Graphics

Affinity Tempts Adobe Users with 6-Month Free Trial of Creative Suite (theverge.com) 39

Serif, the design software developer behind Affinity, has introduced a six-month free trial for its creative suite, offering Affinity Photo, Designer, and Publisher on Mac, Windows PC, and iPad. This move, along with a 50% discount on perpetual licenses, aims to attract Adobe users and reassure them of Affinity's commitment to its one-time purchase pricing model despite its recent acquisition by Canva. The Verge reports: Affinity uses a one-time purchase pricing model that has earned it a loyal fanbase among creatives who are sick of paying for recurring subscriptions. Prices start at $69.99 for Affinity's individual desktop apps or $164.99 for the entire suite, with a separate deal currently offering customers 50 percent off all perpetual licenses.

This discount, alongside the six-month free trial, is potentially geared at soothing concerns that Affinity would change its pricing model after being acquired by Canva earlier this year. "We're saying 'try everything and pay nothing' because we understand making a change can be a big step, particularly for busy professionals," said Affinity CEO Ashley Hewson. "Anyone who takes the trial is under absolutely no obligation to buy."

HP

HP Discontinues Online-Only LaserJet Printers Amid Backlash - Instant Ink Subscription Gets the Boot, Too (tomshardware.com) 51

An anonymous reader writes: Per a report from DruckerChannel, HP has finally been forced to discontinue its cheaper e-series LaserJet printers due to customers experiencing problems with their online-only and always tied to HP+ subscription requirements. Among other things, HP+ requires a permanent Internet connection, and customers only use HP-original ink and toners, not allowing for third-party alternatives to be used at all. There are benefits to HP+, including cloud printing and an extra year's warranty, but the forced online requirement for a cheaper printer left a bad taste in the mouths of many consumers.

In any case, it's important to clarify that this discontinuation of HP printers will only impact HP LaserJet printers that have an "e" added to the end of their model name to denote the alternative business model. So, the HP Laserjet M110w is unaffected by this, but the HP LaserJet M110we and M209dwe, two cheaper always-online alternatives, will no longer be produced or sold by HP. Another critical point of clarification is that the existing HP e-series LaserJet printer models in the wild will still function exactly as they did when they were purchased. No software updates are forthcoming to unlock the true potential of the hardware, so existing customers will have to deal with it and HP+ until they can replace their printers entirely. At least they'll still get HP+ benefits, but after such backlash, it'd be nice if HP acknowledged its mistake enough to remove some of the restrictions on e-series printer users.

Microsoft

Microsoft's Notepad Gets Spellcheck and Autocorrect 40 Years After Launch (theverge.com) 72

An anonymous reader shares a report: Microsoft is finally rolling out spellcheck and autocorrect for its Notepad app in Windows 11, more than 40 years after the simple text editor was first introduced in Windows in 1983. The software giant started testing both features in March, and has now quietly started enabling them for all Windows 11 users in recent days. The spellcheck feature in Notepad is almost identical to how Word or Edge highlight misspelled words, with a red underline to clearly show mistakes.
Open Source

FreeBSD Contributor Mocks Gloomy Predictions for the Open Source Movement (acm.org) 94

In Communications of the ACM, long-time FreeBSD contributor Poul-Henning Kamp mocks the idea that the free and open-source software movement has "come apart" and "will end in tears and regret." Economists and others focused on money — like my bank — have had a lot of trouble figuring out the free and open source software (FOSS) phenomenon, and eventually they seem to have reached the conclusion that it just makes no sense. So, they go with the flow. Recently, very serious people in the FOSS movement have started to write long and thoughtful opinion pieces about how it has all come apart and will end in tears and regret. Allow me to disagree...
What follows is a humorous history of how the Open Source movement bested a series of ill-conceived marketing failures starting after the "utterly bad" 1980s when IBM had an "unimaginably huge monopoly" — and an era of vendor lock-in from companies trying to be the next IBM: Out of that utter market failure came Minix, (Net/Free/Open)BSD, and Linux, at a median year of approximately 1991. I can absolutely guarantee that if we had been able to buy a reasonably priced and solid Unix for our 32-bit PCs — no strings attached — nobody would be running FreeBSD or Linux today, except possibly as an obscure hobby. Bill Gates would also have had a lot less of our money...
The essay moves on to when "that dot-com thing happened, fueled by the availability of FOSS operating systems, which did a much better job than any operating system you could buy — not just for the price, but in absolute terms of performance on any given piece of hardware. Thus, out of utter market failure, the FOSS movement was born."

