Europol, the law enforcement agency of the European Union (EU), has been ordered to delete its massive database of information on EU citizens that it collected in recent years if the agency did not link subjects to any ongoing criminal activity. From a report: The decision was announced today by the European Data Protection Supervisor, an EU-independent supervisory authority whose primary objective is to monitor and ensure that European institutions and bodies respect the right to privacy and data protection. The EDPS said that Europol has one year to comply with its decision, during which time the law enforcement agency must filter its database and delete any information on EU citizens that are not part of criminal investigations. Europol will be allowed to process personal information as part of investigations, but the data on those not linked to crimes must be erased after six months. "This means that Europol will no longer be permitted to retain data about people who have not been linked to a crime or a criminal activity for long periods with no set deadline," the EDPS said in a press release on Monday.

Researchers at Carnegie Mellon University developed a mathematical model to understand why popular baby names keep on changing, and it "points to a tug-of-war between the need to stand out in the crowd and the need to fit in with the pack," reports Phys.Org. "The motives to conform and to be unique interact to produce complex dynamics when people observe each other in a social network." The research has been published in the journal Psychological Review. From the report: Mathematically speaking, the desire to fit in would drive behavior toward the mean, or average, in the group while the desire to stand out would drive behavior away from the mode, or most common occurrence, in the group. "Put them together and they still lead to equilibrium," [said Russell Golman, associate professor in the Social and Decision Sciences Department at CMU]. To break out of the equilibrium conundrum, Golman and his team added social networks to the mix. According to Golman, that means communities, neighbors, colleagues, clubs, or other social groups, not necessarily social media. "It was surprising that social networks could make such a big difference," said Golman. "We modeled the dynamics with a lot of different networks, and not converging to equilibrium is actually pretty typical."

To test their new model, CMU Ph.D. student Erin Bugbee turned to the large database of baby names managed by the Social Security Administration for the last century. If baby names settled into an equilibrium, the most popular name would always be the most popular. That is not what happened.

As the popularity of one name, say Emily, peaks, parents may decide to forgo that name and pick a similar one, like Emma. By following this strategy, they are instilling in their new daughter a name that is socially acceptable by its similarity to the popular name but will allow her to stand out in the crowd by putting a unique twist on her identity. Many parents may be thinking the same thing and the number of little girls named Emily will decline while those named Emma will increase. The study concludes that understanding social psychology and social network structure are both critical to explain the emergence of complex, unpredictable cultural trends.

An anonymous reader quotes a report from BleepingComputer: Accounts of more than three million users of the U.S.-based FlexBooker appointment scheduling service have been stolen in an attack before the holidays and are now being traded on hacker forums. The same intruders are offering databases claiming to be from two other entities: racing media organization Racing.com and Redbourne Group's rediCASE case management software, both from Australia. Among FlexBooker's customers are owners of any business that needs to schedule appointments, which is everything from accountants, barbers, doctors, mechanics, lawyers, dentists, gyms, salons, therapists, trainers, spas, and the list goes on.

Claiming the attack seems to be a group calling themselves Uawrongteam, who shared links to archives and files with sensitive information, such as photos, driver's licenses, and other IDs. According to Uawrongteam, the database contains a table with 10 million lines of customer information that ranges from payment forms and charges to driver's license photos. The actor notes that some "juicy columns" in the database are names, emails, phone numbers, password salt, and hashed passwords. FlexBooker has sent a data breach notification to customers, confirming the attack and that the intruders "accessed and downloaded" data on the service's Amazon cloud storage system. "On December 23, 2021, starting at 4:05 PM EST our account on Amazon's AWS servers was compromised," reads the notification, adding that the intruders did not access "any credit card or other payment card information."

"If you've visited a crypto company's website recently, you've probably visited a URL ending in .xyz instead of its cheugier counterpart, .com," writes Anita Ramaswamy via TechCrunch. "From fintech Block, formerly known as Square, to venture firm Paradigm, to blockchain startups like Mirror, .xyz has become the go-to URL ending for many web3 companies. But what does it mean, and why has it caught on in the web3 space?" An anonymous reader shares an excerpt from the report: .xyz, released to the public in 2014, first surged in popularity one year later when Google parent Alphabet decided to use it for their rebranded website. The internet behemoth had run into an increasingly widespread problem -- the .com URLs for their brand were already taken, with BMW's fleet management division using alphabet.com and American Broadcasting Corporation at abc.com. So Alphabet decided to open up shop at abc.xyz, which presented an "unlimited branding opportunity" for its "futuristic company," Daniel Negari, .xyz's 36-year-old founder and CEO, told TechCrunch in an email. Now, .xyz may be one of the top five top-level domains (TLDs) in the world by traffic, according to the company's own DNS data.

