Intel and Boeing, once exemplars of American manufacturing prowess, now face existential crises. Their market values have plummeted, jeopardizing not just shareholder wealth but national security. The U.S. is losing its edge in manufacturing high-tech products, crucial in its geopolitical contest with China, a story on WSJ argues.

Unlike past manufacturing declines, Intel and Boeing's woes stem from internal missteps, prioritizing financial performance over engineering excellence. Their potential demise threatens America's semiconductor and commercial aircraft industries, with far-reaching consequences for the nation's technological ecosystem. While government intervention is controversial, national security concerns may necessitate support. WSJ adds: So, much as national leaders would like to ignore these companies' woes, they can't. National security dictates the U.S. maintain some know-how in making aircraft and semiconductors.

Certainly other countries feel that way: European governments heavily subsidized Airbus. China is pursuing dominance in key technologies regardless of the cost. Its so-called Big Fund has sunk roughly $100 billion into semiconductors while aid to Comac had reached $72 billion in 2020, according to the Center for Strategic and International Studies.

"Until Comac succeeds in gaining significant global market share, it will continue to run big losses and be bailed out by the Chinese government," said Atkinson, whose organization gets support from Boeing.

Both political parties have bought into the idea that manufacturing is special and thus deserving of public support. That raises the question: which manufacturing, and what kind of support?

The goal of manufacturing strategy shouldn't be just producing jobs but great, world-beating products. [...]

News Corp's Dow Jones & Co., publisher of the Wall Street Journal, and the New York Post have sued Perplexity, a startup that calls itself an "AI-powered Swiss Army Knife for information discovery and curiosity," alleging copyright infringement. From a report: "Perplexity is a generative artificial intelligence company that claims to provide its users accurate and up-to-date news and information in a platform that, in Perplexity's own words, allows users to 'Skip the Links' to original publishers' websites," the companies said in the federal lawsuit, filed Monday. "Perplexity attempts to accomplish this by engaging in a massive amount of illegal copying of publishers' copyrighted works and diverting customers and critical revenues away from those copyright holders. This suit is brought by news publishers who seek redress for Perplexity's brazen scheme to compete for readers while simultaneously freeriding on the valuable content the publishers produce."

jd writes: Linus Torvalds is not a happy camper and is condemning hardware vendors for poor security and the plethora of actual and theoretical attacks, especially as some of the new features being added impact the workarounds. These workarounds are now getting very expensive, CPU-wise.

TFA quotes Linus Torvalds:

"Honestly, I'm pretty damn fed up with buggy hardware and completely theoretical attacks that have never actually shown themselves to be used in practice.

"So I think this time we push back on the hardware people and tell them it's *THEIR* damn problem, and if they can't even be bothered to say yay-or-nay, we just sit tight.

Because dammit, let's put the onus on where the blame lies, and not just take any random shit from bad hardware and say 'oh, but it *might* be a problem.'"

chalsall writes: After more than six years of work since the last discovery, the Great Internet Mersenne Prime Search (GIMPS) has found the 52nd known Mersenne Prime number. This is also the largest prime number known to humans.

The number is 2^136,279,841-1, which is 41,024,320 decimal digits long.

Luke Durant, a researcher from San Jose, CA, found it after contributing a fantastic amount of compute to the GIMPS project.

Egypt was declared malaria-free by the World Health Organization, after nearly a century of work to eradicate the disease in the country. From a report: Egypt saw 3 million cases a year in the 1940s, and the Aswan Dam's development in the 1960s created new bodies of standing water for the mosquitoes to breed in, but by 2001 the disease was "firmly under control," according to the WHO. "The disease that plagued pharaohs now belongs to [Egypt's] history," the WHO's chief said. It's the 44th country to be certified, but the wider battle against malaria goes on: The mosquito-borne disease still kills around 600,000 people a year, the large majority of them children in sub-Saharan Africa.

An anonymous reader shares a report: Fans of literature most likely know Kurt Vonnegut for the novel Slaughterhouse-Five. The staunchly anti-war book first resonated with readers during the Vietnam War era, later becoming a staple in high school curricula the world over. When Vonnegut died in 2007 at the age of 84, he was widely recognized as one of the greatest American novelists of all time. But would you believe that he was also an accomplished game designer?

