The Internal Revenue Service attempted to identify and track potential criminal suspects by purchasing access to a commercial database that records the locations of millions of American cellphones. The Wall Street Journal reports: The IRS Criminal Investigation unit, or IRS CI, had a subscription to access the data in 2017 and 2018, and the way it used the data was revealed last week in a briefing by IRS CI officials to Sen. Ron Wyden's (D., Ore.) office. The briefing was described to The Wall Street Journal by an aide to the senator. IRS CI officials told Mr. Wyden's office that their lawyers had given verbal approval for the use of the database, which is sold by a Virginia-based government contractor called Venntel Inc. Venntel obtains anonymized location data from the marketing industry and resells it to governments. IRS CI added that it let its Venntel subscription lapse after it failed to locate any targets of interest during the year it paid for the service, according to Mr. Wyden's aide.

Justin Cole, a spokesman for IRS CI, said it entered into a "limited contract with Venntel to test their services against the law enforcement requirements of our agency." IRS CI pursues the most serious and flagrant violations of tax law, and it said it used the Venntel database in "significant money-laundering, cyber, drug and organized-crime cases." "The tool provided information as to where a phone with an anonymized identifier (created by Venntel) is located at different times," Mr. Cole said. "For example, if we know that a suspicious ATM deposit was made at a specific time and at a specific location, and we have one or more other data points for the same scheme, we can cross reference the data from each event to see if one or more devices were present at multiple transactions. This would then allow us to identify the device used by a potential suspect and attempt to follow that particular movement."

IRS CI "attempted to use Venntel data to look for location records for mobile devices that were consistently present during multiple financial transactions related to an alleged crime," Mr. Cole said. He said that the tool could be used to track an individual criminal suspect once one was identified but said that it didn't do so because the tool produced no leads.

From a report: Have you ever wondered why online ads appear for things that you were just thinking about? There's no big conspiracy. Ad tech can be creepily accurate. Tech giant Oracle is one of a few companies in Silicon Valley that has near-perfected the art of tracking people across the internet. The company has spent a decade and billions of dollars buying startups to build its very own panopticon of users' web browsing data. One of those startups, BlueKai, which Oracle bought for a little over $400 million in 2014, is barely known outside marketing circles, but it amassed one of the largest banks of web tracking data outside of the federal government. BlueKai uses website cookies and other tracking tech to follow you around the web. By knowing which websites you visit and which emails you open, marketers can use this vast amount of tracking data to infer as much about you as possible -- your income, education, political views, and interests to name a few -- in order to target you with ads that should match your apparent tastes. If you click, the advertisers make money.

But for a time, that web tracking data was spilling out onto the open internet because a server was left unsecured and without a password, exposing billions of records for anyone to find. Security researcher Anurag Sen found the database and reported his finding to Oracle through an intermediary -- Roi Carthy, chief executive at cybersecurity firm Hudson Rock and former TechCrunch reporter.

STERIS Corporation, a company that makes sterilization and other medical equipment, sent a letter to iFixit claiming their online database of repair manuals for ventilators and medical equipment violates their copyrights. Motherboard reports: "It has come to my attention that you have been reproducing certain installation and maintenance manuals relating to our products, documentation which is protected by copyright law," the letter said. The letter then went on to tell [Kyle Wiens, CEO of iFixit] to remove all Steris copyrighted material from the iFixit website within 10 days of the letter. As Motherboard reported in March, major manufacturers of medical devices have long made it difficult for their devices to be repaired through third party repair professionals. Manufacturers have often lobbied against right to repair legislation and many medical devices are controlled by artificial "software locks" that allow only those with authorization to make modifications.