.xyz was created to "provide users around the world competition and choice when it comes to their domain name," and is "the first truly generic domain extension with no inherent meaning," according to Negari. While .com was meant for commercial use, .net for networks and .org for organizations, Negari envisioned .xyz as the TLD choice for users who felt they did not fit neatly into one of these categories or wanted to stand out. "I firmly believe the market has adopted our mantra of 'for every website everywhere,'" Negari said. "Our mantra of openness and inclusion for everyone and everything has bled through into a community of creative thinkers that has embraced .xyz as their domain." Negari is an active crypto investor with "numerous" investments in the space, including Gemini, MoonPay and BlockFi, he said. Because of his interest in crypto, he reached out to Ethereum Name Service (ENS) creator Nick Johnson to pitch him a collaboration. "That historic collaboration allowed early adopters to use a .xyz domain as their wallet address," Negari said.

ENS allows users to create a universal nickname for all their crypto addresses, providing a searchable database to make crypto wallets and transactions, which otherwise reside on a variety of different platforms, more easily accessible. Users can now create profiles to share their social media handles or other personal information in ENS using its native .eth domain or on a .xyz domain. .xyz has continued to find ways to collaborate with ENS and work with the crypto community. It announced this week that it launched its "eth.xyz" service, allowing users to search individual ENS profiles simply by adding ".xyz" to the end of their .eth name rather than having to go to the ENS database to look them up, Negari said. By allowing cryptocurrency holders to buy domains in their preferred names using Ethereum, ENS has creatively monetized users' desire to leverage the internet as an identity-building tool. Although .xyz domains are managed by ICANN, "several parties are now working to develop a decentralized alternative to this system to underpin web3," the report adds. ".xyz's strategy to align itself proactively with web3 companies could present a host of new monetization opportunities based on identity and ownership in a decentralized web as this generation of internet users stakes new claims on domains."

It's also worth noting that these .xyz domains "tend to be more affordable compared to their alternatives."

With some time on their hands, long-time Slashdot reader shanen began exploring the question: How many files does my Windows 10 computer have?

But then they realized "It would also be interesting to compare the weirdness on other OSes..." Here are the two data points in front of me:

(1) Using the right click on properties for all of the top-level folders on the drive (including the so-called hidden folders), it quickly determined that there are a few hundred thousand files in those folders (and a few hundred thousand subfolders). That's already ridiculous, but the expected par these days. The largest project I have on the machine only has about 3,000 files, and that one goes back many years... (My largest database only has about 5,000 records, but it's just a few files.)

(2) However, I also decided to take a look with Microsoft's malicious software removal tool and got a completely different answer. For twisted grins, I had invoked the full scan. It's still running a day later and has already passed 10 million files. Really? The progress bar indicates about 80% finished? WTF?

Obviously there is some kind of disagreement about the nature of "file" here. I could only think of one crazy explanation, but my router answered "No, the computer is not checking all of the files on the Internet." So I've already asked the specific question in three-letter form, but the broader question is about the explosive, perhaps even cancerous, "population growth" of files these days.
Maybe we can all solve this mystery together. So use the comments to share your own answers and insights.

How many files are on your computer?

Through public records requests, The Markup found more than 20 public agencies using the sometimes-controversial software. From the report: In 2020, the FDA's Center for Drug Evaluation and Research (CDER) faced a daunting task: It needed to fill more than 900 job vacancies -- and fast. The center, which does things like inspect pharmaceutical manufacturing facilities, was in the process of modernizing the FDA's New Drugs Regulatory Program just as the pandemic started. It faced "a surge in work," along with new constraints that have affected everyone during the pandemic, including travel limitations and lockdowns. So they decided to turn to an artificial intelligence tool to speed up the hiring, according to records obtained by The Markup. The center, along with the Office of Management and the Division of Management Services, the background section of a statement of work said, were developing a "recruitment plan to leverage artificial intelligence (AI) to assist in the time to hire process."