In 1956, following the lukewarm reception of his first novel, Player Piano, Vonnegut was one of the 16 million other World War II veterans struggling to put food on the table. His moneymaking solution at the time was a board game called GHQ, which leveraged his understanding of modern combined arms warfare and distilled it into a simple game played on an eight-by-eight grid. Vonnegut pitched the game relentlessly to publishers all year long according to game designer and NYU faculty member Geoff Engelstein, who recently found those letters sitting in the archives at Indiana University. But the real treasure was an original set of typewritten rules, complete with Vonnegut's own notes in the margins.

With the permission of the Vonnegut estate, Engelstein tells Polygon that he cleaned the original rules up just a little bit, buffed out the dents in GHQ's endgame, and spun up some decent art and graphic design. Now you can purchase the final product, titled Kurt Vonnegut's GHQ: The Lost Board Game, at your local Barnes & Noble -- nearly 70 years after it was created.

Intuit, the maker of TurboTax software, asked technology news outlet The Verge to delete part of a podcast interview with CEO Sasan Goodarzi, The Verge reported on Monday. The request came after Goodarzi was questioned about Intuit's lobbying efforts against free government tax filing options, a topic that has drawn scrutiny from regulators and lawmakers.

The Verge said it declined to remove the segment, instead choosing to highlight the exchange by playing it at the beginning of the episode. In the interview, Goodarzi disputed claims that Intuit lobbies against free tax filing, stating the company spends "a couple of million dollars fighting for simplified taxes." However, The Verge's editor Nilay Patel pressed Goodarzi on reports of Intuit's lobbying against government-provided tax returns. Patel adds: I got a note from Rick Heineman, the chief communications officer at Intuit, who called the line of questioning and my tone "inappropriate," "egregious," and "disappointing" and demanded that we delete that entire section of the recording. I mean, literally -- he wrote a long email that ended with "at the very least the end portion of your interview should be deleted."

Though Sam Altman once called OpenAI's partnership with Microsoft "the best bromance in tech," now "ties between the companies have started to fray" reports the New York Times — citing interviews with 19 people "familiar with the relationship". [Alternate URL here.]

Among other things, Satya Nadella "has said privately that Altman's firing in November shocked and concerned him, according to five people with knowledge of his comments. Since then, Microsoft has started to hedge its bet on OpenAI," and reconsidered new investments beyond its initial $13 billion — even as OpenAI expects to lose $5 billion this year That tension demonstrates a key challenge for AI startups: They are dependent on the world's tech giants for money and computing power because those big companies control the massive cloud computing systems the small outfits need to develop AI... Over the past year, OpenAI has been trying to renegotiate the deal to help it secure more computing power and reduce crushing expenses while Microsoft executives have grown concerned that their AI work is too dependent on OpenAI... [I]n March, Microsoft paid at least $650 million to hire most of the staff from Inflection, an OpenAI competitor...

In June, Microsoft agreed to an exception in [OpenAI's] contract, six people with knowledge of the change said. That allowed OpenAI to sign a roughly $10 billion computing deal with Oracle for additional computing resources, according to two people familiar with the deal. Oracle is providing computers packed with chips suited to building AI, while Microsoft provides the software that drives the hardware... While it was looking for computer power alternatives, OpenAI also raced to broaden its investors, according to two people familiar with the company's plan. Part of the plan was to secure strategic investments from organizations that could bolster OpenAI's prospects in ways beyond throwing around money. Those organizations included Apple, chipmaker Nvidia, and MGX, a tech investment firm controlled by the United Arab Emirates... Earlier this month, OpenAI closed a $6.6 billion funding round led by Thrive Capital, with additional participation from Nvidia, MGX and others. Apple did not invest, but Microsoft also participated in the funding round.

OpenAI expected to spend at least $5.4 billion in computing costs through the end of 2024, according to documents reviewed by The New York Times. That amount was expected to skyrocket over the next five years as OpenAI expanded, soaring to an estimated $37.5 billion in annual computing costs by 2029, the documents showed... Still, OpenAI employees complain that Microsoft is not providing enough computing power, according to three people familiar with the relationship. And some have complained that if another company beat it to the creation of AI that matches the human brain, Microsoft will be to blame because it hasn't given OpenAI the computing power it needs, according to two people familiar with the complaints.

