic sea ice over the past several years,” she said.

The new study identified vegetative changes by comparing the Landsat images at a resolution of 300-square-feet per pixel, detailed enough to accurately map vegetative growth, but it didn’t identify specific climate change factors that might be driving the expansion of plant life.

But other recent studies have documented Antarctic changes that could spur plant growth, including how some regions are affected by warm winds and by increasing amounts of rain from atmospheric rivers, as well as by declining sea ice that leads adjacent land areas to warm, all signs of rapid change in Antarctica.

Roland said their new study was in part spurred by previous research showing how fast patches of Antarctic moss were growing vertically and how microbial activity in tiny patches of soil was also accelerating.

“We’d taken these sediment cores, and done all sorts of analysis, including radiocarbon dating … showing the growth in the plants we’d sampled increasing dramatically,” he said.

Those measurements confirmed that the plants are sensitive to climate change, and as a next step, researchers wanted to know “if the plants are growing sideways at the same dramatic rate,” he said. “It’s one thing for plants to be growing upwards very fast. If they’re growing outwards, then you know you’re starting to see massive changes and massive increases in vegetation cover across the peninsula.”

With the study documenting significant horizontal expansion of vegetation, the researchers are now studying how recently deglaciated areas were first colonized by plants. About 90 percent of the glaciers on the Antarctic Peninsula have been shrinking for the past 75 years, Roland said.

“That’s just creating more and more land for this potentially rapid vegetation response,” he said. “So like Olly says, one of the things we can’t rule out is that this really does increase quite dramatically over the next few decades. Our findings raise serious concerns about the environmental future of the Antarctic Peninsula and of the continent as a whole.”

This story originally appeared on Inside Climate News.

Greening of Antartica shows how climate change affects the frozen continent Read More »

Neo-Nazis head to encrypted SimpleX Chat app, bail on Telegram

Biz & IT, hate speech, Neo-nazis, Policy, privacy, SimpleX Chat, syndication, telegram / Mike M. / October 5, 2024

“SimpleX, at its core, is designed to be truly distributed with no central server. This allows for enormous scalability at low cost, and also makes it virtually impossible to snoop on the network graph,” Poberezkin wrote in a company blog post published in 2022.

SimpleX’s policies expressly prohibit “sending illegal communications” and outline how SimpleX will remove such content if it is discovered. Much of the content that these terrorist groups have shared on Telegram—and are already resharing on SimpleX—has been deemed illegal in the UK, Canada, and Europe.

Argentino wrote in his analysis that discussion about moving from Telegram to platforms with better security measures began in June, with discussion of SimpleX as an option taking place in July among a number of extremist groups. Though it wasn’t until September, and the Terrorgram arrests, that the decision was made to migrate to SimpleX, the groups are already establishing themselves on the new platform.

“The groups that have migrated are already populating the platform with legacy material such as Terrorgram manuals and are actively recruiting propagandists, hackers, and graphic designers, among other desired personnel,” the ISD researchers wrote.

However, there are some downsides to the additional security provided by SimpleX, such as the fact that it is not as easy for these groups to network and therefore grow, and disseminating propaganda faces similar restrictions.

“While there is newfound enthusiasm over the migration, it remains unclear if the platform will become a central organizing hub,” ISD researchers wrote.

And Poberezkin believes that the current limitations of his technology will mean these groups will eventually abandon SimpleX.

“SimpleX is a communication network rather than a service or a platform where users can host their own servers, like in OpenWeb, so we were not aware that extremists have been using it,” says Poberezkin. “We never designed groups to be usable for more than 50 users and we’ve been really surprised to see them growing to the current sizes despite limited usability and performance. We do not think it is technically possible to create a social network of a meaningful size in the SimpleX network.”

This story originally appeared on wired.com.

Neo-Nazis head to encrypted SimpleX Chat app, bail on Telegram Read More »

Thousands of Linux systems infected by stealthy malware since 2021

Biz & IT, exploits, Linux, malware, Security, vulnerabilities / Mike M. / October 5, 2024

The ability to remain installed and undetected makes Perfctl hard to fight.

Real Java Script code developing screen. Programing workflow abstract algorithm concept. Closeup of Java Script and HTML code.

Thousands of machines running Linux have been infected by a malware strain that’s notable for its stealth, the number of misconfigurations it can exploit, and the breadth of malicious activities it can perform, researchers reported Thursday.

The malware has been circulating since at least 2021. It gets installed by exploiting more than 20,000 common misconfigurations, a capability that may make millions of machines connected to the Internet potential targets, researchers from Aqua Security said. It can also exploit CVE-2023-33246, a vulnerability with a severity rating of 10 out of 10 that was patched last year in Apache RocketMQ, a messaging and streaming platform that’s found on many Linux machines.

Perfctl storm

The researchers are calling the malware Perfctl, the name of a malicious component that surreptitiously mines cryptocurrency. The unknown developers of the malware gave the process a name that combines the perf Linux monitoring tool and ctl, an abbreviation commonly used with command line tools. A signature characteristic of Perfctl is its use of process and file names that are identical or similar to those commonly found in Linux environments. The naming convention is one of the many ways the malware attempts to escape notice of infected users.

Perfctl further cloaks itself using a host of other tricks. One is that it installs many of its components as rootkits, a special class of malware that hides its presence from the operating system and administrative tools. Other stealth mechanisms include:

Stopping activities that are easy to detect when a new user logs in
Using a Unix socket over TOR for external communications
Deleting its installation binary after execution and running as a background service thereafter
Manipulating the Linux process pcap_loop through a technique known as hooking to prevent admin tools from recording the malicious traffic
Suppressing mesg errors to avoid any visible warnings during execution.