"I'm disappointed that Steris is resorting to legal threats to stop hospitals from having access to information about how to maintain critical sterilization equipment during a pandemic," Wiens told Motherboard in an email. "No manufacturer should be stopping hospitals from repairing their equipment," Wiens said. "The best way to ensure patient safety is to make sure that equipment is being maintained regularly using the manufacturer's recommended procedures. The only way to do that is if hospitals have up to date manuals." With regards to the letter sent by Steris, Wiens said iFixit has not removed any material from its website. "We explained to Steris that what we did is a lawful and protected fair use under the U.S. Copyright act," Wiens said. "iFixit is protected by Section 512 of the Digital Millennium Copyright Act, which allows online platforms to host content contributed by users provided they comply with the Act's requirements, which iFixit does," a letter to Steris from the Electronic Frontier Foundation on behalf of iFixit said.

The police in China are collecting blood samples from men and boys from across the country to build a genetic map of its roughly 700 million males, giving the authorities a powerful new tool for their emerging high-tech surveillance state. From a report: They have swept across the country since late 2017 to collect enough samples to build a vast DNA database, according to a new study published on Wednesday by the Australian Strategic Policy Institute, a research organization, based on documents also reviewed by The New York Times. With this database, the authorities would be able to track down a man's male relatives using only that man's blood, saliva or other genetic material. An American company, Thermo Fisher, is helping: The Massachusetts company has sold testing kits to the Chinese police tailored to their specifications. American lawmakers have criticized Thermo Fisher for selling equipment to the Chinese authorities, but the company has defended its business.

The project is a major escalation of China's efforts to use genetics to control its people, which had been focused on tracking ethnic minorities and other, more targeted groups. It would add to a growing, sophisticated surveillance net that the police are deploying across the country, one that increasingly includes advanced cameras, facial recognition systems and artificial intelligence. The police say they need the database to catch criminals and that donors consent to handing over their DNA. Some officials within China, as well as human rights groups outside its borders, warn that a national DNA database could invade privacy and tempt officials to punish the relatives of dissidents and activists. Rights activists argue that the collection is being done without consent because citizens living in an authoritarian state have virtually no right to refuse.

In 1999, Ray Kurzweil made predictions about what the world would be like 20 years in the future. Last month the community blog LessWrong took a look at how accurate Kurzweil's predictions turned out to be: This was a follow up to a previous assessment about his predictions about 2009, which showed a mixed bag, roughly evenly divided between right and wrong, which I'd found pretty good for 10-year predictions... For the 2019 predictions, I divided them into 105 separate statements, did a call for volunteers [and] got 46 volunteers with valid email addresses, of which 34 returned their predictions... Of the 34 assessors, 24 went the whole hog and did all 105 predictions; on average, 91 predictions were assessed by each person, a total of 3078 individual assessments...

Kurzweil's predictions for 2019 were considerably worse than those for 2009, with more than half strongly wrong.
The assessors ultimately categorized just 12% of Kurzweil's predictions as true, with another 12% declared "weakly true," while another 10% were classed as "cannot decide." But 52% were declared "false" -- with another 15% also called "weakly false."

Among Kurzweil's false predictions for the year 2019:

• "Phone" calls routinely include high-resolution three-dimensional images projected through the direct-eye displays and auditory lenses... Thus a person can be fooled as to whether or not another person is physically present or is being projected through electronic communication.

• The all-enveloping tactile environment is now widely available and fully convincing.

"As you can see, Kurzweil suffered a lot from his VR predictions," explains the LessWrong blogpost. "This seems a perennial thing: Hollywood is always convinced that mass 3D is just around the corner; technologists are convinced that VR is imminent."

But the blog post also thanks Kurzweil, "who, unlike most prognosticators, had the guts and the courtesy to write down his predictions and give them a date. I strongly suspect that most people's 1999 predictions about 2019 would have been a lot worse."

And they also took special note of Kurzweil's two most accurate predictions. First, "The existence of the human underclass continues as an issue." And second:

"People attempt to protect their privacy with near-unbreakable encryption technologies, but privacy continues to be a major political and social issue with each individual's practically every move stored in a database somewhere."

"The terms 'allowlist' and 'blocklist' describe their purpose, while the other words use metaphors to describe their purpose," reads a change description on the source code for Android -- from over a year ago. 9to5Mac calls it "a shortened version of Google's (internal-only) explanation" for terminology changes which are now becoming more widespread.