Oddly, that could be the key to getting out from under its contract with Microsoft. The contract contains a clause that says that if OpenAI builds artificial general intelligence, or AGI — roughly speaking, a machine that matches the power of the human brain — Microsoft loses access to OpenAI's technologies.

"Several of Europe's biggest carmakers unveiled low-cost electric vehicles at the Paris Motor Show this week," reports CNBC. The automakers are "seeking to jump-start a demand slump and recapture some of the market share now held by Chinese brands." "It feels like Europe is fighting back," Julia Poliscanova, senior director for vehicles and e-mobility supply chains at the Transport & Environment campaign group, told CNBC at the Paris Motor Show. "There are so many new models on show, and what is really great is that there are a lot of launches that are more affordable. So, Citroen, Peugeot [and] Renault, they are all showing some smaller affordable models," Poliscanova said. "This is exactly what we need for the mass market, for people to buy those vehicles more, and this is also where the competition from the Chinese is also the hardest," she added...

"The storytelling is that people have cooled off on EVs and there is no consumer demand, [but] this is really not true," Transport & Environment's Poliscanova said. "This year in Europe, we did not have affordable models, so people are not buying those overpriced premium vehicles. However, as soon as vehicles come in the right price range next year ... people will flock to buy them." Poliscanova said the launch of several low-cost EVs means electric car sales could account for up to a 24% market share next year, up from 14% this year. Chinese-made EVs typically cost less than half the prices seen in Europe and the U.S. last year, according to figures published by data firm JATO, underscoring the challenge for Western automakers to keep pace with Beijing...

Pere Brugal, president and managing director of GM Europe, said that the challenges facing Europe's auto industry should be seen as a transitional phase — and not evidence of a crisis. "The adoption of new technologies and new behaviors is never a linear growth story, but the end is full-electric [vehicles]," Brugal told CNBC at the Paris Motor Show.
Meanwhile, GM's CEO "says it will start making money on battery-powered models by the end of the year — becoming the only U.S. automaker aside from Tesla to achieve that feat," reports the New York Times (adding that sales are increasing "and the company just introduced a model that sells for less than $30,000 after a federal tax credit.")

And GM "is still committed to doing away with combustion engine cars in the United States by 2035."

"Millions of Cubans remained without power for a third day in a row Sunday," reports CNN, "after fresh attempts to restore electricity failed overnight and the power grid collapsed for the fourth time — all before the arrival of Hurricane Oscar."

A report from Reuters notes it was the fourth power grid failure in 48 hours. "On the forecast track, the center of Oscar is expected to continue moving across eastern Cuba tonight and Monday, then emerge off the northern coast of Cuba late Monday and cross the central Bahamas on Tuesday," the U.S. National Hurricane Center said. The Communist-run government canceled school through Wednesday — a near unprecedented move in Cuba — citing the hurricane and the ongoing energy crisis...

Cuba had restored power to 160,000 clients in Havana just prior to the grid's Sunday collapse, giving some residents a glimmer of hope... Energy and mines minister Vicente de la O Levy told reporters earlier on Sunday he expected the grid to be fully functional by Monday or Tuesday but warned residents not to expect dramatic improvements.

It was not immediately clear how much the latest setback would delay the government's efforts.

An anonymous reader shared this report from ComicBook.com: On Saturday, 20th Century Studios announced that the latest entry in the Alien sci-fi horror franchise will get a limited-edition VHS release on December 3 — just in time for the holidays.

The VHS release of Alien: Romulus is the first such release from a major studio since 2006... a major win for fans of physical media. In recent months, there has been a great bit of conversation surrounding the so-called death of physical media with the rise of digital and streaming with some retailers even having previously announced that they have or will be stopping sales of physical media. But with streaming platforms removing content for various reasons, there's been a rise in appreciation for physical media which has, in turn, resulted in increased sales, particularly when it comes to limited edition items such as Steelbooks [collectible steel-case disc releases]... Given that the Alien: Romulus VHS release is part of an overall celebration of the franchise for its 45th anniversary year, leaning into that nostalgia for feels pretty spot on.
The release will present the movie "in a 4:3 aspect ratio," writes the Verge, "hopefully with well-done pan-and-scan..." (Their post includes a promotional picture showing the "slick, vintage-style" box-cover art.)