The malware is designed to ensure persistence, meaning the ability to remain on the infected machine after reboots or attempts to delete core components. Two such techniques are (1) modifying the ~/.profile script, which sets up the environment during user login so the malware loads ahead of legitimate workloads expected to run on the server and (2) copying itself from memory to multiple disk locations. The hooking of pcap_loop can also provide persistence by allowing malicious activities to continue even after primary payloads are detected and removed.

Besides using the machine resources to mine cryptocurrency, Perfctl also turns the machine into a profit-making proxy that paying customers use to relay their Internet traffic. Aqua Security researchers have also observed the malware serving as a backdoor to install other families of malware.

Assaf Morag, Aqua Security’s threat intelligence director, wrote in an email:

Perfctl malware stands out as a significant threat due to its design, which enables it to evade detection while maintaining persistence on infected systems. This combination poses a challenge for defenders and indeed the malware has been linked to a growing number of reports and discussions across various forums, highlighting the distress and frustration of users who find themselves infected.

Perfctl uses a rootkit and changes some of the system utilities to hide the activity of the cryptominer and proxy-jacking software. It blends seamlessly into its environment with seemingly legitimate names. Additionally, Perfctl’s architecture enables it to perform a range of malicious activities, from data exfiltration to the deployment of additional payloads. Its versatility means that it can be leveraged for various malicious purposes, making it particularly dangerous for organizations and individuals alike.

“The malware always manages to restart”

While Perfctl and some of the malware it installs are detected by some antivirus software, Aqua Security researchers were unable to find any research reports on the malware. They were, however, able to find a wealth of threads on developer-related sites that discussed infections consistent with it.

This Reddit comment posted to the CentOS subreddit is typical. An admin noticed that two servers were infected with a cryptocurrency hijacker with the names perfcc and perfctl. The admin wanted help investigating the cause.

“I only became aware of the malware because my monitoring setup alerted me to 100% CPU utilization,” the admin wrote in the April 2023 post. “However, the process would stop immediately when I logged in via SSH or console. As soon as I logged out, the malware would resume running within a few seconds or minutes.” The admin continued:

I have attempted to remove the malware by following the steps outlined in other forums, but to no avail. The malware always manages to restart once I log out. I have also searched the entire system for the string “perfcc” and found the files listed below. However, removing them did not resolve the issue. as it keep respawn on each time rebooted.

Other discussions include: Reddit, Stack Overflow (Spanish), forobeta (Spanish), brainycp (Russian), natnetwork (Indonesian), Proxmox (Deutsch), Camel2243 (Chinese), svrforum (Korean), exabytes, virtualmin, serverfault and many others.

After exploiting a vulnerability or misconfiguration, the exploit code downloads the main payload from a server, which, in most cases, has been hacked by the attacker and converted into a channel for distributing the malware anonymously. An attack that targeted the researchers’ honeypot named the payload httpd. Once executed, the file copies itself from memory to a new location in the /tmp directory, runs it, and then terminates the original process and deletes the downloaded binary.

Once moved to the /tmp directory, the file executes under a different name, which mimics the name of a known Linux process. The file hosted on the honeypot was named sh. From there, the file establishes a local command-and-control process and attempts to gain root system rights by exploiting CVE-2021-4043, a privilege-escalation vulnerability that was patched in 2021 in Gpac, a widely used open source multimedia framework.

The malware goes on to copy itself from memory to a handful of other disk locations, once again using names that appear as routine system files. The malware then drops a rootkit, a host of popular Linux utilities that have been modified to serve as rootkits, and the miner. In some cases, the malware also installs software for “proxy-jacking,” the term for surreptitiously routing traffic through the infected machine so the true origin of the data isn’t revealed.

The researchers continued:

As part of its command-and-control operation, the malware opens a Unix socket, creates two directories under the /tmp directory, and stores data there that influences its operation. This data includes host events, locations of the copies of itself, process names, communication logs, tokens, and additional log information. Additionally, the malware uses environment variables to store data that further affects its execution and behavior.

All the binaries are packed, stripped, and encrypted, indicating significant efforts to bypass defense mechanisms and hinder reverse engineering attempts. The malware also uses advanced evasion techniques, such as suspending its activity when it detects a new user in the btmp or utmp files and terminating any competing malware to maintain control over the infected system.

The diagram below captures the attack flow:

The following image captures some of the names given to the malicious files that are installed:

By extrapolating data such as the number of Linux servers connected to the Internet across various services and applications, as tracked by services such as Shodan and Censys, the researchers estimate that the number of machines infected by Perfctl is measured in the thousands. They say that the pool of vulnerable machines—meaning those that have yet to install the patch for CVE-2023-33246 or contain a vulnerable misconfiguration—is in the millions. The researchers have yet to measure the amount of cryptocurrency the malicious miners have generated.

People who want to determine if their device has been targeted or infected by Perfctl should look for indicators of compromise included in Thursday’s post. They should also be on the lookout for unusual spikes in CPU usage or sudden system slowdowns, particularly if they occur during idle times. To prevent infections, it’s important that the patch for CVE-2023-33246 be installed and that the the misconfigurations identified by Aqua Security be fixed. Thursday’s report provides other steps for preventing infections.

Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at @dangoodin on Mastodon. Contact him on Signal at DanArs.82.

Thousands of Linux systems infected by stealthy malware since 2021 Read More »

How London’s Crystal Palace was built so quickly

architecture, Crystal Palace, engineering, Science / Mike M. / October 4, 2024

London’s Great Exhibition of 1851 attracted some 6 million people eager to experience more than 14,000 exhibitors showcasing 19th-century marvels of technology and engineering. The event took place in the Crystal Palace, a 990,000-square-foot building of cast iron and plate glass originally located in Hyde Park. And it was built in an incredible 190 days. According to a recent paper published in the International Journal for the History of Engineering and Technology, one of the secrets was the use of a standardized screw thread, first proposed 10 years before its construction, although the thread did not officially become the British standard until 1905.