And Thursday GitHub's CEO said they were also "already working on" renaming the default branches of code from "master" to a more neutral term like "main," reports ZDNet: GitHub lending its backing to this movement effectively ensures the term will be removed across millions of projects, and effectively legitimizes the effort to clean up software terminology that started this month.

But, in reality, these efforts started years ago, in 2014, when the Drupal project first moved in to replace "master/slave" terminology with "primary/replica." Drupal's move was followed by the Python programming language, Chromium (the open source browser project at the base of Chrome), Microsoft's Roslyn .NET compiler, and the PostgreSQL and Redis database systems... The PHPUnit library and the Curl file download utility have stated their intention to replace blacklist/whitelist with neutral alternatives. Similarly, the OpenZFS file storage manager has also replaced its master/slave terms used for describing relations between storage environments with suitable replacements. Gabriel Csapo, a software engineer at LinkedIn, said on Twitter this week that he's also in the process of filing requests to update many of Microsoft's internal libraries.
A recent change description for the Go programming language says "There's been plenty of discussion on the usage of these terms in tech. I'm not trying to have yet another debate." It's clear that there are people who are hurt by them and who are made to feel unwelcome by their use due not to technical reasons but to their historical and social context. That's simply enough reason to replace them.

Anyway, allowlist and blocklist are more self-explanatory than whitelist and blacklist, so this change has negative cost.
That change was merged on June 9th -- but 9to5Mac reports it's just one of many places these changes are happening. "The Chrome team is beginning to eliminate even subtle forms of racism by moving away from terms like 'blacklist' and 'whitelist.' Google's Android team is now implementing a similar effort to replace the words 'blacklist' and 'whitelist.'" And ZDNet reports more open source projects are working on changing the name of their default Git repo from "master" to alternatives like main, default, primary, root, or another, including the OpenSSL encryption software library, automation software Ansible, Microsoft's PowerShell scripting language, the P5.js JavaScript library, and many others.

On Wednesday, Magic: The Gathering publisher Wizards of the Coast took unprecedented measures to remove racist cards from its game. Seven cards in all, dating back to 1994, are now banned from play. Their images will also being removed from the game's official online database. Polygon reports: "The events of the past weeks and the ongoing conversation about how we can better support people of color have caused us to examine ourselves, our actions, and our inactions," Wizards said in a statement. "We appreciate everyone helping us to recognize when we fall short. We should have been better, we can be better, and we will be better." The list of now-banned cards is: Invoke Prejudice, Cleanse, Stone-Throwing Devils, Pradesh Gypsies, Jihad, Imprison, and Crusade.

One card in particular, Invoke Prejudice, was singled out. It shows a hooded executioner with a black axe. "If opponent casts a Summon spell that does not match the color of one of the creatures under your control, that spell is countered," says the card. It effectively kills off creatures that don't look like the creatures already on the table. Gatherer, the official online database of every Magic card ever published, displays the card at a web URL ending in "1488," numbers that are synonymous with white supremacy. All cards will be replaced online with a note that calls out their racist depictions, text, or a combination thereof.

Sen. Edward Markey has raised concerns that police and law enforcement agencies have access to controversial facial recognition app Clearview AI in cities where people are protesting the killing of George Floyd, an unarmed black man who died two weeks ago while in the custody of Minneapolis police. CNET reports: Markey, a Democratic senator from Massachusetts and a member of the Commerce, Science, and Transportation Committee, said Tuesday the technology could be used to identify and arrest protestors. "As demonstrators across the country exercise their First Amendment rights by protesting racial injustice, it is important that law enforcement does not use technological tools to stifle free speech or endanger the public," Markey said in a letter to Clearview AI CEO and co-founder Hoan Ton-That. The threat of surveillance could also deter people from "speaking out against injustice for fear of being permanently included in law enforcement databases," he said.