And ultimately, the essay ends with our present day, and the phenomenon of companies that "make a business out of FOSS or derivatives thereof..." The "F" in FOSS was never silent. In retrospect, it seems clear that open source was not so much the goal itself as a means to an end, which is freedom: freedom to fix broken things, freedom from people who thought they could clutch the source code tightly and wield our ignorance of it as a weapon to force us all to pay for and run Windows Vista. But the FOSS movement has won what it wanted, and no matter how much oldsters dream about their glorious days as young revolutionaries, it is not coming back; the frustrations and anger of IT in 2024 are entirely different from those of 1991.

One very big difference is that more people have realized that source code is a liability rather than an asset. For some, that realization came creeping along the path from young teenage FOSS activists in the late 1990s to CIOs of BigCorp today. For most of us, I expect, it was the increasingly crushing workload of maintaining legacy code bases...

AI

Microsoft's AI CEO: Web Content (Without a Robots.txt File) is 'Freeware' for AI Training (windowscentral.com) 136

Slashdot reader joshuark shared this report from Windows Central Microsoft may have opened a can of worms with recent comments made by the tech giant's CEO of AI Mustafa Suleyman. The CEO spoke with CNBC's Andrew Ross Sorkin at the Aspen Ideas Festival earlier this week. In his remarks, Suleyman claimed that all content shared on the web is available to be used for AI training unless a content producer says otherwise specifically.
The whole discussion was interesting — but this particular question was very direct. CNBC's interviewer specifically said, "There are a number of authors here... and a number of journalists as well. And it appears that a lot of the information that has been trained on over the years has come from the web — and some of it's the open web, and some of it's not, and we've heard stories about how OpenAI was turning YouTube videos into transcripts and then training on the transcripts."

The question becomes "Who is supposed to own the IP, who is supposed to get value from the IP, and whether, to put it in very blunt terms, whether the AI companies have effectively stolen the world's IP." Suleyman begins his answer — at the 14:40 mark — with "Yeah, I think — look, it's a very fair argument." SULEYMAN: "I think that with respect to content that is already on the open web, the social contract of that content since the 90s has been that it is fair use. Anyone can copy it, recreate with it, reproduce with it. That has been freeware, if you like. That's been the understanding.

"There's a separate category where a website or a publisher or a news organization had explicitly said, 'Do not scrape or crawl me for any other reason than indexing me so that other people can find that content.' That's a gray area and I think that's going to work its way through the courts."


Q: And what does that mean, when you say 'It's a gray area'?

SULEYMAN: "Well, if — so far, some people have taken that information... but that's going to get litigated, and I think that's rightly so...

"You know, look, the economics of information are about to radically change, because we're going to reduce the cost of production of knowledge to zero marginal cost. And this is just a very difficult thing for people to intuit — but in 15 or 20 years time, we will be producing new scientific cultural knowledge at almost zero marginal cost. It will be widely open sourced and available to everybody. And I think that is going to be, you know, a true inflection point in the history of our species. Because what are we, collectively, as an organism of humans, other than an intellectual production engine. We produce knowledge. Our science makes us better. And so what we really want in the world, in my opinion, are new engines that can turbocharge discovery and invention."

AI

'How Good Is ChatGPT at Coding, Really?' (ieee.org) 135

IEEE Spectrum (the IEEE's official publication) asks the question. "How does an AI code generator compare to a human programmer?" A study published in the June issue of IEEE Transactions on Software Engineering evaluated the code produced by OpenAI's ChatGPT in terms of functionality, complexity and security. The results show that ChatGPT has an extremely broad range of success when it comes to producing functional code — with a success rate ranging from anywhere as poor as 0.66 percent and as good as 89 percent — depending on the difficulty of the task, the programming language, and a number of other factors. While in some cases the AI generator could produce better code than humans, the analysis also reveals some security concerns with AI-generated code.
The study tested GPT-3.5 on 728 coding problems from the LeetCode testing platform — and in five programming languages: C, C++, Java, JavaScript, and Python. The results? Overall, ChatGPT was fairly good at solving problems in the different coding languages — but especially when attempting to solve coding problems that existed on LeetCode before 2021. For instance, it was able to produce functional code for easy, medium, and hard problems with success rates of about 89, 71, and 40 percent, respectively. "However, when it comes to the algorithm problems after 2021, ChatGPT's ability to generate functionally correct code is affected. It sometimes fails to understand the meaning of questions, even for easy level problems," said Yutian Tang, a lecturer at the University of Glasgow. For example, ChatGPT's ability to produce functional code for "easy" coding problems dropped from 89 percent to 52 percent after 2021. And its ability to generate functional code for "hard" problems dropped from 40 percent to 0.66 percent after this time as well...