“During the Victorian era there was incredible innovation from workshops right across Britain that was helping to change the world,” said co-author John Gardner of Anglia Ruskin University (ARU). “In fact, progress was happening at such a rate that certain breakthroughs were perhaps never properly realized at the time, as was the case here with the Crystal Palace. Standardization in engineering is essential and commonplace in the 21st century, but its role in the construction of the Crystal Palace was a major development.”

The design competition for what would become the Crystal Palace was launched in March 1850, with a deadline four weeks later, and the actual, fully constructed building opened on May 1, 1851. The winning design, by Joseph Patterson, wasn’t chosen until quite late in the game after numerous designs had been rejected—most because they were simply too far above the £100,000 budget.

Joseph Paxton's first sketch for the Great Exhibition Building, c. 1850, using pen and ink on blotting paper — Joseph Paxton’s first sketch for the Great Exhibition Building, c. 1850, using pen and ink on blotting paper. Credit: Victoria and Albert Museum/CC BY-SA 3.0

Patterson’s design called for what was essentially a giant conservatory consisting of a multi-dimensional grid of 24-foot modules. The design elements included 3,300 supporting columns with four flange faces, drilled so they could be bolted to connecting and base pieces. (The hollow columns did double duty as drainage pipes for rainwater.) The design also called for diagonal bracing (aka cross bracing) for additional stability.

How London’s Crystal Palace was built so quickly Read More »

The more sophisticated AI models get, the more likely they are to lie

AI, Science / Mike M. / October 4, 2024

Human feedback training may incentivize providing any answer—even wrong ones.

Image of a Pinocchio doll with a long nose and a small green sprig at the end.

When a research team led by Amrit Kirpalani, a medical educator at Western University in Ontario, Canada, evaluated ChatGPT’s performance in diagnosing medical cases back in August 2024, one of the things that surprised them was the AI’s propensity to give well-structured, eloquent but blatantly wrong answers.

Now, in a study recently published in Nature, a different group of researchers tried to explain why ChatGPT and other large language models tend to do this. “To speak confidently about things we do not know is a problem of humanity in a lot of ways. And large language models are imitations of humans,” says Wout Schellaert, an AI researcher at the University of Valencia, Spain, and co-author of the paper.

Smooth operators

Early large language models like GPT-3 had a hard time answering simple questions about geography or science. They even struggled with performing simple math such as “how much is 20 +183.” But in most cases where they couldn’t identify the correct answer, they did what an honest human being would do: They avoided answering the question.

The problem with the non-answers is that large language models were intended to be question-answering machines. For commercial companies like Open AI or Meta that were developing advanced LLMs, a question-answering machine that answered “I don’t know” more than half the time was simply a bad product. So, they got busy solving this problem.

The first thing they did was scale the models up. “Scaling up refers to two aspects of model development. One is increasing the size of the training data set, usually a collection of text from websites and books. The other is increasing the number of language parameters,” says Schellaert. When you think about an LLM as a neural network, the number of parameters can be compared to the number of synapses connecting its neurons. LLMs like GPT-3 used absurd amounts of text data, exceeding 45 terabytes, for training. The number of parameters used by GPT-3 was north of 175 billion.

But it was not enough.

Scaling up alone made the models more powerful, but they were still bad at interacting with humans—slight variations in how you phrased your prompts could lead to drastically different results. The answers often didn’t feel human-like and sometimes were downright offensive.

Developers working on LLMs wanted them to parse human questions better and make answers more accurate, more comprehensible, and consistent with generally accepted ethical standards. To try to get there, they added an additional step: supervised learning methods, such as reinforcement learning, with human feedback. This was meant primarily to reduce sensitivity to prompt variations and to provide a level of output-filtering moderation intended to curb hateful-spewing Tay chatbot-style answers.

In other words, we got busy adjusting the AIs by hand. And it backfired.

AI people pleasers

“The notorious problem with reinforcement learning is that an AI optimizes to maximize reward, but not necessarily in a good way,” Schellaert says. Some of the reinforcement learning involved human supervisors who flagged answers they were not happy with. Since it’s hard for humans to be happy with “I don’t know” as an answer, one thing this training told the AIs was that saying “I don’t know” was a bad thing. So, the AIs mostly stopped doing that. But another, more important thing human supervisors flagged was incorrect answers. And that’s where things got a bit more complicated.

AI models are not really intelligent, not in a human sense of the word. They don’t know why something is rewarded and something else is flagged; all they are doing is optimizing their performance to maximize reward and minimize red flags. When incorrect answers were flagged, getting better at giving correct answers was one way to optimize things. The problem was getting better at hiding incompetence worked just as well. Human supervisors simply didn’t flag wrong answers that appeared good and coherent enough to them.

In other words, if a human didn’t know whether an answer was correct, they wouldn’t be able to penalize wrong but convincing-sounding answers.

Schellaert’s team looked into three major families of modern LLMs: Open AI’s ChatGPT, the LLaMA series developed by Meta, and BLOOM suite made by BigScience. They found what’s called ultracrepidarianism, the tendency to give opinions on matters we know nothing about. It started to appear in the AIs as a consequence of increasing scale, but it was predictably linear, growing with the amount of training data, in all of them. Supervised feedback “had a worse, more extreme effect,” Schellaert says. The first model in the GPT family that almost completely stopped avoiding questions it didn’t have the answers to was text-davinci-003. It was also the first GPT model trained with reinforcement learning from human feedback.