Markey, who has previously hammered Clearview AI over its sales to foreign governments, use by domestic law enforcement and use in the COVID-19 pandemic, is now asking the company for a list of law enforcement agencies that have signed new contracts since May 25, 2020. It's also being asked if search traffic on its database has increased during the past two weeks; whether it considers a law enforcement agency's "history of unlawful or discriminatory policing practices" before selling the technology to them; what process it takes to give away free trials; and whether it will prohibit its technology from being used to identify peaceful protestors. Ton-That said he will respond to the letter from Markey. "Clearview AI's technology is intended only for after-the-crime investigations, and not as a surveillance tool relating to protests or under any other circumstances," he said in an emailed statement.

A study that analyzed the top 54 open source projects found that security vulnerabilities in these tools doubled in 2019, going from 421 bugs reported in 2018 to 968 last year. From a report: According to RiskSense's "The Dark Reality of Open Source" report, released today, the company found 2,694 bugs reported in popular open source projects between 2015 and March 2020. The report didn't include projects like Linux, WordPress, Drupal, and other super-popular free tools, since these projects are often monitored, and security bugs make the news, ensuring most of these security issues get patched fairly quickly. Instead, RiskSense looked at other popular open source projects that aren't as well known but broadly adopted by the tech and software community. This included tools like Jenkins, MongoDB, Elasticsearch, Chef, GitLab, Spark, Puppet, and others. RiskSense says that one of the main problems they found during their study was that a large number of the security bugs they analyzed had been reported to the National Vulnerability Database (NVD) many weeks after they've been publicly disclosed. The company said it usually took on average around 54 days for bugs found in these 54 projects to be reported to the NVD, with PostgreSQL seeing reporting delays that amounted to eight months.

Last month Techcrunch reported that Mozilla had gone "full incubator" by holding a startup lab called Fix the Internet, followed by "a formal program dangling $75,000 investments in front of early-stage companies..."

Fix the Internet had many key themes, including collaboration and decentralization (as well as user-controlled data and privacy-protecting social networks). That event "drew the interest of some 1,500 people in 520 projects, and 25 were chosen to receive the full package and stipend during the development of their minimum viable product (MVP). Below that, as far as pecuniary commitment goes, is the 'MVP Lab,' similar to the spring program but offering a total of $16,000 per team."

And one of those MVP Lab teams is Meething, a new video conferencing and collaboration platform from the innovation lab ERA. Meething "aims to be more secure than existing video conferencing tools and run on a decentralized database engine and leverage peer-to-peer networking" according to ZDNet.

In their video interview with CEO Mark Nadal, he outlined the following selling points:

• Browser based video conferencing gives customers better options for security as well as branding.
• Open source architecture is a win and the peer-to-peer networking is more efficient on compute costs.
• Meething doesn't require downloads or apps that increase the security attack surface.
  
  The total addressable market for video conferencing is large and can support multiple players.

Their press release quotes Mark Mayo, a former Chief Product Officer at Mozilla who served as Meething's mentor, arguing that video conferencing on the web "has long promised to enable a whole new world of online collaboration. Frankly, it hasn't delivered. It's been way too hard to build cool products with video and Meething aims to be the zero-barrier-to-entry platform that realizes this future. Soon, video conferencing won't suck!"

Slack is partnering with Amazon in a multi-year agreement that means all Amazon employees will start to use Slack. The Verge reports: The deal comes just as Slack faces increased competition from Microsoft Teams, and it will also see Slack migrate its voice and video calling features over to Amazon's Chime platform alongside a broader adoption of Amazon Web Services (AWS). Amazon's roll out of Slack to all of its employees is a big part of the deal, thanks to an enterprise-wide agreement. It's not immediately clear how many of Amazon's 840,000 employees will be using Slack, though. Up until today, Slack's biggest customer has been IBM, which is rolling out Slack to its 350,000 employees.

While Slack has long used AWS to power parts of its chat app, it's now committing to using Amazon's cloud services as its preferred partner for storage, compute, database, security, analytics, machine learning, and future collaboration features. The deal means it's unlikely we'll see Slack turn to Microsoft's Azure cloud services or Google Cloud to power parts of its service in the foreseeable future. [...] Slack and Amazon are also promising better product integration and interoperability for features like AWS Chatbot, a service that pushes out Slack channel alerts for AWS instances. In the coming months, Slack and AWS will improve its Amazon AppFlow integration to support bi-directional transfer of data between AWS services and Slack channels.