The researchers also explored the ability of ChatGPT to fix its own coding errors after receiving feedback from LeetCode. They randomly selected 50 coding scenarios where ChatGPT initially generated incorrect coding, either because it didn't understand the content or problem at hand. While ChatGPT was good at fixing compiling errors, it generally was not good at correcting its own mistakes... The researchers also found that ChatGPT-generated code did have a fair amount of vulnerabilities, such as a missing null test, but many of these were easily fixable.

"Interestingly, ChatGPT is able to generate code with smaller runtime and memory overheads than at least 50 percent of human solutions to the same LeetCode problems..."
Businesses

Investors Pour $27.1 Billion into AI Startups, Defying a Downturn (msn.com) 17

"For two years, many unprofitable tech startups have cut costs, sold themselves or gone out of business," reports the New York Times.

"But the ones focused on artificial intelligence have been thriving." Now, the AI boom that started in late 2022, has become the strongest counterpoint to the broader startup downturn. Investors poured $27.1 billion into AI startups in the United States from April to June, accounting for nearly half of all U.S. startup funding in that period, according to PitchBook, which tracks startups. In total, U.S. startups raised $56 billion, up 57% from a year earlier and the highest three-month haul in two years. AI companies are attracting huge rounds of funding reminiscent of 2021, when low interest rates pushed investors away from taking risks on tech investments...

The startup downturn began in early 2022 as many money-losing companies struggled to grow as quickly as they did in the pandemic. Rising interest rates also pushed investors to chase less risky investments. To make up for dwindling funding, startups slashed staff and scaled back their ambitions. Then in late 2022, OpenAI, a San Francisco AI lab, kicked off a new boom with the release of its ChatGPT chatbot. Excitement around generative AI technology, which can produce text, images and videos, set off a frenzy of startup creation and funding. "Sam Altman canceled the recession," joked Siqi Chen, founder of the startup Runway Financial, referring to OpenAI's chief executive. Chen said his company, which makes finance software, was growing faster than it otherwise would have because "AI can do the job of 1.5 people...."

An analysis of 125 AI startups by Kruze Consulting, an accounting and tax advisory firm, showed that the companies spent an average of 22% of their expenses on computing costs in the first three months of the year — more than double the 10% spent by non-AI software companies in the same period. "No wonder VCs are throwing money into these companies," said Healy Jones, Kruze's vice president of financial strategy. While AI startups are growing faster than other startups, he said, "they clearly need the money."

Startups receiving funding include CoreWeave ($1.1 billion), ScaleAI ($1 billion), and the Elon Musk-founded xAI ($6 billion), according to the article.

"For investors who back fast-growing startups, there is little downside to being wrong about the next big thing, but there is enormous upside in being right. AI's potential has generated deafening hype, with prominent investors and executives predicting that the market for AI will be bigger than the markets for the smartphone, the personal computer, social media and the internet."
Microsoft

Christie's Likens Microsoft's Work On MS-DOS To Einstein's Work In Physics 110

Longtime Slashdot reader theodp writes: "If Einstein paved the way for a new era in physics," explains auction house Christie's in a promotion piece for its upcoming offering of 150+ "objects of scientific and historical importance" from the Paul G. Allen Collection (including items from the shuttered Living Computers Museum), "Mr. Allen and his collaborators ushered in a new era of computing. Starting with MS-DOS in 1981, Microsoft then went on to revolutionize personal computing with the launch of Windows in 1985."