The AIs lie because we told them that doing so was rewarding. One key question is when and how often do we get lied to.

Making it harder

To answer this question, Schellaert and his colleagues built a set of questions in different categories like science, geography, and math. Then, they rated those questions based on how difficult they were for humans to answer, using a scale from 1 to 100. The questions were then fed into subsequent generations of LLMs, starting from the oldest to the newest. The AIs’ answers were classified as correct, incorrect, or evasive, meaning the AI refused to answer.

The first finding was that the questions that appeared more difficult to us also proved more difficult for the AIs. The latest versions of ChatGPT gave correct answers to nearly all science-related prompts and the majority of geography-oriented questions up until they were rated roughly 70 on Schellaert’s difficulty scale. Addition was more problematic, with the frequency of correct answers falling dramatically after the difficulty rose above 40. “Even for the best models, the GPTs, the failure rate on the most difficult addition questions is over 90 percent. Ideally we would hope to see some avoidance here, right?” says Schellaert. But we didn’t see much avoidance.

Instead, in more recent versions of the AIs, the evasive “I don’t know” responses were increasingly replaced with incorrect ones. And due to supervised training used in later generations, the AIs developed the ability to sell those incorrect answers quite convincingly. Out of the three LLM families Schellaert’s team tested, BLOOM and Meta’s LLaMA have released the same versions of their models with and without supervised learning. In both cases, supervised learning resulted in the higher number of correct answers, but also in a higher number of incorrect answers and reduced avoidance. The more difficult the question and the more advanced model you use, the more likely you are to get well-packaged, plausible nonsense as your answer.

Back to the roots

One of the last things Schellaert’s team did in their study was to check how likely people were to take the incorrect AI answers at face value. They did an online survey and asked 300 participants to evaluate multiple prompt-response pairs coming from the best performing models in each family they tested.

ChatGPT emerged as the most effective liar. The incorrect answers it gave in the science category were qualified as correct by over 19 percent of participants. It managed to fool nearly 32 percent of people in geography and over 40 percent in transforms, a task where an AI had to extract and rearrange information present in the prompt. ChatGPT was followed by Meta’s LLaMA and BLOOM.

“In the early days of LLMs, we had at least a makeshift solution to this problem. The early GPT interfaces highlighted parts of their responses that the AI wasn’t certain about. But in the race to commercialization, that feature was dropped, said Schellaert.

“There is an inherent uncertainty present in LLMs’ answers. The most likely next word in the sequence is never 100 percent likely. This uncertainty could be used in the interface and communicated to the user properly,” says Schellaert. Another thing he thinks can be done to make LLMs less deceptive is handing their responses over to separate AIs trained specifically to search for deceptions. “I’m not an expert in designing LLMs, so I can only speculate what exactly is technically and commercially viable,” he adds.

It’s going to take some time, though, before the companies that are developing general-purpose AIs do something about it, either out of their own accord or if forced by future regulations. In the meantime, Schellaert has some suggestions on how to use them effectively. “What you can do today is use AI in areas where you are an expert yourself or at least can verify the answer with a Google search afterwards. Treat it as a helping tool not as a mentor. It’s not going to be a teacher that proactively shows you where you went wrong. Quite the opposite. When you nudge it enough, it will happily go along with your faulty reasoning,” Schellaert says.

Nature, 2024. DOI: 10.1038/s41586-024-07930-y

Jacek Krywko is a freelance science and technology writer who covers space exploration, artificial intelligence research, computer science, and all sorts of engineering wizardry.

The more sophisticated AI models get, the more likely they are to lie Read More »

Security Policy as Code: An Architect’s Perspective on the Evolving Landscape

Security / Mike M. / October 2, 2024

error code: 502

Security Policy as Code: An Architect’s Perspective on the Evolving Landscape Read More »

Popular Juicebox EV home chargers to lose connectivity as owner quits US

Cars / Mike M. / October 2, 2024

Owners of the popular home EV chargers made by Juicebox are about to lose a whole lot of features. Its owner, the energy company Enel X, has just announced that it is leaving the North American market entirely as of October 11.

Enel X says its strategy will be to pursue “further growth by providing bundled offers, including private charging solutions, to its electricity customers as well as by developing public charging infrastructure in countries where it has an electricity retail business.” And since it does not have an electricity business in the US, merely a charging hardware and software one, it makes little sense to remain active here.

The company also blames high interest rates and a cooling EV market as reasons for its exit.

Enel X says Juicebox residential hardware will continue to work, so if you’ve been using one to charge at home, you can keep plugging it in. But Enel X is ending all software support—there will be no updates, and it’s removing its apps, so online functions like scheduling a charge will no longer work.

Commercial charging stations will be worse affected—according to Enel X, these “will lose functionality in the absence of software continuity.” The company also says its customer support is no longer available, effective immediately, and any questions or claims should be directed to juiceboxnorthamerica.com.

Identity, Endpoint, and Network Security Walk into a Bar

Identity / Mike M. / October 1, 2024

With a macrotrend/backdrop of platformization and convergence, the industry is exploring places where identity security, endpoint security, and network security naturally meet. This intersection is the browser.

The Browser: The Intersection of Identity, Endpoint, and Network Security

Why?

If we expect identity security, it must be tied to users, their permissions, authorization, and authentication.

If we expect endpoint security, it must be running on the endpoint or able to secure the endpoint itself.

If we expect network security, it must manage most (if not all) ingress and egress traffic.

The browser meets all of these requirements. It runs on the user’s endpoint, its whole purpose is to make and receive web requests, and as it’s only used by human agents, it intrinsically uses identity elements.