The agency ultimately chose to use HireVue, an online platform that allows employers to review asynchronously recorded video interviews and have recruits play video games as part of their application process. Over the years the platform has also offered a variety of AI features to automatically score candidates. HireVue, controversially, used to offer facial analysis to predict whether an applicant would be a good fit for an open job. In recent years, research has shown that facial recognition software is racially biased. In 2019, the company's continued use of the technique led one member of its scientific advisory board to resign. It has since stopped using facial recognition. The Markup used GovSpend, a database of procurement records for U.S. agencies at the state, local, and federal levels, to identify agencies that use HireVue. We also searched for agencies using Teramind and ActivTrak, both another kind of controversial software that allows employers to remotely monitor their workers' browsing activities through screenshots and logs. The Markup contacted and filed public records requests with those 24 agencies to understand how they were using the software. Eleven public agencies, including the FDA, replied to The Markup with documents or confirmations that they had bought HireVue at some point since 2017. Of the six public agencies that replied to The Markup's questions confirming that they actually used the software, all but one -- Lake Travis Independent School District in Texas -- confirmed they did not make use of the AI scoring features of the software. Documents and responses from 13 agencies confirmed that they purchased Teramind or ActivTrak at some point during the same time frame.

75% of the top 1,000 games run on Linux now, and the figure is even higher, at 80%, for the top 100 games. gHacks reports: Valve Software, the company behind the popular Steam gaming platform and smash hits such as Dota 2, Half-Life and Team Fortress, announced plans in 2018 to improve Windows game support for Linux. [...] The independent database protondb keeps track of compatibility using user reports. Compatibility has improved significantly in recent years. The site highlights compatibility for the top 10, top 100 and top 1000 games on Steam.

75% of the top 1000 games run on Linux now, and the figure is even higher, at 80%, for the top 100 games. Only the top 10 games are not well represented, as only 40% of them run on Linux without major issues according to the database. Users have submitted more than 150,000 reports for over 21,000 games to the site. Of these 21,000 games, more than 17,600 are working according to the site. Games on the database are ranked using a medal system. Platinum and Gold rated games run perfectly, and silver games may have minor issues. Bronze games may crash or have serious issues. Borked games won't work at all or are unplayable, and native Linux games are just the opposite of that.

Protondb has a search feature that Linux gamers may use to find out if games that they are interested in work well on Linux. All games that match the search term are returned, which means that you can search for entire series of games, e.g. King's Bounty, Final Fantasy or Civilization, and get all reported games and their compatibility rating returned. Compatibility is improving, and while there are still games that won't run on Linux, it is clear that compatibility has improved significantly in the past couple of years.

David Heinemeier Hansson is the creator of Ruby on Rails (as well as the co-founder and CTO of Basecamp, makers of the email software HEY). But he says Wednesday's release of version 7.0 is the version he's been longing for, "The one where all the cards are on the table. No more tricks up our sleeves. The culmination of years of progress on five different fronts at once." The backend gets some really nice upgrades, especially with the encryption work that we did for HEY, so your data can be encrypted while its live in the database.... But it's on the front end things have made a quantum leap. We've integrated the Hotwire frameworks of Stimulus and Turbo directly as the new defaults, together with that hot newness of import maps, which means you no longer need to run the whole JavaScript ecosystem enchilada in your Ruby app...

The part that really excites me about this version, though, is how much closer it brings us to the ideal of The One Person Framework. A toolkit so powerful that it allows a single individual to create modern applications upon which they might build a competitive business. The way it used to be... Rails 7 seeks to be the wormhole that folds the time-learning-shipping-continuum, and allows you to travel grand distances without knowing all the physics of interstellar travel. Giving the individual rebel a fighting chance against The Empire....

The key engine powering this assault is conceptual compression. Like a video codec that throws away irrelevant details such that you might download the film in real-time rather than buffer for an hour. I dedicated an entire RailsConf keynote to the idea...

[I]f there ever was an opening, ever was a chance that we might at least tilt the direction of the industry, now is it.

What a glorious time to be working in web development.

Controversial facial recognition company, Clearview AI, which has amassed a database of some 10 billion images by scraping selfies off the Internet so it can sell an identity-matching service to law enforcement, has been hit with another order to delete people's data. From a report: France's privacy watchdog said today that Clearview has breached Europe's General Data Protection Regulation (GDPR). In an announcement of the breach finding, the CNIL also gives Clearview formal notice to stop its "unlawful processing" and says it must delete user data within two months. The watchdog is acting on complaints against Clearview received since May 2020. The US company does not have an established base in the EU -- meaning its business is open to regulatory action across the EU, by any of the bloc's data protection supervisors. So while the CNIL's order only applies to data it holds on people from French territories -- which the CNIL estimates covers "several" tens of millions of Internet users -- more such orders are likely from other EU agencies.