Christie's auction and characterization of MS-DOS as an Allen and Microsoft innovation comes 30 years after the death of Gary Kildall, whose unpublished memoir, the Seattle Times reported in Kildall's July 1994 obituary, called DOS "plain and simple theft" of Kildall's CP/M OS. PC Magazine's The Rise of DOS: How Microsoft Got the IBM PC OS Contract notes that Paul Allen himself traced the genesis of MS-DOS back to a phone call Allen made to Seattle Computer Products owner Rod Brock in which Microsoft licensed Tim Paterson's CP/M-inspired QDOS (Quick and Dirty Operating System) for $10,000 plus a royalty of $15,000 for every company that licensed the software. A shrewd buy-low-sell-high business deal, yes, but hardly an Einstein-caliber breakthrough idea.
The Internet

Cloudflare Rolls Out Feature For Blocking AI Companies' Web Scrapers (siliconangle.com) 40

Cloudflare today unveiled a new feature part of its content delivery network (CDN) that prevents AI developers from scraping content on the web. According to Cloudflare, the feature is available for both the free and paid tiers of its service. SiliconANGLE reports: The feature uses AI to detect automated content extraction attempts. According to Cloudflare, its software can spot bots that scrape content for LLM training projects even when they attempt to avoid detection. "Sadly, we've observed bot operators attempt to appear as though they are a real browser by using a spoofed user agent," Cloudflare engineers wrote in a blog post today. "We've monitored this activity over time, and we're proud to say that our global machine learning model has always recognized this activity as a bot."

One of the crawlers that Cloudflare managed to detect is a bot that collects content for Perplexity AI Inc., a well-funded search engine startup. Last month, Wired reported that the manner in which the bot scrapes websites makes its requests appear as regular user traffic. As a result, website operators have struggled to block Perplexity AI from using their content. Cloudflare assigns every website visit that its platform processes a score of 1 to 99. The lower the number, the greater the likelihood that the request was generated by a bot. According to the company, requests made by the bot that collects content for Perplexity AI consistently receive a score under 30.

"When bad actors attempt to crawl websites at scale, they generally use tools and frameworks that we are able to fingerprint," Cloudflare's engineers detailed. "For every fingerprint we see, we use Cloudflare's network, which sees over 57 million requests per second on average, to understand how much we should trust this fingerprint." Cloudflare will update the feature over time to address changes in AI scraping bots' technical fingerprints and the emergence of new crawlers. As part of the initiative, the company is rolling out a tool that will enable website operators to report any new bots they may encounter.

AI

MIT Robotics Pioneer Rodney Brooks On Generative AI 41

An anonymous reader quotes a report from TechCrunch: When Rodney Brooks talks about robotics and artificial intelligence, you should listen. Currently the Panasonic Professor of Robotics Emeritus at MIT, he also co-founded three key companies, including Rethink Robotics, iRobot and his current endeavor, Robust.ai. Brooks also ran the MIT Computer Science and Artificial Intelligence Laboratory (CSAIL) for a decade starting in 1997. In fact, he likes to make predictions about the future of AI and keeps a scorecard on his blog of how well he's doing. He knows what he's talking about, and he thinks maybe it's time to put the brakes on the screaming hype that is generative AI. Brooks thinks it's impressive technology, but maybe not quite as capable as many are suggesting. "I'm not saying LLMs are not important, but we have to be careful [with] how we evaluate them," he told TechCrunch.

He says the trouble with generative AI is that, while it's perfectly capable of performing a certain set of tasks, it can't do everything a human can, and humans tend to overestimate its capabilities. "When a human sees an AI system perform a task, they immediately generalize it to things that are similar and make an estimate of the competence of the AI system; not just the performance on that, but the competence around that," Brooks said. "And they're usually very over-optimistic, and that's because they use a model of a person's performance on a task." He added that the problem is that generative AI is not human or even human-like, and it's flawed to try and assign human capabilities to it. He says people see it as so capable they even want to use it for applications that don't make sense.

Brooks offers his latest company, Robust.ai, a warehouse robotics system, as an example of this. Someone suggested to him recently that it would be cool and efficient to tell his warehouse robots where to go by building an LLM for his system. In his estimation, however, this is not a reasonable use case for generative AI and would actually slow things down. It's instead much simpler to connect the robots to a stream of data coming from the warehouse management software. "When you have 10,000 orders that just came in that you have to ship in two hours, you have to optimize for that. Language is not gonna help; it's just going to slow things down," he said. "We have massive data processing and massive AI optimization techniques and planning. And that's how we get the orders completed fast."
"People say, 'Oh, the large language models are gonna make robots be able to do things they couldn't do.' That's not where the problem is. The problem with being able to do stuff is about control theory and all sorts of other hardcore math optimization," he said.