"The tape has only the film," notes Gizmodo, "and no special featurette attached at the end, like some used to back in the day."

Gizmodo also reminds readers of Hulu's 2025 series Alien: Earth and an upcoming videogame sequel to 2014's Alien: Isolation.

"After two years of being beaten with the memory-safety stick, the C++ community has published a proposal to help developers write less vulnerable code," reports the Register.

"The Safe C++ Extensions proposal aims to address the vulnerable programming language's Achilles' heel, the challenge of ensuring that code is free of memory safety bugs..." Acknowledging the now deafening chorus of calls to adopt memory safe programming languages, developers Sean Baxter, creator of the Circle compiler, and Christian Mazakas, from the C++ Alliance, argue that while Rust is the only popular systems level programming language without garbage collection that provides rigorous memory safety, migrating C++ code to Rust poses problems. "Rust lacks function overloading, templates, inheritance and exceptions," they explain in the proposal. "C++ lacks traits, relocation and borrow checking. These discrepancies are responsible for an impedance mismatch when interfacing the two languages. Most code generators for inter-language bindings aren't able to represent features of one language in terms of the features of another."

Though DARPA is trying to develop better automated C++ to Rust conversion tools, Baxter and Mazakas argue telling veteran C++ developers to learn Rust isn't an answer... The Safe C++ project adds new technology for ensuring memory safety, Baxter explained, and isn't just a reiteration of best practices. "Safe C++ prevents users from writing unsound code," he said. "This includes compile-time intelligence like borrow checking to prevent use-after-free bugs and initialization analysis for type safety." Baxter said that rewriting a project in a different programming language is costly, so the aim here is to make memory safety more accessible by providing the same soundness guarantees as Rust at a lower cost. "With Safe C++, existing code continues to work as always," he explained. "Stakeholders have more control for incrementally opting in to safety."

The next step, Baxter said, involves greater participation from industry to help realize the Safe C++ project. "The foundations are in: We have fantastic borrow checking and initialization analysis which underpin the soundness guarantees," he said. "The next step is to comprehensively visit all of C++'s features and specify memory-safe versions of them. It's a big effort, but given the importance of reducing C++ security vulnerabilities, it's an effort worth making."

A principal security software engineer at Microsoft described how they use their Azure cloud platform "to hunt phishers at scale," in a talk at the information security conference BSides Exeter.

Calling himself Microsoft's "Head of Deception." Ross Bevington described how they'd created a "hybrid high interaction honeypot" on the now retired code.microsoft.com "to collect threat intelligence on actors ranging from both less skilled cybercriminals to nation state groups targeting Microsoft infrastructure," according to a report by BleepingComputer: With the collected data, Microsoft can map malicious infrastructure, gain a deeper understanding of sophisticated phishing operations, disrupt campaigns at scale, identify cybercriminals, and significantly slow down their activity... Bevington and his team fight phishing by leveraging deception techniques using entire Microsoft tenant environments as honeypots with custom domain names, thousands of user accounts, and activity like internal communications and file-sharing...

In his BSides Exeter presentation, the researcher says that the active approach consists in visiting active phishing sites identified by Defender and typing in the credentials from the honeypot tenants. Since the credentials are not protected by two-factor authentication and the tenants are populated with realistic-looking information, attackers have an easy way in and start wasting time looking for signs of a trap. Microsoft says it monitors roughly 25,000 phishing sites every day, feeding about 20% of them with the honeypot credentials; the rest are blocked by CAPTCHA or other anti-bot mechanisms.

Once the attackers log into the fake tenants, which happens in 5% of the cases, it turns on detailed logging to track every action they take, thus learning the threat actors' tactics, techniques, and procedures. Intelligence collected includes IP addresses, browsers, location, behavioral patterns, whether they use VPNs or VPSs, and what phishing kits they rely on... The deception technology currently wastes an attacker 30 days before they realize they breached a fake environment. All along, Microsoft collects actionable data that can be used by other security teams to create more complex profiles and better defenses.