"The Federal Aviation Administration said on Friday that it was ending a program that awarded small gold pins called 'Commercial Space Astronaut Wings' to certain people who flew to space on private spacecraft," reports the New York Times. (Alternate URL here.) But before the program officially retires in January, all who applied for the gold wings after flying to space this year will still receive them, the agency said.

That means Mr. Bezos, the billionaire founder of Amazon who rode a rocket with his space company, Blue Origin, to the edge of space in July, will be considered a commercial astronaut. So will Richard Branson, the founder of the space tourism firm Virgin Galactic who flew his own company's rocket plane to space in the same month. William Shatner, the Star Trek star who flew with Blue Origin to the edge of space in October, will also receive astronaut wings to go with his Starfleet paraphernalia. Twelve other people were also added to the federal agency's list of wing recipients on Friday [bringing the list up to 30 people].

The changes will help the F.A.A. avoid the potentially awkward position of proclaiming that some space tourists are only passengers, not astronauts.

The Commercial Space Astronaut Wings Program was created by Patti Grace Smith, the first chief of the F.A.A.'s commercial space office, to promote the private development of human spaceflight — a mandate from a 1984 law that aimed to accelerate innovation of space vehicles. The program began handing out pins to qualified individuals in 2004, when Mike Melvill, a test pilot who flew the Scaled Composites SpaceShipOne plane, became its first recipient. To qualify for the commercial astronaut wings under the original guidelines, a person had to reach an altitude of at least 50 miles, the marker of space recognized by NASA and the U.S. Air Force, and be a member of the spacecraft's "flight crew..."

Although no one will receive the little gold pins after 2021, those who fly above 50 miles on an F.A.A.-licensed rocket will be honored in the agency's online database.

But future space tourists should not despair a lack of post-flight flair. Virgin Galactic, Blue Origin and SpaceX have each presented paying and guest passengers with custom-designed wings.
Or, as the Associated Press put it, "The FAA said Friday it's clipping its astronaut wings because too many people are now launching into space and it's getting out of the astronaut designation business entirely...." "The U.S. commercial human spaceflight industry has come a long way from conducting test flights to launching paying customers into space," the FAA's associate administrator Wayne Monteith said in a statement. "Now it's time to offer recognition to a larger group of adventurers daring to go to space."
Thanks to long-time Slashdot reader schwit1 for submitting the story.

Over 40 million people in the United States had their personal health information exposed in data breaches this year, a significant jump from 2020 and a continuation of a trend toward more and more health data hacks and leaks. The Verge reports: Health organizations are required to report any health data breaches that impact 500 or more people to the Office for Civil Rights at the Department of Health and Human Services, which makes the breaches public. So far this year, the office has received reports of 578 breaches, according to its database. That's fewer than the 599 breaches reported in 2020 (PDF), but last year's breaches only affected about 26 million people. Since 2015, hacks or other IT incidents have been the leading reason people have their health records exposed, according to a report (PDF) from security company Bitglass. Before then, lost or stolen devices led to the most data breaches.

An anonymous reader quotes a report from Politico: Clearview AI has gotten the green light on a federal patent for its facial recognition technology -- an award that the company says is the first to cover a so-called "search engine for faces" that crawls the internet to find matches. Clearview's software -- which scrapes public images from social media to help law enforcement match images in government databases or surveillance footage -- has long faced fire from privacy advocates who say it uses people's faces without their knowledge or consent. Civil rights groups also argue that facial recognition technology is generally error-prone, misidentifying women and minorities at higher rates than it does white men and sometimes leading to false arrests. (A recent audit of Clearview's tech by the Commerce Department's National Institute of Standards and Technology found its results to be highly accurate (PDF), and the company said it knows of no instances to date where the technology has led to a wrongful arrest.) Now, some of those critics fear that codifying Clearview's work with a patent will accelerate the growth of these technologies before legislators or regulators have fully addressed the potential dangers.