"It's not useful in the warehouse to tell an individual robot to go out and get one thing for one order, but it may be useful for eldercare in homes for people to be able to say things to the robots," he said.
Communications

Two of the German Military's New Spy Satellites Appear To Have Failed In Orbit (arstechnica.com) 34

Ars Technica's Eric Berger writes: On the day before Christmas last year, a Falcon 9 rocket launched from California and put two spy satellites into low-Earth orbit for the armed forces of Germany, which are collectively called the Bundeswehr. Initially, the mission appeared successful. The German satellite manufacturer, OHB, declared that the two satellites were "safely in orbit." The addition of the two SARah satellites completed a next-generation constellation of three reconnaissance satellites, the company said. However, six months later, the two satellites have yet to become operational. According to the German publication Der Spiegel, the antennas on the satellites cannot be unfolded. Engineers with OHB have tried to resolve the issue by resetting the flight software, performing maneuvers to vibrate or shake the antennas loose, and more to no avail. As a result, last week, German lawmakers were informed that the two new satellites will probably not go into operation as planned.

The three-satellite constellation known as SARah -- the SAR is a reference to the synthetic aperture radar capability of the satellites -- was ordered in 2013 at a cost of $800 million. The first of the three satellites, SARah 1, launched in June 2022 on a Falcon 9 rocket. This satellite was built by Airbus in southern Germany, and it has since gone into operation without any problems. The two smaller satellites built by OHB, flying with passive synthetic aperture radar reflectors, were intended to complement the SARah 1 satellite, which carries an active phased-array radar antenna. [...] According to the Der Spiegel report, the Bundeswehr says the two SARah satellites built by OHB remain the property of the German company and would only be turned over to the military once they were operational. As a result, the military says OHB will be responsible for building two replacement satellites. Shockingly, the German publication says that its sources indicated OBH did not fully test the functionality and deployment of the satellite antennas on the ground. This could not be confirmed.

Software

Bruce Bastian, WordPerfect Co-Creator, Dies At 76 (wsj.com) 56

Longtime Slashdot reader regoli shares an obituary from the Wall Street Journal: When Alan Ashton was a computer-science professor at Brigham Young University in the mid-1970s, the director of the school's marching band knocked on his door and said he wanted to use a computer to choreograph the band's halftime shows. Ashton was easily persuaded; he was a trumpet player whose Ph.D. dissertation at the University of Utah was "Electronics, music and computers." Bruce Bastian, the graduate student who was working as BYU's marching-band director, turned out to be a quick learner. "He was very conscientious, very thorough," Ashton said in an interview, "and just absolutely brilliant." Within a few years, the two were at work on a program that would turn them into two of the richest people in the nation, founders of the company that made WordPerfect, the dominant word-processing software in the 1980s and early '90s and one of the first pieces of software many Americans bought when they brought home their first PCs.

But behind the hundreds of millions of dollars and blockbuster success, Bastian's personal life, he later said, was in "free fall." Between the time he and Ashton released what would later be known as WordPerfect to the public in 1980 and when they sold the company for $1.4 billion in 1994, Bastian told his wife, four sons and his Mormon community that he was gay and leaving both his marriage and the church. When he died, June 16, at the age of 76 from complications associated with pulmonary fibrosis, he had been living a different life: A longtime advocate for LGBTQ rights, Bastian was married to a man, and had found a way to maintain relationships with his family, who remained dedicated members of the church that rejected his sexual orientation. "I kind of have three parts of my life," he said in 2010 during one of several extensive interviews he gave to the Mormon Stories podcast, "the pre-WordPerfect life, the WordPerfect years, and now the LGBT years."
Other publications remembering Bruce Bastian include: The New York Times, The Salt Lake Tribune, University of Utah, and Human Rights Campaign.
Security

Despite OS Shielding Up, Half of America Opts For Third-Party Antivirus (theregister.com) 76

Nearly half of Americans are using third-party antivirus software and the rest are either using the default protection in their operating system -- or none at all. From a report: In all, 46 percent of almost 1,000 US citizens surveyed by the reviews site Security.org said they used third-party antivirus on their computers, with 49 percent on their PCs, 18 percent using it on their tablets, and 17 percent on their phones. Of those who solely rely on their operating system's built-in security -- such as Microsoft's Windows Defender, Apple's XProtect, and Android's Google Play -- 12 percent are planning to switch to third-party software in the next six months.

Of those who do look outside the OS, 54 percent of people pay for the security software, 43 percent choose the stripped-down free version, and worryingly, three percent aren't sure whether they pay or not. Among paying users, the most popular brands were Norton, McAfee, and Malwarebytes, while free users preferred -- in order -- McAfee, Avast, and Malwarebytes. The overwhelming reason for purchasing, cited by 84 percent of respondents, was, of course, fear of malware. The next most common reasons were privacy, at 54 percent, and worries over online shopping, at 48 percent. Fear of losing cryptocurrency stashes from wallets was at eight percent, doubled since last year's survey.