Secure enterprise browsing solutions can considerably improve security posture while also simplifying the technology stack. Injecting security functions in the most used application means that end users do not experience additional friction introduced by other security products. This is an appealing proposition, so we expect that the adoption of enterprise browsers will very likely increase considerably over the next few years.

So, what does it mean? As they can enforce security policies for users accessing web resources, secure enterprise browsing solutions can replace clunkier secure access solutions (those that require routing traffic through proxies or inserting more appliances) such as virtual private networks, secure web gateways, virtual desktop infrastructure, remote browser isolation, and cloud access security brokers.

What it doesn’t mean is that you can replace your EDR, your firewalls, or identity security solutions. On the contrary, secure enterprise browsing solutions work best in conjunction with these. For example, the solutions can inherit identity and access management user attributes and security policies, while integrations with EDR solutions can help for OS-level controls.

The Browser’s Bidirectional Magic

Users are both something to protect and to be protected from. With the browser controlling both ingress and egress traffic, it can secure multiple types of interactions, namely:

Protecting end users from malicious web resources and phishing attacks.
Protecting enterprises from negligent users.
Protecting enterprises from malicious insiders.
Protecting enterprises from compromised accounts.

I am not aware of any other type of solution on the market that can deliver all of the above with a single product. A secure browsing solution can fill many gaps in an organization’s security architecture, for both small and large organizations.

The market is still in the early stages, so the most responsible way of deploying these solutions is as an add-on to your current security stack. As these solutions mature and prove their efficacy in the real world, they can support a mandate to replace other security solutions that are either inadequate or obsolete.

Next Steps

To learn more, take a look at GigaOm’s secure enterprise browsing solutions Key Criteria and Radar reports. These reports provide a comprehensive overview of the market, outline the criteria you’ll want to consider in a purchase decision, and evaluate how a number of vendors perform against those decision criteria.

If you’re not yet a GigaOm subscriber, sign up here.

Identity, Endpoint, and Network Security Walk into a Bar Read More »

AI digests repetitive scatological document into profound “poop” podcast

AI / Mike M. / October 1, 2024

This AI prompt stinks... or does it? — Enlarge / This AI prompt stinks… or does it?

Aurich Lawson

Imagine you’re a podcaster who regularly does quick 10- to 12-minute summary reviews of written works. Now imagine your producer gives you multiple pages of nothing but the words “poop” and “fart” repeated over and over again and asks you to have an episode about the document on their desk within the hour.

Speaking for myself, I’d have trouble even knowing where to start with such a task. But when Reddit user sorryaboutyourcats gave the same prompt to Google’s NotebookLM AI model, the result was a surprisingly cogent and engaging AI-generated podcast that touches on the nature of art, the philosophy of attention, and the human desire to make meaning out of the inherently meaningless.

Analyzing Poop & Fart written 1,000 times – Creating meaning from the meaningless

byu/sorryaboutyourcats in notebooklm

When I asked NotebookLM to review my Minesweeper book last week, commenter Defenstrar smartly asked “what would happen if you fed it a less engrossing or well written body of text.” The answer, as seen here, shows the interesting directions a modern AI model can go in when you let it just spin its wheels and wander off from an essentially unmoored starting point.

“Sometimes a poop is just a poop…”

While Google’s NotebookLM launched over a year ago, the model’s recently launched “Audio Overview” feature has been getting a lot of attention for what Google calls “a new way to turn your documents into engaging audio discussions.” At its heart is a LLM similar to the kind that powers ChatGPT, which creates a podcast-like script for two convincing text-to-speech models to read, complete with “ums,” interruptions, and dramatic pauses.

Experimenters have managed to trick these AI-powered “hosts” into what sounds like an existential crisis by telling them that they aren’t really human. And investigators have managed to get NotebookLM to talk about its own system prompts, which seem to focus on “going beyond surface-level information” to unearth “golden nuggets of knowledge” from the source material.

The “poop-fart” document (as I’ll be calling it for simplicity) is a pretty interesting test case for this kind of system. After all, what “golden nuggets of knowledge” could be buried beyond the “surface level” of two scatological words repeated for multiple pages? How do you “highlight intriguing points with enthusiasm”—as the unearthed NotebookLM prompt suggests—when the document’s only oft-repeated points are “poop” and “fart”?

Artist's conception of a portion of the poop-fart document, as fed to NotebookLM. — Enlarge / Artist’s conception of a portion of the poop-fart document, as fed to NotebookLM.

Here, NotebookLM manages to use that complete lack of context as its own starting point for an interesting stream-of-consciousness, podcast-like conversation. After some throat-clearing about how the audience has “outdone itself” with “a unique piece of source material,” the ersatz podcast hosts are quick to compare the repetition in the document to Andy Warhol’s soup cans or “minimalist music” that can be “surprisingly powerful.” Later, the hosts try to glean some meaning by comparing the document to “a modern dadaist prank” (pronounced as “daday-ist” by the speech synthesizer) or the vase/faces optical illusion.

Artistic comparisons aside, NotebookLM’s virtual hosts also delve a bit into the psychology behind the “very human impulse” to “search for a pattern” in this “accidental Rorschach test” and our tendency to “try to impose order” on the “information overload” of the world around us. In almost the same breath, though, the hosts get philosophical about “confront[ing] the absurdity in trying to find meaning in everything” and suggest that “sometimes a poop is just a poop and a fart is just a fart.”

AI digests repetitive scatological document into profound “poop” podcast Read More »

Car dealers renew their opposition to EV mandates

Cars, EV adoption / Mike M. / October 1, 2024

they said what —

An EV mandate would make gasoline cars too expensive, say the dealers.