The U.S. Patent and Trademark Office sent Clearview a "notice of allowance" on Wednesday, meaning the patent will be approved once the company pays certain administrative fees. The patent covers Clearview's "methods of providing information about a person based on facial recognition," including its "automated web crawler" that scans social networking sites and the internet and its algorithms that analyze and match facial images obtained online. "There are other facial recognition patents out there -- that are methods of doing it -- but this is the first one around the use of large-scale internet data," Clearview CEO and co-founder Hoan Ton-That told POLITICO in an exclusive interview. The product uses a database of more than 10 billion photos, Ton-That said, and he has emphasized that "as a person of mixed race, having non-biased technology is important to me." Clearview argues that there is a First Amendment right to make use of public material. "All information in our datasets are all publicly available info that people voluntarily posted online -- it's not anything on your private camera roll," Ton-That said. "If it was all private data, that would be a completely different story."

Ton-That said Clearview serves government users only and that "we don't intend to ever make a consumer version of Clearview AI." Yet Clearview says in its patent application that the invention could be useful for other purposes. The company argues that "it may be desirable for an individual to know more about a person that they meet, such as through business, dating, or other relationship." Common ways of learning about new people, like asking them questions or checking out their business cards, may be unreliable because the information they choose to share could be false, the application says. "The part that they're looking to protect is exactly the part that's the most problematic," said Matt Mahmoudi, an Amnesty International researcher who is leading the group's work to ban facial recognition. "They are patenting the very part of it that's in violation of international human rights law."

Mahmoudi of Amnesty International said that language in the patent leaves the door open to a cascade of new uses in the future. "It shows a willingness to go down a slippery slope of basically being available in any context," he said.

UnknowingFool writes: Two days before Missouri governor Michael Parson (R) accused a newspaper reporter, Josh Renaud, of "hacking" for reporting about a fixed flaw in a state website, the state government of Missouri was planning to publicly thank Renaud for alerting them of the flaw, emails show in a public records request. Two days later, however, the Governor publicly accused Renaud of crimes. Also in the request, emails show that a day before the article was published the state's cybersecurity specialist informed other state officials that "this incident is not an actual network intrusion." [Instead, the state's database was "misconfigured," which "allowed open source tools to be used to query data that should not be public."]

St Louis Dispatch reporter, Josh Renaud, had discovered that the state's website was exposing the Social Security Numbers of teachers and other school employees in the HTML code of the state's site. He informed the state who fixed the flaw, and he delayed publishing the article until after the flaw was fixed. The article was published on October 14. The same day, Governor Parson accused Renaud of cyber crimes. A week later, Parson doubled down after criticism.

Concerned about America's cybersecurity preparedness, the White House "is accelerating efforts to fill nearly 600,000 vacant cybersecurity positions in the public and private sectors bogging down efforts to protect digital infrastructure," reports Axios: Following a deluge of ransomware attacks targeting critical government and corporate infrastructure this year, clogs in the talent pipeline are leaving federal, cash-strapped local governments and Big Business even more susceptible to hacking. The issue has emerged repeatedly in Senate and House hearings but received little public attention until recently...

Microsoft...has pitched in by providing free cybersecurity curriculum to every public community college. A nonprofit, Public Infrastructure Security Cyber Education Systems, provides university students hands-on experience: monitoring real-time data on local government networks...

A job-tracking database funded by the Commerce Department shows there are nearly 600,000 U.S. cyber job openings nationwide.

The Department of Homeland Security recently launched a federal recruiting tool aimed at courting young, diverse talent. DHS currently has about 1,500 cybersecurity-related vacancies, affecting the agency's efforts to protect the homeland. A Senate audit found key agencies across the federal government continue to fail to meet basic cybersecurity standards, with eight of them earning a C- in the report.

Historically, local and federal government entities have struggled to compete with private sector companies, where bidding wars for talent are commonplace.

"HTTP Archive is a community-run project that has been tracking how the web is built since 2010," explains its web site. "Using WebPageTest and Lighthouse under the hood, metadata about nearly 8.2 million websites are tested monthly and included in a public BigQuery database for analysis."

And now 113 people "have volunteered countless hours in the planning, research, writing and production phases of the 2021 Web Almanac," processing 39.5 terabytes of data from 8.2 million web sites (using July's data set).

Berlin-based web developer Stefan Judis calls it "a comprehensive report on the state of the web, backed by real data and trusted web experts...comprised of 24 chapters spanning aspects of page content, user experience, publishing, and distribution." But he's also tweeting out what he sees as some of its most interesting statistics. — The median webpage loads 70kb CSS...and the "top scoring site loaded over 60mb of CSS...

- There's also a new high score for the number of loaded external stylesheets: 2368...!

- We all ship a lot of JavaScript. It's 420kb+ per page at the 50th percentile. This is transferred bytes, so the amount of JavaScript is way higher after decompressing...