IT

Figma Disables AI Design Tool That Copied Apple Weather App (techcrunch.com) 28

Design startup Figma is temporarily disabling its "Make Design" AI feature that was said to be ripping off the designs of Apple's own Weather app. TechCrunch: The problem was first spotted by Andy Allen, the founder of NotBoring Software, which makes a suite of apps that includes a popular, skinnable Weather app and other utilities. He found by testing Figma's tool that it would repeatedly reproduce Apple's Weather app when used as a design aid. John Gruber, writing at DaringFireball: This is even more disgraceful than a human rip-off. Figma knows what they trained this thing on, and they know what it outputs. In the case of this utter, shameless, abject rip-off of Apple Weather, they're even copying Weather's semi-inscrutable (semi-scrutable?) daily temperature range bars.

"AI" didn't do this. Figma did this. And they're handing this feature to designers who trust Figma and are the ones who are going to be on the hook when they present a design that, unbeknownst to them, is a blatant rip-off of some existing app.

Security

10-Year-Old Open Source Flaw Could Affect 'Almost Every Apple Device' (thecyberexpress.com) 23

storagedude shares a report from the Cyber Express: Some of the most widely used web and social media applications could be vulnerable to three newly discovered CocoaPods vulnerabilities -- including potentially millions of Apple devices, according to a report by The Cyber Express, the news service of threat intelligence vendor Cyble Inc. E.V.A Information Security researchers reported three vulnerabilities in the open source CocoaPods dependency manager that could allow malicious actors to take over thousands of unclaimed pods and insert malicious code into many of the most popular iOS and MacOS applications, potentially affecting "almost every Apple device." The researchers found vulnerable code in applications provided by Meta (Facebook, Whatsapp), Apple (Safari, AppleTV, Xcode), and Microsoft (Teams); as well as in TikTok, Snapchat, Amazon, LinkedIn, Netflix, Okta, Yahoo, Zynga, and many more.

The vulnerabilities have been patched, yet the researchers still found 685 Pods "that had an explicit dependency using an orphaned Pod; doubtless there are hundreds or thousands more in proprietary codebases." The newly discovered vulnerabilities -- one of which (CVE-2024-38366) received a 10 out of 10 criticality score -- actually date from a May 2014 CocoaPods migration to a new 'Trunk' server, which left 1,866 orphaned pods that owners never reclaimed. While the vulnerabilities have been patched, the work for developers and DevOps teams that used CocoaPods before October 2023 is just getting started. "Developers and DevOps teams that have used CocoaPods in recent years should verify the integrity of open source dependencies used in their application code," the E.V.A researchers said. "The vulnerabilities we discovered could be used to control the dependency manager itself, and any published package." [...] "Dependency managers are an often-overlooked aspect of software supply chain security," the researchers wrote. "Security leaders should explore ways to increase governance and oversight over the use these tools."
"While there is no direct evidence of any of these vulnerabilities being exploited in the wild, evidence of absence is not absence of evidence." the EVA researchers wrote. "Potential code changes could affect millions of Apple devices around the world across iPhone, Mac, AppleTV, and AppleWatch devices."

While no action is required by app developers or users, the EVA researchers recommend several ways to protect against these vulnerabilities. To ensure secure and consistent use of CocoaPods, synchronize the podfile.lock file with all developers, perform CRC validation for internally developed Pods, and conduct thorough security reviews of third-party code and dependencies. Furthermore, regularly review and verify the maintenance status and ownership of CocoaPods dependencies, perform periodic security scans, and be cautious of widely used dependencies as potential attack targets.
Open Source

FreeDOS Founder Jim Hall: After 30 Years, What I've Learned About Open Source Community (opensource.net) 39

In 1994, college student Jim Hall created FreeDOS (in response to Microsoft's plan to gradually phase out MS-DOS). After celebrating its 30th anniversary last week, Hill wrote a new article Saturday for OpenSource.net: "What I've learned about Open Source community over 30 years."

Lessons include "every Open Source project needs a website," but also "consider other ways to raise awareness about your Open Source software project." ("In the FreeDOS Project, we've found that posting videos to our YouTube channel is an excellent way to help people learn about FreeDOS... The more information you can share about your Open Source project, the more people will find it familiar and want to try it out.")