"Who asked for any of this in the first place?" wonders a New York Times consumer-tech writer. (Alternate URL here.) "Judging from the feedback I get from readers, lots of people outside the tech industry remain uninterested in AI — and are increasingly frustrated with how difficult it has become to ignore." The companies rely on user activity to train and improve their AI systems, so they are testing this tech inside products we use every day. Typing a question such as "Is Jay-Z left-handed?" in Google will produce an AI-generated summary of the answer on top of the search results. And whenever you use the search tool inside Instagram, you may now be interacting with Meta's chatbot, Meta AI. In addition, when Apple's suite of AI tools, Apple Intelligence, arrives on iPhones and other Apple products through software updates this month, the tech will appear inside the buttons we use to edit text and photos.

The proliferation of AI in consumer technology has significant implications for our data privacy, because companies are interested in stitching together and analyzing our digital activities, including details inside our photos, messages and web searches, to improve AI systems. For users, the tools can simply be an annoyance when they don't work well. "There's a genuine distrust in this stuff, but other than that, it's a design problem," said Thorin Klosowski, a privacy and security analyst at the Electronic Frontier Foundation, a digital rights nonprofit, and a former editor at Wirecutter, the reviews site owned by The New York Times. "It's just ugly and in the way."

It helps to know how to opt out. After I contacted Microsoft, Meta, Apple and Google, they offered steps to turn off their AI tools or data collection, where possible. I'll walk you through the steps.
The article suggests logged-in Google users can toggle settings at myactivity.google.com. (Some browsers also have extensions that force Google's search results to stop inserting an AI summary at the top.) And you can also tell Edge to remove Copilot from its sidebar at edge://settings.

But "There is no way for users to turn off Meta AI, Meta said. Only in regions with stronger data protection laws, including the EU and Britain, can people deny Meta access to their personal information to build and train Meta's AI." On Instagram, for instance, people living in those places can click on "settings," then "about" and "privacy policy," which will lead to opt-out instructions. Everyone else, including users in the United States, can visit the Help Center on Facebook to ask Meta only to delete data used by third parties to develop its AI.
By comparison, when Apple releases new AI services this month, users will have to opt in, according to the article. "If you change your mind and no longer want to use Apple Intelligence, you can go back into the settings and toggle the Apple Intelligence switch off, which makes the tools go away."

Cybersecurity startup Watchtowr "was founded by hacker-turned-entrepreneur Benjamin Harris," according to a recent press release touting their Fortune 500 customers and $29 million investments from venture capital firms. ("If there's a way to compromise your organization, watchTowr will find it," Harris says in the announcement.)

This week they shared their own research on a Fortinet FortiGate SSLVPN appliance vulnerability (discovered in February by Gwendal Guégniaud of the Fortinet Product Security team — presumably in a static analysis for format string vulnerabilities). "It affected (before patching) all currently-maintained branches, and recently was highlighted by CISA as being exploited-in-the-wild... It's a Format String vulnerability [that] quickly leads to Remote Code Execution via one of many well-studied mechanisms, which we won't reproduce here..."

"Tl;dr SSLVPN appliances are still sUpEr sEcurE," their post begains — but the details are interesting. When trying to test an exploit, Watchtowr discovered instead that FortiGate always closed the connection early, thanks to an exploit mitigation in glibc "intended to hinder clean exploitation of exactly this vulnerability class." Watchtowr hoped to "use this to very easily check if a device is patched — we can simply send a %n, and if the connection aborts, the device is vulnerable. If the connection does not abort, then we know the device has been patched... " But then they discovered "Fortinet added some kind of certificate validation logic in the 7.4 series, meaning that we can't even connect to it (let alone send our payload) without being explicitly permitted by a device administrator." We also checked the 7.0 branch, and here we found things even more interesting, as an unpatched instance would allow us to connect with a self-signed certificate, while a patched machine requires a certificate signed by a configured CA. We did some reversing and determined that the certificate must be explicitly configured by the administrator of the device, which limits exploitation of these machines to the managing FortiManager instance (which already has superuser permissions on the device) or the other component of a high-availability pair. It is not sufficient to present a certificate signed by a public CA, for example...