- [From a graph of JavaScript library/framework adoption]: 84% use jQuery and 8% are built with React...

- There's almost no adoption of WebAssembly. ["We got 3854 confirmed WebAssembly requests on desktop and 3173 on mobile. Those Wasm modules are used across 2724 domains on desktop and 2300 domains on mobile, which represents 0.06% and 0.04% of all domains on desktop and mobile correspondingly."]

- 16% of sites don't ship a robots.txt...

- In 2021 641 million emails, 428 million passwords and 149 million phone numbers were involved in data breaches.
And apparently while just 7% of the top 1,000 sites use a content-management system, 42% of all sampled sites are using one. (And 33.6% of those appear to be using WordPress.)

The US government's China Initiative sought to protect national security. In the most comprehensive analysis of cases to date, MIT Technology Review reveals how far it has strayed from its goals. Technology Review: A visiting researcher at UCLA accused of hiding his connection to China's People's Liberation Army. A hacker indicted for breaking into video game company servers in his spare time. A Harvard professor accused of lying to investigators about funding from China. And a man sentenced for organizing a turtle-smuggling ring between New York and Hong Kong. For years, the US Department of Justice has used these cases to highlight the success of its China Initiative, an effort to counter rising concerns about Chinese economic espionage and threats to US national security. Started in 2018, the initiative was a centerpiece of the Trump administration's hardening stance against China. Now, an investigation by MIT Technology Review shows that the China Initiative has strayed far from its initial mission. Instead of focusing on economic espionage and national security, the initiative now appears to be an umbrella term for cases with almost any connection to China, whether they involve state-sponsored hackers, smugglers, or, increasingly, academics accused of failing to disclose all ties to China on grant-related forms.

To date, only about a quarter of defendants charged under the initiative have been convicted, and about half of those defendants with open charges have yet to see the inside of an American courtroom. Although the program has become a top priority of US law enforcement and domestic counterintelligence efforts -- and an unusual one, as the first country-specific initiative -- many details have remained murky. The DOJ has not publicly defined the initiative or answered many basic questions about it, making it difficult to understand, let alone assess or exercise oversight of it, according to many civil rights advocates, lawmakers, and scholars. While the threat of Chinese intellectual property theft is real, critics wonder if the China Initiative is the right way to counteract it. Today, after months of research and investigation, MIT Technology Review is publishing a searchable database of 77 cases and more than 150 defendants. While likely incomplete, the database represents the most comprehensive accounting of the China Initiative prosecutions to date. Our reporting and analysis showed that the climate of fear created by the prosecutions has already pushed some talented scientists to leave the United States and made it more difficult for others to enter or stay, endangering America's ability to attract new talent in science and technology from China and around the world.

In 2020 Microsoft's GitHub acquired NPM (makers of the default package manager for Node.js). The company's web page boasts that npm "is a critical part of the JavaScript community and helps support one of the largest developer ecosystems in the world."

But now BleepingComputer reports on two security flaws found (and remediated) in its software registry. Names of private npm packages on npmjs.com's 'replica' server (consumed by third-party services) were leaked — but in addition, a second flaw could've allowed attackers "to publish new versions of any existing npm package that they do not own or have rights to, due to improper authorization checks."

In a blog post this week GitHub's chief security officer explained the details: During maintenance on the database that powers the public npm replica at replicate.npmjs.com, records were created that could expose the names of private packages. This briefly allowed consumers of replicate.npmjs.com to potentially identify the names of private packages due to records published in the public changes feed. No other information, including the content of these private packages, was accessible at any time. Package names in the format of @owner/package for private packages created prior to October 20 were exposed between October 21 13:12:10Z UTC and October 29 15:51:00Z UTC. Upon discovery of the issue, we immediately began work on implementing a fix and determining the scope of the exposure. On October 29, all records containing private package names were removed from the replication database. While these records were removed from the replicate.npmjs.com service on this date, the data on this service is consumed by third-parties who may have replicated the data elsewhere. To prevent this issue from occuring again, we have made changes to how we provision this public replication database to ensure records containing private package names are not generated during this process.

Second, on November 2 we received a report to our security bug bounty program of a vulnerability that would allow an attacker to publish new versions of any npm package using an account without proper authorization. We quickly validated the report, began our incident response processes, and patched the vulnerability within six hours of receiving the report.