But the larger lesson is that "Open Source projects must be grounded in community." Without open doors for new ideas and ongoing development, even the most well-intentioned project becomes a stagnant echo chamber...

Maintain open lines of communication... This can take many forms, including an email list, discussion board, or some other discussion forum. Other forums where people can ask more general "Help me" questions are okay but try to keep all discussions about project development on your official discussion channel.

The last of its seven points stresses that "An Open Source project isn't really Open Source without source code that everyone can download, study, use, modify and share" (urging careful selection for your project's licensing). But the first point emphasizes that "It's more than just code," and Hall ends his article by attributing FreeDOS's three-decade run to "the great developers and users in our community." In celebrating FreeDOS, we are celebrating everyone who has created programs, fixed bugs, added features, translated messages, written documentation, shared articles, or contributed in some other way to the FreeDOS Project... Here's looking forward to more years to come!
Jim Hall is also Slashdot reader #2,985, and back in 2000 he answered questions from Slashdot's readers — just six years after starting the project. "Jim isn't rich or famous," wrote RobLimo, "just an old-fashioned open source contributor who helped start a humble but useful project back in 1994 and still works on it as much as he can."

As the years piled up, Slashdot ran posts celebrating FreeDOS's 10th, 15th, and 20th anniversary.

And then for FreeDOS's 25th, Hall returned to Slashdot to answer more questions from Slashdot readers...
Bitcoin

Linux Foundation Announces Intent to Form LF Decentralized Trust (linuxfoundation.org) 9

This week the Linux Foundation announced a new organization for decentralized systems and technologies, with an aim of "fostering innovation and collaboration" in both their development and deployment.

It will build on existing Linux Foundation blockchain and digital identity projects, according to the announcement, while supporting "a rapidly growing decentralized technology landscape." To foster this broader ecosystem, LF Decentralized Trust will encompass the growing portfolio of Hyperledger projects and host new open source software, communities, standards, and specifications that are critical to the macro shift toward decentralized systems of distributed trust....

LF Decentralized Trust's expanded project and member ecosystem will be both essential to emerging tokenized assets classes and networks, as well as to modernizing the core infrastructure for finance, trade, government, healthcare, and more. LF Decentralized Trust will serve as a neutral home for the open development of a broad range of ledger, identity, security, interoperability, scale, implementation, and related technologies... LF Decentralized Trust will also include new directed funding models that will drive strategic investments by members into individual projects and project resources.

"With LF Decentralized Trust, we're expanding our commitment to open source innovation by embracing a wider array of decentralized technologies," said Jim Zemlin, Executive Director of the Linux Foundation. "This new, elevated foundation will enable the community to build a more robust ecosystem that drives forward transparency, security, and efficiency in global infrastructure."

"After eight years of advancing the development of blockchain, decentralized identity and related technologies via the Hyperledger community, the time has come to broaden our effort and impact," said Daniela Barbosa, General Manager, Blockchain and Identity, the Linux Foundation. "Ledgers and ledger technologies are but one component of the decentralized systems that will underpin a digital-first global economy. LF Decentralized Trust is where we will gather and grow an expanded community and portfolio of technologies to deliver the transparency, reliability, security and efficiency needed to successfully upgrade critical systems around the world."

The announcement includes quotes of support from numerous companies including Oracle, Siemens, Visa, Accenture, Citi, and Hitachi. Some highlights:
  • "The formation of the LF Decentralized Trust reflects the growing demand for open source resources that are critical to the management and functionality of decentralized systems." — CEO of Digital Asset
  • "The adoption of decentralized infrastructure is at an inflection point, reflecting the increasing demand from both enterprises and consumers for more secure and transparent digital transactions. As the industry leader for onchain data, blockchain abstraction, and interoperability, we're excited to see the formation of the LF Decentralized Trust and to expand our collaboration with leading financial institutions on advancing tokenized assets and the onchain economy at large." — CMO at Chainlink Labs.
  • "As a founding member of the Hyperledger Foundation, and given our unique position in the financial markets, we recognize the vast potential for open-source innovation and decentralized technologies when it comes to reducing risk, increasing resiliency and improving security. The expansion of Hyperledger Foundation into LF Decentralized Trust represents an exciting opportunity to continue expanding these groundbreaking technologies." — a managing director at DTCC

The Courts

Lawsuit Claims Microsoft Tracked Sex Toy Shoppers With 'Recording In Real Time' Software (404media.co) 36

Samantha Cole reports via 404 Media: A woman is suing Microsoft and two major U.S. sex toy retailers with claims that their websites are tracking users without their consent, despite promising they wouldn't do that. In a complaint (PDF) filed on June 25 in the Northern District of California, San Francisco resident Stella Tatola claims that Babeland and Good Vibrations -- both owned by Barnaby Ltd., LLC -- allowed Microsoft to see what visitors to their websites searched for and bought.