AmiMoJo shares a report from The Guardian The World Health Organization and a number of national governments have changed their Covid-19 policies and treatments on the basis of flawed data from a little-known U.S. healthcare analytics company, also calling into question the integrity of key studies published in some of the world's most prestigious medical journals. Surgisphere, whose employees appear to include a sci-fi writer and adult content model, provided the database behind Lancet and New England Journal of Medicine hydroxychloroquine studies. Data it claims to have legitimately obtained from more than a thousand hospitals worldwide formed the basis of scientific articles that have led to changes in Covid-19 treatment policies in Latin American counties. It was also behind a decision by the WHO and research institutes around the world to halt trials of the controversial drug hydroxychloroquine. Late on Tuesday, the Lancet released an "expression of concern" about its published study. The New England Journal of Medicine has also issued a similar notice. According to an independent audit by authors not affiliated with Surgisphere, the article includes a list of "concerns that have been raised about the reliability of the database." Some of the main points include: Surgisphere's employees have little or no data or scientific background; While Surgisphere claims to run one of the largest and fastest growing hospital databases in the world, it has almost no online presence; and The firm's chief executive, Sapan Desai, has been named in three medical malpractice suits.

An anonymous reader quotes a report from the BBC: As the United States deals with widespread civil unrest across dozens of cities, "hacktivist" group Anonymous has returned from the shadows. The hacker collective was once a regular fixture in the news, targeting those it accused of injustice with cyber-attacks. After years of relative quiet, it appears to have re-emerged in the wake of violent protests in Minneapolis over the death of George Floyd, promising to expose the "many crimes" of the city's police to the world. However, it's not easy to pin down what, if anything, is genuinely the mysterious group's work.

Various forms of cyber-attack are being attributed to Anonymous in relation to the George Floyd protests. First, the Minneapolis police department website was temporarily taken offline over the weekend in a suspected Distributed Denial of Service (DDoS) attack. This is an unsophisticated but effective form of cyber-attack that floods a server with data until it can't keep up and stops working -- in the same way that shopping websites can go offline when too many people flood it to snap up high-demand products. A database of email addresses and passwords claiming to be hacked from the police department's system is also in circulation, and being linked to Anonymous. However, there is no evidence that the police servers have been hacked and one researcher, Troy Hunt, says the credentials are likely to have been compiled from older data breaches.

A page on the website of a minor United Nations agency has been turned into a memorial for Mr Floyd, replacing its contents with the message "Rest in Power, George Floyd", along with an Anonymous logo. On Twitter, unverified posts have also gone viral, apparently showing police radios playing music and preventing communication. However, experts suggest it is unlikely to be a hack, and could instead be the result of a stolen piece of hardware being commandeered by protesters on the scene -- if the videos are genuine in the first place. Anonymous activists are also circulating years-old accusations against President Trump, taken from documents in a civil court case that was voluntarily dismissed by the accuser before it went to trial.

The American Civil Liberties Union on Thursday sued the facial recognition start-up Clearview AI (alternative source), which claims to have helped hundreds of law enforcement agencies use online photos to solve crimes, accusing the company of "unlawful, privacy-destroying surveillance activities." The New York Times reports: In a suit filed in Illinois, the A.C.L.U. said that Clearview violated a state law that forbids companies from using a resident's fingerprints or face scans without consent. Under the law, residents have the right to sue companies for up to $5,000 per privacy violation. "The bottom line is that, if left unchecked, Clearview's product is going to end privacy as we know it," said Nathan Freed Wessler, a lawyer at the A.C.L.U., "and we're taking the company to court to prevent that from happening."