Fortinet's advice here is simply to update, which is always sound advice, but doesn't really communicate the nuance of this vulnerability... Assuming an organisation is unable to apply the supplied workaround, the urgency of upgrade is largely dictated by the willingness of the target to accept a self-signed certificate. Targets that will do so are open to attack by any host that can access them, while those devices that require a certificate signed by a trusted root are rendered unexploitable in all but the narrowest of cases (because the TLS/SSL ecosystem is just so solid, as we recently demonstrated)...

While it's always a good idea to update to the latest version, the life of a sysadmin is filled with cost-to-benefit analysis, juggling the needs of users with their best interests.... [I]t is somewhat troubling when third parties need to reverse patches to uncover such details.
Thanks to Slashdot reader Mirnotoriety for sharing the article.

For the first time in 50 years, humans will walk on the moon again. Currently planned for as soon as 2026, the Artemis III mission "will be one of the most complex undertakings of engineering and human ingenuity in the history of deep space exploration..." writes NASA. "Two crew members will descend to the surface and spend approximately a week near the South Pole of the Moon conducting new science before returning to lunar orbit..."

And they'll be wearing Prada, according to a Space News report from Milan: At a briefing at the International Astronautical Congress here October 16, Axiom and Prada revealed details about the Axiom Extravehicular Mobility Unit (AxEMU) suit that Axiom is creating for use by NASA on lunar landing missions starting with Artemis 3... Axiom emphasized the advanced capabilities in the suit, particularly when compared to the suits worn by the Apollo astronauts on moonwalks more than a half-century ago [including greater redundancy and healthy monitoring systems not available in Apollo-era suits]...

The unveiling came just over a year after Axiom announced it was working with luxury goods company Prada, an unconventional partnership intended to leverage Prada's expertise in materials and design... [Axiom's executive VP of extravehicular activity Russell Ralston] said Axiom has leveraged Prada's expertise in fabrics and garment design in helping create the outer layer of the suit, which reflects sunlight and keeps dust from getting into interior layers... "If you look across all the different technologies that are needed within the suit, the uniqueness of those technologies and their application, the supply chain has tended to be pretty unstable," he said. "So, one of the things that Prada has really helped us with is bringing stability to that base, especially on the fabric side...."

Not surprisingly, Prada also contributed to the appearance of the suit. "One of the things that was important to us was the appeal of the suit, the look of the suit," Ralston said. "Something that Prada brought to the table was helping with the general aesthetic of the suit." One design aspect that brought the two companies together was a prominent red stripe on the suit. Ralston noted that was a nod to a NASA tradition where the mission commander's suit would have that red stripe to distinguish them from another spacewalker...

While the current focus of the suit is for walking on the moon, Ralston said the suit can be easily adapted for applications in low Earth orbit, such as spacewalks from the International Space Station or Axiom's future commercial space station.
The article adds that 30 people worked on the suit (full- or part-time). "These suits will give the astronauts increased range of motion and flexibility to explore more of the landscape than on previous lunar missions," according to NASA.

With "the ability to send high quality images and video to the ground with advanced communication technology, they will be sharing a unique new human experience with the world."

Thanks to long-time Slashdot reader schwit1 for sharing the news.

A post shared Saturday on social media acknowledges those admins and developers at the Internet Archive working "literally round the clock... They have taken no days off this past week. They are taking none this weekend... they are working with all of their energy and considerable talent."

It describes people "working so incredibly hard... putting their all in," with a top priority of "getting the site back secure and safe".

But there's new and continuing problems, reports The Verge's weekend editor: Early this morning, I received an email from "The Internet Archive Team," replying to a message I'd sent on October 9th. Except its author doesn't seem to have been the digital archivists' support team — it was apparently written by the hackers who breached the site earlier this month and who evidently maintain some level of access to its systems.

I'm not alone. Users on the Internet Archive subreddit are reporting getting the replies, as well. Here is the message I received:

It's dispiriting to see that even after being made aware of the breach 2 weeks ago, IA has still not done the due diligence of rotating many of the API keys that were exposed in their gitlab secrets.