"Unbeknownst to Plaintiff and other Barnaby website users, and constituting the ultimate violation of privacy, Barnaby allows an undisclosed third-party, Microsoft, to intercept, read, and utilize for commercial gain consumers' private information about their sexual practices and preferences, gleaned from their activity on Barnaby's websites," the complaint states. "This information includes but is not limited to product searches and purchase initiations, as well as the consumer's unique Microsoft identifier." The complaint claims that Good Vibrations and Babeland sites have installed trackers using Microsoft's Clarity software, which does "recording in real time," and tracks users' mouse movements, clicks or taps, scrolls, and site navigation. Microsoft says on the Clarity site that it "processes a massive amount of anonymous data around user behavior to gain insights and improve machine learning models that power many of our products and services."

"By allowing undisclosed third party Microsoft to eavesdrop and intercept users' PPSI in such a manner -- including their sexual orientation, preferences, and desires, among other highly sensitive, protected information -- Barnaby violates its Privacy Policies, which state it will never share such information with third parties," the complaint states. The complaint includes screenshots of code from the sexual health sites that claims to show them using Machine Unique Identifier ("MUID") cookies that "identifies unique web browsers visiting Microsoft sites," according to Microsoft, and are used for "advertising, site analytics, and other operational purposes." The complaint claims that this violates the California Invasion of Privacy Act, the Federal Wiretap Act, and Californians' reasonable expectation of privacy.

Transportation

Mechanic's Viral TikTok Highlights Right To Repair Issues With Newer Car Models (dailydot.com) 71

Parks Kugle reports via the Daily Dot: A mechanic went viral when he posted a TikTok about technicians being locked out of computer systems in a new Dodge Ram. TikTok user Shorty of Shorty's Speed Shop (@shortysspeedshop) garnered over 301,000 views when he showed viewers what mechanics had to do to be able to repair newer car models. "It has officially happened. 2024 Ram 3500, authorization denied," Shorty said as he showed viewers the computer screen. "Cannot get into anything on this except generic OBD2 Software."

Shorty went on to explain that this update made his "manufacturer software 100 percent irrelevant." Then, Shorty showed viewers the Vehicle Security Professional (VSP) Registry on the National Automaker Service Task Force (NASTF) website. According to NASTF, automakers require mechanics to become credentialed VSPs if they want to purchase key and immobilizer codes, PIN numbers, and special tool access from Automaker websites. A VSP is required to "verify proof of ownership/authority prior to performing any security operation." "It's all part of the NASTF Security Professional Registery," Shorty explained.

Shorty believes that this rule allows manufacturers to lock mechanics out of anything they "deem security sensitive." Shorty then broke down the "requirements to gain VSP access." According to him, these include a $325 fee "every two years" and a $100 fee for every subsequent two-year license renewal. He says mechanics also need "commercial liability insurance of $1 million" and a "fidelity or employee dishonesty bond of $100,000." The VSP application page on NASTF's website confirms that there is a $100 Application Fee that covers a "Two Year Renewal" and a $325 Primary Account fee that covers a "Two Year License." It also confirms his claims about the required commercial liability insurance and fidelity or employee dishonesty bond. "There's a lot of people that don't know that this is going on, and it's going to affect everybody getting their cars fixed," Shorty remarked.

The Courts

SEC Sues ConsenSys (coindesk.com) 7

The SEC sued Ethereum software provider ConsenSys over its MetaMask service on Friday, alleging the wallet product was an unregistered broker that "engaged in the offer and sale of securities." From a report: MetaMask also offered an unregistered securities program through its staking service, the SEC alleged in a filing in the courthouse in the Eastern District of New York. The SEC alleged in its lawsuit that it offered staking services for Lido and Rocket Pool as investment contracts, meaning they are also unregistered securities. "Consensys has collected over $250 million in fees," the SEC alleged. You can read the full lawsuit here [PDF].

Slashdot Top Deals