We determined that this vulnerability was due to inconsistent authorization checks and validation of data across several microservices that handle requests to the npm registry. In this architecture, the authorization service was properly validating user authorization to packages based on data passed in request URL paths. However, the service that performs underlying updates to the registry data determined which package to publish based on the contents of the uploaded package file. This discrepancy provided an avenue by which requests to publish new versions of a package would be authorized for one package but would actually be performed for a different, and potentially unauthorized, package. We mitigated this issue by ensuring consistency across both the publishing service and authorization service to ensure that the same package is being used for both authorization and publishing.

This vulnerability existed in the npm registry beyond the timeframe for which we have telemetry to determine whether it has ever been exploited maliciously. However, we can say with high confidence that this vulnerability has not been exploited maliciously during the timeframe for which we have available telemetry, which goes back to September 2020.
BleepingComputer adds: Both announcements come not too long after popular npm libraries, 'ua-parser-js,' 'coa,' and 'rc' were hijacked in a series of attacks aimed at infecting open source software consumers with trojans and crypto-miners. These attacks were attributed to the compromise of npm accounts [1, 2] belonging to the maintainers behind these libraries.

None of the maintainers of these popular libraries had two-factor authentication (2FA) enabled on their accounts, according to GitHub. Attackers who can manage to hijack npm accounts of maintainers can trivially publish new versions of these legitimate packages, after contaminating them with malware. As such, to minimize the possibility of such compromises from recurring in near future, GitHub will start requiring npm maintainers to enable 2FA, sometime in the first quarter of 2022.

An anonymous reader shares an excerpt from a Bloomberg report: In Togo, a nation of about 8 million people where the average income is below $2 a day, it took the government less than two weeks to design and launch an all-digital system for delivering monthly payments to about a quarter of the adult population. People [...] with no tax or payroll records, were identified as in need, enrolled in the program, and paid without any in-person contact. According to Anit Mukherjee, a policy fellow at the Center for Global Development, "the U.S. program looks like a dinosaur" in comparison.

[The program called Novissi], which means "solidarity" in the local Ewe language, is the brainchild of Cina Lawson, who heads the Ministry of Digital Economy and Digital Transformation. [...] Togo had run some cash transfer programs in the past, but they were small-scale and typically involved registering households one at a time and distributing physical money by hand. According to [Shegun Bakari, a close adviser to the president], other cabinet members objected to the idea of using mobile technology, arguing that many in rural areas didn't have access to phones or identification, and even those who did might lack the wherewithal to navigate a digital system. Yet in fact, Togolese -- like people across Africa -- had for years been using "mobile money," stored on and transferred from their mobile phones. The president quickly embraced the proposal. [....] Covid pushed countries to move quickly beyond age-old debates over who is deserving of government aid and whether transfers should be unconditional. The sheer breadth of suffering undercut the paternalistic attitude that the poor brought their suffering upon themselves.

Even with the president's support, Lawson's team faced big challenges. For starters they didn't know which Togolese were most in need: Tax rolls were no help in a country where four out of five working-age people toil in the informal economy. The last national census, conducted almost a decade earlier, hadn't gathered information about households' wealth or income. To ensure payments were made only to verified individuals, the team sought to build the platform off an existing database. Few Togolese possessed a driver's license or national ID card, but 3.6 million adults are registered to vote, according to the country's electoral commission, which requires potential voters to indicate their occupation and address. This electoral database was thought to represent somewhere between 83% and 98% of the adult population. Lawson and other members of the cabinet decided to focus the first round of support on anyone with an address in greater Lome who had listed an informal occupation, including shopkeepers, seamstresses, maids, hairdressers, and drivers. With the funding allocated by the government, they could provide each beneficiary one-third of the minimum wage, about $20 per month. Lawson insisted that the platform be able to offer an instantaneous payoff; otherwise, she warned, Togolese would doubt the promise of "free money" and fail to enroll. "You register, the platform determines you're eligible -- because once you enter your voter ID, the platform knows your profession and your geographic position -- and bam! You receive an SMS with the money," she says. The program wasn't without hiccups, however. When Novissi first began on April 8th, there were millions of registration attempts and tens of thousands of people calling for troubleshooting help, causing the platform to briefly buckle. But, as the report notes, it "largely worked," with more than 567,000 people receiving payments in the first round of disbursements.