The suit, filed in the Circuit Court of Cook County, adds to the growing backlash against Clearview since January, when The New York Times reported that the company had amassed a database of more than three billion photos across the internet, including from Facebook, YouTube, Twitter and Venmo. This trove of photos enables anyone with the Clearview app to match a person to their online photos and find links back to the sites where the images originated. People in New York and Vermont have also filed suits in against the company in recent months, and the state attorneys general of Vermont and New Jersey have ordered Clearview to stop collecting residents' photos. According to the A.C.L.U. suit, "Clearview has set out to do what many companies have intentionally avoided out of ethical concerns: create a mass database of billions of face prints of people, including millions of Illinoisans, entirely unbeknownst to those people, and offer paid access to that database to private and governmental actors worldwide." The company's business model, the complaint said, "appears to embody the nightmare scenario" of a "private company capturing untold quantities of biometric data for purposes of surveillance and tracking without notice to the individuals affected, much less their consent."

Thailand's largest cell network AIS has pulled a database offline that was spilling billions of real-time internet records on millions of Thai internet users. From a report: Security researcher Justin Paine said in a blog post that he found the database, containing DNS queries and Netflow data, on the internet without a password. With access to this database, Paine said that anyone could "quickly paint a picture" about what an internet user (or their household) does in real-time. Paine alerted AIS to the open database on May 13. But after not hearing back for a week, Paine reported the apparent security lapse to Thailand's national computer emergency response team, known as ThaiCERT, which contacted AIS about the open database. The database was inaccessible a short time later. AIS spokesperson Sudaporn Watcharanisakorn confirmed AIS owned the data, and apologized for the security lapse.

The State of Software Security (SOSS): Open Source Edition "analyzed the component open source libraries across the Veracode platform database of 85,000 applications which includes 351,000 unique external libraries," reports TechRepublic. "Chris Eng, chief research officer at Veracode, said open source software has a surprising variety of flaws." "An application's attack surface is not limited to its own code and the code of explicitly included libraries, because those libraries have their own dependencies," he said. The study found that 70% of applications have a security flaw in an open source library on an initial scan.
Other findings from the report:

• The most commonly included libraries are present in over 75% of applications for each language.

• 47% of those flawed libraries in applications are transitive.

• More than 61% of flawed libraries in JavaScript contain vulnerabilities without corresponding common vulnerabilities and exposures (CVEs).

• Fixing most library-introduced flaws can be done with a minor version upgrade.

• Using any given PHP library has a greater than 50% chance of bringing a security flaw along with it.

sciencehabit shares a report from Science Magazine: When the Soviet Union launched Sputnik into orbit in 1957, the United States responded with its own spy satellites. The espionage program, known as Corona, sought to locate Soviet missile sites, but its Google Earth-like photography captured something unintended: snapshots of animals and their habitats frozen in time. Now, by comparing these images with modern data, scientists have found a way to track the decline of biodiversity in regions that lack historic records.

The researchers tested the approach on bobak marmot (Marmota bobak) populations in the grassland region of northern Kazakhstan. There, Soviets converted millions of hectares of natural habitat into cropland in the 1960s. The scientists searched the satellites' black and white film images on a U.S. Geological Survey database for signs of the squirrel-like animal's burrows. They identified more than 5,000 historic marmot homes and compared them with contemporary digital images of the region, mapping more than 12,000 marmot burrows in all. About eight generations of marmots occupied the same burrows in the study area over more than 50 years, even when their habitats underwent major changes, the team reports in the Proceedings of the Royal Society B. Overall, the researchers estimate the number of marmot burrows dropped by 14% since the '60s. But the number of burrows in some of the oldest fields -- those persistently disturbed by humans plowing grassland to plant wheat -- plunged by much more -- about 60%.

Apple and Google announced today that they have rolled out a COVID-19 exposure notification system, "essentially a unified programming interface that will allow public health departments to create their own contact tracing applications," reports ABC News. "Apple and Google are not building contact tracing apps." From the report: "Starting today, our Exposure Notifications technology is available to public health agencies on both iOS and Android," Apple and Google said in a statement. "Today, this technology is in the hands of public health agencies across the world who will take the lead and we will continue to support their efforts."