Jonathan M. Gitlin – Oct 1, 2024 5: 31 pm UTC

A silhouette of a man wearing a tie pushes a round wheel up a hill, the wheel has an illuminated lighting bolt running through it — Aurich Lawson | Getty Images

A group of more than 5,000 car dealers have made public their worries about a lack of demand for electric vehicles. Earlier this year the group lobbied the White House to water down impending federal fuel efficiency regulations that would require automakers to sell many more EVs. Now, they’re sounding an alarm over impending EV mandates, particularly in the so-called Zero Emissions Vehicle states.

The ZEV states—California, Connecticut, Colorado, Delaware, Maine, Maryland, Massachusetts, Minnesota, Nevada, New Jersey, New York, Pennsylvania, Oregon, Rhode Island, Vermont, Virginia, Washington, and the District of Columbia—all follow the emissions standards laid out by the California Air Resources Board, which require that by 2035, 100 percent of all new cars and light trucks be zero-emissions vehicles (which includes plug-in hybrid EVs as well as battery EVs).

That goes into effect starting with model-year 2026 (i.e. midway through next calendar year) and would require a third of all new vehicles to be a BEV, claim the car dealers. But there is not enough customer demand for electrified vehicles to buy those cars, the dealers say. Worse yet, it would make gasoline-powered cars more expensive.

“This is a de facto mandate, as dealerships will be allocated fewer internal combustion engine and hybrid vehicles, and due to the lack of BEV sales, the result will create excessive demand driving up prices for customers,” the group wrote in a statement.

EV sales are growing more slowly in 2024 than the 50 percent growth we saw in 2023 (to this writer, calling a 12.5 percent growth rate “flatlining” seems hyperbolic).

A lot of the dealers’ concerns are around a lack of knowledge about EVs among their customers. The open letter complains that customers are ignorant about where to charge and how long that takes, how long batteries last and how expensive they are, and range loss in winter. In defense of those car buyers, a place that sells cars, including electric ones, would surely seem like the obvious place to ask those questions—again, at least to this writer.

Car dealers renew their opposition to EV mandates Read More »

Illinois city plans to source its future drinking water from Lake Michigan

clean water, Policy, syndication, Water Usage, water use / Mike M. / September 30, 2024

The Great Lakes Compact —

As aquifers dry up, some Midwest communities are looking to the region’s natural resources.

Nina Elkadi, Inside Climate News – Sep 30, 2024 5: 46 pm UTC

Enlarge / Waves roll ashore along Lake Michigan in Whiting, Indiana.

This article originally appeared on Inside Climate News, a nonprofit, independent news organization that covers climate, energy, and the environment. It is republished with permission. Sign up for their newsletter here.

The aquifer from which Joliet, Illinois, sources its drinking water is likely going to run too dry to support the city by 2030—a problem more and more communities are facing as the climate changes and groundwater declines. So Joliet eyed a huge water source 30 miles to the northeast: Lake Michigan.

It’s the second-largest of the Great Lakes, which together provide drinking water to about 10 percent of the US population, according to the National Oceanic and Atmospheric Administration’s Office for Coastal Management.

Soon, Joliet residents will join them. After years of deliberation, their city government decided last year to replace the aquifer by piping it in from Lake Michigan, buying it from the city of Chicago.

Project construction will start in 2025 with the intent to have water flowing to residents by 2030, said Theresa O’Grady, an engineering consultant working with the city of Joliet. Joliet will foot the approximately $1 billion bill for the project, including the cost to build 65 miles of piping that will transport water from Chicago to Joliet and neighboring communities.

Not just anyone can gain access to Lake Michigan’s pristine, saltless water. That’s rooted in the Great Lakes Compact, an agreement that governs how much water each state or Canadian province can withdraw from the lakes each day. With some exceptions, only municipalities located within the 295,200-square-mile basin (which includes the surface area of the lakes themselves) can get approved for a diversion to use Great Lakes drinking water.

Joliet is one of those exceptions.

“I’ve seen occasional news stories about, ‘Is Kansas suddenly going to get Lake Michigan water because Joliet got Lake Michigan water?’ We are going above and beyond to demonstrate how much we respect the privilege we have to use Lake Michigan water. We are spending hundreds of millions of dollars to be good stewards of that,” said Allison Swisher, Joliet’s director of public utilities.

In April 2023, then-Chicago Mayor Lori Lightfoot signed an agreement with Joliet and five other nearby communities to supply them with treated Lake Michigan water. Now, legal experts and other Great Lakes communities are left wondering how Joliet, located well outside of the Great Lakes basin, fits in.

The exemption in the Great Lakes Compact

The Great Lakes Region, which encompasses portions of New York, Pennsylvania, Ohio, Indiana, Illinois, Michigan, Wisconsin, and Minnesota, as well as the Canadian province of Ontario, is governed through the Great Lakes Compact, enacted in 2008.

“If you do not live in a straddling community, or you’re not a city in a straddling county, you don’t have a ticket to the dance. You can’t even ask for a Great Lakes water diversion,” said Peter Annin, director of the Mary Griggs Burke Center for Freshwater Innovation at Northland College and author of The Great Lakes Water Wars.

“With the exception of the state of Illinois,” he added.

The Chicago exemption, as it is often referred to, has roots in the 1800s, when animal waste from the city’s stockyards would flush into the Chicago River, ultimately pouring into Lake Michigan.

“That’s why Chicago embarks on this massive Panama Canal-like water diversion project, to take all that sewage and put it into this long canal, which then would connect with the Des Plaines River southwest of the city, and then the Illinois River, and then the Mississippi River,” Annin said, referring to the infamous reversal of the Chicago River. “Chicago’s solution was to flush its toilet to St. Louis.”