"In part because Novissi proved so successful, the ministry teamed up with GiveDirectly and researchers at the University of California at Berkeley to fund a round of payments for the 200 poorest cantons," adds Bloomberg. "To find them, the researchers trained an algorithm to identify impoverished communities based on their urban layout and housing materials, using satellite images. The researchers couldn't pick individual beneficiaries by occupation because many rural residents didn't have differentiated professions; instead, they created a second algorithm that used data from mobile phones -- including the frequency and timing of calls, texts, and data use -- to identify the poorest users. Over the next few months, this round pushed funds out to 138,000 more beneficiaries."

"It has never been more difficult to be a software developer than it is today," says Nigel Simpson, a former director of enterprise technology strategy at Walt Disney.

And they're not the only one who thinks so, writes the U.K. Group editor of InfoWorld: "Complexity kills," Lotus Notes creator and Microsoft veteran Ray Ozzie famously wrote in a 2005 internal memo. "It sucks the life out of developers; it makes products difficult to plan, build, and test; it introduces security challenges; and it causes user and administrator frustration."

If Ozzie thought things were complicated back then, you can't help but wonder what he would make of the complexity software developers face in the cloud-native era. The shift from building applications in a monolithic architecture hosted on a server you could go and touch, to breaking them down into multiple microservices, packaged up into containers, orchestrated with Kubernetes, and hosted in a distributed cloud environment, marks a clear jump in the level of complexity of our software. Add to that expectations of feature-rich, consumer-grade experiences, which are secure and resilient by design, and never has more been asked of developers. "There is a clear increase in complexity when you move to such a pervasive microservices environment," said Amazon CTO Werner Vogels during the AWS Summit in 2019. "Was it easier in the days when everything was in a monolith? Yes, for some parts definitely."

Or, as his colleague, head of devops product marketing at AWS, Emily Freeman, said in 2021, modern software development is "a study in entropy, and it is not getting any more simple."

On the other hand, complex technologies have never been easier to consume off the shelf, often through a single API — from basic libraries and frameworks, to image recognition capabilities or even whole payments stacks. Simply assemble and build your business logic on top. But is it really that simple?
The article also cites a critical 2020 blog post by RedMonk analyst Stephen O'Grady. "The process of application development is simply too fragmented at this point," O'Grady wrote. "The days of every enterprise architecture being three-tier, every database being relational, and every business application being written in Java and deployed to an application server are over.

"The single most defining characteristic of today's infrastructure is that there is no single defining characteristic. It's diverse to a fault."

23andMe CEO Anne Wojcicki wants to make drugs using insights from millions of customer DNA samples, and doesn't think that should bother anyone. From a report: A few months ago, on the morning 23andMe Holding Co. was about to go public, Chief Executive Officer Anne Wojcicki received a framed sheet of paper she hadn't seen in 15 years. As she was preparing to ring in the Nasdaq bell remotely from the courtyard of her company's Silicon Valley headquarters, Patrick Chung, one of its earliest investors, presented her with the pitch document she'd shown him when she was first asking for money, reproduced on two pieces of paper so she could see both sides. The one-sheet outlined a radical transformation in the field of DNA testing. Wojcicki's plan back then was to turn genetics from the rarefied work of high-end labs into mainstream health and quasi entertainment products.

First she'd sell tastemakers on her mail-in spit kits as a way to learn sort-of-interesting things about their DNA makeup, such as its likely ancestral origins and the chance it would lead to certain health conditions. Eventually she'd be able to lower prices enough to make the kits broadly accessible, allowing 23andMe to build a database big enough to identify new links between diseases and particular genes. Later, this research would fuel the creation of drugs the company could tailor to different genetic profiles. 23andMe would become a new kind of health-care business, sitting somewhere between a Big Pharma lab, a Big Tech company, and a trusted neighborhood doctor.

Some of this still sounds as far off now as it did during the Bush years. Improbably, though, 23andMe has rounded second base and is heading for third. Wojcicki did sell millions of people on DNA test kits -- 11 million and counting -- and bring such tests to the mainstream, with some help from Oprah's holiday gift guide. An estimated 1 in 5 Americans have turned over their genetic material to 23andMe or one of its competitors. Now that she's got the data, Wojcicki is working on the drugs. Her company is collaborating on clinical trials for one compound (and nearing trials for another) that could be used for what's known as immuno-oncology, treatments that attempt to harness the body's complex immune system to beat cancer. 23andMe says it's also exploring drugs with potential use in treatments for neurological, cardiovascular, and other conditions, though it declined to specify them. Last month the company bought Lemonaid Health, a telehealth and drug delivery startup that offers treatment and prescriptions for a select group of conditions, including depression, anxiety, and STDs.