After an individual downloads and enables a contact tracing application on his phone, he would subsequently receive an alert if he is exposed to anyone who is diagnosed with or likely to have COVID-19. Of course, that assumes that the COVID-19-positive individual also has the application enabled on his phone. The companies said that digital contact tracing is meant to argument traditional human-to-human tracing, not replace it. Digital contact tracing is faster than traditional tracing, requires fewer resources and since it doesn't rely on human memory, can make it easier to track exposure in crowded spaces, or contact with strangers. On the other hand, for such applications to be effective, they require users to download and enable the applications on their phones, and it's not yet clear that Americans will be willing to do so en masse. "Once they download the app, users will have to consent to make their information available to the health authorities and can turn it on and off when they choose to," the report adds. "Data collection will be kept private and only used by health authorities for COVID-19 exposure, not stored in a central database."

The companies said that they will not monetize the data that comes out of the system.

According to CEO Kyle Wiens, teardown and repair website iFixit has just posted "the most comprehensive online resource for medical repair professionals." The Verge reports: The new database contains dedicated sections for clinical, laboratory, and medical support equipment, in addition to numerous other categories of devices. It also provides more than 13,000 manuals from hundreds of medical device manufacturers. Wiens says the effort began with a crowdsourcing campaign to collect repair information for hospital equipment, with a focus on "ventilator documentation, anesthesia systems, and respiratory analyzers -- devices widely used to support COVID-19 patients." But the effort grew from there, spanning more than two months as iFixit added dozens more staff members to the project; began talking to more biomedical technicians, doctors, and nurses about their day-to-day needs; and started collecting and cataloging information from libraries and other sources.

The medical repair database is split up into nine categories, with each containing countless subcategories for basically any type of device you'd find in a medical setting. For instance, the clinical equipment category contains 53 subcategories for everything from anesthesia systems and Bilevel Positive Airway Pressure (BiPAP) machines to respiratory analyzers and ventilators. The database also has medical training manuals, information on medical furniture like decontamination systems and hospital beds, and an exhaustive section on surgical equipment repair and maintenance. Wiens explains in iFixit's announcement post that some medical device manufacturers make this information more easily available online than others. "But for their day-to-day work, biomeds have long relied on a rag-tag set of web resources to get the job done. Among the most popular is Frank's Hospital Workshop, a Tanzania-based site that hosts hundreds of medical device manuals -- it's the unofficial biomed bible," Wiens writes. The goal was not to outdo that website or try to overtake it in popularity, but to add new documents and manuals that weren't available before to a database including existing resources. Another bonus: the website will not make money on this project. "We are providing hosting and curation free of charge, and free of advertising, to the medical community," Wiens says.

Long-time Slashdot reader bbsguru shares a story from the alternative newsweekly the Arkansas Times. "A computer programmer applying for unemployment on Arkansas's Pandemic Unemployment Assistance program discovered a vulnerability in the system that exposed the Social Security numbers, bank account and routing numbers and other sensitive information of some 30,000 applicants.

"Anyone with basic computer knowledge could have accessed personal information for malicious purposes." Alarmed, the computer programmer called the Arkansas Division of Workforce Services Friday morning and was told by an operator that there was no one available who could talk to him. He then tried someone at the Arkansas State Police Criminal Investigation Division, who told the programmer he would find the person he needed to talk with to fix the situation. The programmer later called the Arkansas Times for advice on whom to call. The Times alerted the Division of Workforce Services to the issue at 4:30 p.m. Soon after a message appeared on the website that said, "The site is currently under maintenance...."

In exploring the website, the computer programmer determined that by simply removing part of the site's URL, he could access the administrative portal of the site, where he had the option of editing the personal information of applicants, including bank account numbers. From the admin portal, he viewed the page's source code and saw that the site was using an API (application programming interface) to connect with a database. That API was also left unencrypted, and he could access all of the applicants' raw data, included Social Security numbers and banking information...

The computer programmer said he thought he could have programmed a script that would gather all of the information from the API in under an hour.