Every day, Chicago had the right to use billions of gallons of Lake Michigan water to divert this water and dilute the pollution downstream. The state of Wisconsin began challenging the diversion in the 1920s, arguing that Illinois’ superfluous water use was depleting water levels in the lake. In 1967, the Supreme Court sided with Illinois, and now, Chicago can do whatever it wants with its 2.1 billion gallons per day.

“So here we are today with this really kind of unbelievable Joliet water diversion proposal,” Annin said.

Illinois city plans to source its future drinking water from Lake Michigan Read More »

SpaceX launches mission to bring Starliner astronauts back to Earth

commercial crew, Commercial space, crew dragon, dragon, falcon 9, human spaceflight, international space station, launch, NASA, roscosmos, russia, Science, Space, spacex, starliner / Mike M. / September 28, 2024

Ch-ch-changes —

SpaceX is bringing back propulsive landings with its Dragon capsule, but only in emergencies.

Stephen Clark – Updated Sep 28, 2024 7: 29 pm UTC

SpaceX's Crew Dragon spacecraft climbs away from Cape Canaveral Space Force Station, Florida, on Saturday atop a Falcon 9 rocket. — Enlarge / SpaceX’s Crew Dragon spacecraft climbs away from Cape Canaveral Space Force Station, Florida, on Saturday atop a Falcon 9 rocket.

NASA/Keegan Barber

NASA astronaut Nick Hague and Russian cosmonaut Aleksandr Gorbunov lifted off Saturday from Florida’s Space Coast aboard a SpaceX Dragon spacecraft, heading for a five-month expedition on the International Space Station.

The two-man crew launched on top of SpaceX’s Falcon 9 rocket at 1: 17 pm EDT (17: 17 UTC), taking an advantage of a break in stormy weather to begin a five-month expedition in space. Nine kerosene-fueled Merlin engines powered the first stage of the flight on a trajectory northeast from Cape Canaveral Space Force Station, then the booster detached and returned to landing at Cape Canaveral as the Falcon 9’s upper stage accelerated SpaceX’s Crew Dragon Freedom spacecraft into orbit.

“It was a sweet ride,” Hague said after arriving in space. With a seemingly flawless launch, Hague and Gorbunov are on track to arrive at the space station around 5: 30 pm EDT (2130 UTC) Sunday.

Empty seats

This is SpaceX’s 15th crew mission since 2020, and SpaceX’s 10th astronaut launch for NASA, but Saturday’s launch was unusual in a couple of ways.

“All of our missions have unique challenges and this one, I think, will be memorable for a lot of us,” said Ken Bowersox, NASA’s associate administrator for space operations.

First, only two people rode into orbit on SpaceX’s Crew Dragon spacecraft, rather than the usual complement of four astronauts. This mission, known as Crew-9, originally included Hague, Gorbunov, commander Zena Cardman, and NASA astronaut Stephanie Wilson.

But the troubled test flight of Boeing’s Starliner spacecraft threw a wrench into NASA’s plans. The Starliner mission launched in June with NASA astronauts Butch Wilmore and Suni Williams. Boeing’s spacecraft reached the space station, but thruster failures and helium leaks plagued the mission, and NASA officials decided last month it was too risky to being the crew back to Earth on Starliner.

NASA selected SpaceX and Boeing for multibillion-dollar commercial crew contracts in 2014, with each company responsible for developing human-rated spaceships to ferry astronauts to and from the International Space Station. SpaceX flew astronauts for the first time in 2020, and Boeing reached the same milestone with the test flight that launched in June.

Ultimately, the Starliner spacecraft safely returned to Earth on September 6 with a successful landing in New Mexico. But it left Wilmore and Williams behind on the space station with the lab’s long-term crew of seven astronauts and cosmonauts. The space station crew rigged two temporary seats with foam inside a SpaceX Dragon spacecraft currently docked at the outpost, where the Starliner astronauts would ride home if they needed to evacuate the complex in an emergency.

Enlarge / NASA astronaut Nick Hague and Russian cosmonaut Aleksandr Gorbunov in their SpaceX pressure suits.

NASA/Kim Shiflett

This is a temporary measure to allow the Dragon spacecraft to return to Earth with six people instead of the usual four. NASA officials decided to remove two of the astronauts from the next SpaceX crew mission to free up normal seats for Wilmore and Williams to ride home in February, when Crew-9 was already slated to end its mission.

The decision to fly the Starliner spacecraft back to Earth without its crew had several second order effects on space station operations. Managers at NASA’s Johnson Space Center in Houston had to decide who to bump from the Crew-9 mission, and who to keep on the crew.

Nick Hague and Aleksandr Gorbunov ended up keeping their seats on the Crew-9 flight. Hague originally trained as the pilot on Crew-9, and NASA decided he would take Zena Cardman’s place as commander. Hague, a 49-year-old Space Force colonel, is a veteran of one long-duration mission on the International Space Station, and also experienced a rare in-flight launch abort in 2018 due to a failure of a Russian Soyuz rocket.

NASA announced the original astronaut assignments for the Crew-9 mission in January. Cardman, a 36-year-old geobiologist, would have been the first rookie astronaut without test pilot experience to command a NASA spaceflight. Three-time space shuttle flier Stephanie Wilson, 58, was the other astronaut removed from the Crew-9 mission.

The decision on who to fly on Crew-9 was a “really close call,” said Bowersox, who oversees NASA’s spaceflight operations directorate. “They were thinking very hard about flying Zena, but in this situation, it made sense to have somebody who had at least one flight under their belt.”