As demonstrated by this message, this includes a Zendesk token with perms to access 800K+ support tickets sent to info@archive.org since 2018.

Whether you were trying to ask a general question, or requesting the removal of your site from the Wayback Machine — your data is now in the hands of some random guy. If not me, it'd be someone else.
The site BleepingComputer believes they know the larger context, starting with the fact that they've also "received numerous messages from people who received replies to their old Internet Archive removal requests... The email headers in these emails also pass all DKIM, DMARC, and SPF authentication checks, proving they were sent by an authorized Zendesk server."

BleepingComputer also writes that they'd "repeatedly tried to warn the Internet Archive that their source code was stolen through a GitLab authentication token that was exposed online for almost two years."

And that "the threat actor behind the actual data breach, who contacted BleepingComputer through an intermediary to claim credit for the attack," has been frustrated by misreporting. (Specifically, they insist there were two separate attacks last week — a DDoS attack and a separate data breach for a 6.4-gigabyte database which includes email addresses for the site's 33 million users.) The threat actor told BleepingComputer that the initial breach of Internet Archive started with them finding an exposed GitLab configuration file on one of the organization's development servers, services-hls.dev.archive.org. BleepingComputer was able to confirm that this token has been exposed since at least December 2022, with it rotating multiple times since then. The threat actor says this GitLab configuration file contained an authentication token allowing them to download the Internet Archive source code. The hacker say that this source code contained additional credentials and authentication tokens, including the credentials to Internet Archive's database management system. This allowed the threat actor to download the organization's user database, further source code, and modify the site.

The threat actor claimed to have stolen 7TB of data from the Internet Archive but would not share any samples as proof. However, now we know that the stolen data also included the API access tokens for Internet Archive's Zendesk support system. BleepingComputer attempted contact the Internet Archive numerous times, as recently as on Friday, offering to share what we knew about how the breach occurred and why it was done, but we never received a response.
"The Internet Archive was not breached for political or monetary reasons," they conclude, "but simply because the threat actor could...

"While no one has publicly claimed this breach, BleepingComputer was told it was done while the threat actor was in a group chat with others, with many receiving some of the stolen data. This database is now likely being traded amongst other people in the data breach community, and we will likely see it leaked for free in the future on hacking forums like Breached."

That massive geothermal energy project in Utah gets a closer look from the Washington Post, which calls it "a significant advance for a climate-friendly technology that is gaining momentum in the United States." Once fully operational, the project could generate up to 2 gigawatts of electricity — enough to power more than 2 million homes. In addition, the BLM proposed Thursday to speed up the permitting process for geothermal projects on public lands across the country. Earlier this month, the agency also hosted the biggest lease sale for geothermal developers in more than 15 years...

White House national climate adviser Ali Zaidi said in an interview Thursday, "Enhanced geothermal technology has the opportunity to deliver something in the range of 65 million homes' worth of clean power — power that can be generated without putting any pollution in the sky. So we see it as a really meaningful contributor to our technology tool kit...."

The developments Thursday come as tech companies race to find new sources of zero-emission power for data centers that can use as much energy as entire cities. With major backing from Google parent Alphabet, Fervo recently got its first project up and running in the northern Nevada desert... The advanced geothermal technology that Fervo is trying to scale up is an attractive option for tech firms. Enhanced geothermal plants do not pose all the safety concerns that come with nuclear power, but they have the potential to provide the round-the-clock energy that data centers need. The challenge Fervo faces is whether it can bring this technology online quickly enough.
Fervo (a seven-year-old start-up) was co-founded by Tim Latimer, who previously worked as a drilling engineer, according to the article. But "Early in my career I got passionate about climate change. I started looking at where could a drilling engineer from the oil and gas industry make a difference," Latimer said during a Washington Post Live event in September. "And I realized that geothermal had been so overlooked ... even though the primary technical challenge to making geothermal work is dropping drilling costs."

Libreboot is a distribution of coreboot "aimed at replacing the proprietary BIOS firmware contained by most computers."

So then what exactly is GNU Boot? Its home page explains... In November 2022, Libreboot began to include non-libre code. We have made repeated efforts to continue collaboration with those developers to help their version of Libreboot remain libre, but that was not successful. Now we've stepped forward to stand up for freedom, ours and that of the wider community, by maintaining our own version — a genuinely libre Libreboot, that after some hurdles gave birth to this project: GNU Boot.
But today, Phoronix writes: While priding itself on being "100% free", last December [GNU Boot] had to drop some motherboard support and CPU code after discovering they were shipping some files that are non-free by their free software standards. Today they announced another mistake in having inadvertently been shipping additional non-free code.

GNU Boot discovered an issue with non-free code affecting not only them but also some of the Linux distributions that pride themselves on being fully free software / 100% open-source. This latest snafu they say is "more problematic" than their prior non-free code discover due to impacting the free software Linux distributions too. The issue at hand though comes down to test data contained within the archive and that containing non-free code in the form of microcode, BIOS bits, and Intel Management Engine firmware.
"We also contacted Replicant..." according to the announcement, "a free Android distro that also ships vboot source code." And in addition, "We had to re-release all the affected tarballs." (Which at this point is three release candidates...)

Neal Stephenson is a sci-fi writer "of exuberant prose who revels in embracing big ideas," according to the New York Times. "With Polostan he enters the realm of the spy novel..."

Or, as the Washington Post puts it, Stephenson "drops readers into a bloody, inspiring, conflict-ridden and pivotal period of the early 20th century." With its flair for characterization, precision of language, witty apercus and fecundity of events, the novel delivers what we've come to cherish from the author of such fantastical classics as "The Diamond Age," "Snow Crash" and "Cryptonomicon."

But the book is also utterly unlike the majority of Stephenson's work. For one thing, it's short — a far cry from the maximalist "systems novels" that cram in entire worlds with complex interacting power structures, both explicit and hidden. "Polostan" is also devoid of fantastical elements and farcical "hysterical realism," which comes as a bit of a shock given that this is the writer who invented Mafia pizza-delivery guys and cybernetic children's primers. The structure of the book is, likewise, unusually straightforward: a mainly linear narrative dispersed along two timelines...

These observations aren't quibbles so much as alerts to the reader that this is new territory for Stephenson — and good for him! Though, because Polostan is the first novel in a planned historical series titled Bomb Light, which aims to capture the excitement and intrigue of the nuclear arms race, we cannot rule out any Stephenson freakiness down the line... Assuming the subsequent books are as good as this one, Stephenson might end up with a series that rivals Michael Moorcock's Pyat Quartet and Edward Whittemore's Jerusalem Quartet as a vivid and canny dissection of a century unlike any other.
"Much of the next volume is already written," Stephenson says on Substack, calling it "a project that has been in the works for over ten years". (He also notes that among his novels, "even the stuff that's branded as science fiction tends to contain a lot of history.")

Meanwhile in August, Stephenson's blockchain-tech startup Lamina1 announced a collaboration with special effects company Weta Workshop (from "The Lord of the Rings" film franchise) on a "participatory worldbuilding" experience. Variety reports: The experience is expected to offer "a new blueprint for IP expansion through immersive experiences that incorporate fan action and input."

Per Lamina1's description for the project, "Stephenson and the Weta team will begin engaging a global community of creators and fans on the Lamina1 platform this fall, inviting them to unravel the lore behind a mysterious set of 'Artefacts' that will build upon the themes and lore from Stephenson's critically-acclaimed catalog of work.

Next, the superfan will take on the new role of creator, utilizing their discoveries to contribute directly to the expansion of the universe."

"Artefact" will serve as the flagship project in the Lamina1-Weta partnership and first major multimedia property launching on Lamina1's blockchain infrastructure and tooling.
Neal Stephenson answered questions from Slashdot's readers in 2004. Now to promote his new novel Polostan, Stephenson will be making several personal appearances this week:

• At the Wisconsin Book Festival in Madison (Sunday at noon)
• Chicago's Book Stall (Monday at 7 p.m.)
• A Cary, North Carolina Barnes & Noble (Tuesday at 6 p.m.)
• New York City's Strand (Wednesday at 7 p.m.)
• At the Midtown Scholar Bookstore in Harrisburg, Pennsylvania (Thursday at 7 p.m.)
• Ames, Iowa at Dog Eared Books (Sunday at 6 p.m.)