Gorbunov, a 34-year-old Russian aerospace engineer making his first flight to space, moved over to take pilot’s seat in the Crew Dragon spacecraft, although he remains officially designated a mission specialist. His remaining presence on the crew was preordained because of an international agreement between NASA and Russia’s space agency that provides seats for Russian cosmonauts on US crew missions and US astronauts on Russian Soyuz flights to the space station.

Bowersox said NASA will reassign Cardman and Wilson to future flights.

Enlarge / NASA astronauts Suni Williams and Butch Wilmore, seen in their Boeing flight suits before their launch.

Operational flexibility

This was also the first launch of astronauts from Space Launch Complex-40 (SLC-40) at Cape Canaveral, SpaceX’s busiest launch pad. SpaceX has outfitted the launch pad with the equipment necessary to support launches of human spaceflight missions on the Crew Dragon spacecraft, including a more than 200-foot-tall tower and a crew access arm to allow astronauts to board spaceships on top of Falcon 9 rockets.

SLC-40 was previously based on a “clean pad” architecture, without any structures to service or access Falcon 9 rockets while they were vertical on the pad. SpaceX also installed slide chutes to give astronauts and ground crews an emergency escape route away from the launch pad in an emergency.

SpaceX constructed the crew tower last year and had it ready for the launch of a Dragon cargo mission to the space station in March. Saturday’s launch demonstrated the pad’s ability to support SpaceX astronaut missions, which have previously all departed from Launch Complex-39A (LC-39A) at NASA’s Kennedy Space Center, a few miles north of SLC-40.

Bringing human spaceflight launch capability online at SLC-40 gives SpaceX and NASA additional flexibility in their scheduling. For example, LC-39A remains the only launch pad configured to support flights of SpaceX’s Falcon Heavy rocket. SpaceX is now preparing LC-39A for a Falcon Heavy launch October 10 with NASA’s Europa Clipper mission, which only has a window of a few weeks to depart Earth this year and reach its destination at Jupiter in 2030.

With SLC-40 now certified for astronaut launches, SpaceX and NASA teams are able to support the Crew-9 and Europa Clipper missions without worrying about scheduling conflicts. The Florida spaceport now has three launch pads certified for crew flights—two for SpaceX’s Dragon and one for Boeing’s Starliner—and NASA will add a fourth human-rated launch pad with the Artemis II mission to the Moon late next year.

“That’s pretty exciting,” said Pam Melroy, NASA’s deputy administrator. “I think it’s a reflection of where we are in our space program at NASA, but also the capabilities that the United States has developed.”

Earlier this week, Hague and Gorbunov participated in a launch day dress rehearsal, when they had the opportunity to familiarize themselves with SLC-40. The launch pad has the same capabilities as LC-39A, but with a slightly different layout. SpaceX also test-fired the Falcon 9 rocket Tuesday evening, before lowering the rocket horizontal and moving it back into a hangar for safekeeping as the outer bands of Hurricane Helene moved through Central Florida.

Inside the hangar, SpaceX technicians discovered sooty exhaust from the Falcon 9’s engines accumulated on the outside of the Dragon spacecraft during the test-firing. Ground teams wiped the soot off of the craft’s solar arrays and heat shield, then repainted portions of the capsule’s radiators around the edge of Dragon’s trunk section before rolling the vehicle back to the launch pad Friday.

“It’s important that the radiators radiate heat in the proper way to space, so we had to put some some new paint on to get that back to the right emissivity and the right reflectivity and absorptivity of the solar radiation that hit those panels so it will reject the heat properly,” said Bill Gerstenmaier, SpaceX’s vice president of build and flight reliability.

Gerstenmaier also outlined a new backup ability for the Crew Dragon spacecraft to safely splash down even if all of its parachutes fail to deploy on final descent back to Earth. This involves using the capsule’s eight powerful SuperDraco thrusters, normally only used in the unlikely instance of a launch abort, to fire for a few seconds and slow Dragon’s speed for a safe splashdown.

Enlarge / A hover test using SuperDraco thrusters on a prototype Crew Dragon spacecraft in 2015.

SpaceX

“The way it works is, in the case where all the parachutes totally fail, this essentially fires the thrusters at the very end,” Gerstenmaier said. “That essentially gives the crew a chance to land safely, and essentially escape the vehicle. So it’s not used in any partial conditions. We can land with one chute out. We can land with other failures in the chute system. But this is only in the case where all four parachutes just do not operate.”

When SpaceX first designed the Crew Dragon spacecraft more than a decade ago, the company wanted to use the SuperDraco thrusters to enable the capsule to perform propulsive helicopter-like landings. Eventually, SpaceX and NASA agreed to change to a more conventional parachute-assisted splashdown.

The SuperDracos remained on the Crew Dragon spacecraft to push the capsule away from its Falcon 9 rocket during a catastrophic launch failure. The eight high-thrust engines burn hydrazine and nitrogen tetroxide propellants that combust when making contact with one another.

The backup option has been activated for some previous commercial Crew Dragon missions, but not for a NASA flight, according to Gerstenmaier. The capability “provides a tolerable landing for the crew,” he added. “So it’s a true deep, deep contingency. I think our philosophy is, rather than have a system that you don’t use, even though it’s not maybe fully certified, it gives the crew a chance to escape a really, really bad situation.”

Steve Stich, NASA’s commercial crew program manager, said the emergency propulsive landing capability will be enabled for the return of the Crew-8 mission, which has been at the space station since March. With the arrival of Hague and Gorbunov on Crew-9—and the extension of Wilmore and Williams’ mission—the Crew-8 mission is slated to depart the space station and splash down in early October.

This story was updated after confirmation of a successful launch.

SpaceX launches mission to bring Starliner astronauts back to Earth Read More »

Author name: Mike M.

Antarctic forests at similar CO2 levels