×
Microsoft

Microsoft Won't Say If Its Products Were Exploited By Spyware Zero-Days (techcrunch.com) 13

Microsoft has released patches to fix zero-day vulnerabilities in two popular open source libraries that affect several Microsoft products, including Skype, Teams and its Edge browser. But Microsoft won't say if those zero-days were exploited to target its products, or if the company knows either way. From a report: The two vulnerabilities -- known as zero-days because developers had no advance notice to fix the bugs -- were discovered last month, and both bugs have been actively exploited to target individuals with spyware, according to researchers at Google and Citizen Lab. The bugs were discovered in two common open source libraries, webp and libvpx, which are widely integrated into browsers, apps and phones to process images and videos. The ubiquity of these libraries coupled with a warning from security researchers that the bugs were abused to plant spyware prompted a rush by tech companies, phone makers and app developers to update the vulnerable libraries in their products.

In a brief statement Monday, Microsoft said it had rolled out fixes addressing the two vulnerabilities in the webp and libvpx libraries which it had integrated into its products, and acknowledged that exploits exist for both vulnerabilities. When reached for comment, a Microsoft spokesperson declined to say if its products had been exploited in the wild, or if the company has the ability to know. Security researchers at Citizen Lab said in early September that they had discovered evidence that NSO Group customers, using the company's Pegasus spyware, had exploited a vulnerability found in the software of an up-to-date and fully patched iPhone.

Education

Tech-Backed Code.org Picks 'Creativity With AI' As Theme For 2023 Hour of Code 3

theodp writes: With Microsoft President Satya Nadella testifying in the Google antitrust trial that the tech titans are engaged in a Generative AI Gold Rush, it's no surprise to learn that tech giant-backed and advised nonprofit Code.org has chosen "Creativity with AI" as the theme for this December's Hour of Code, the annual global event that aims to whet K-12 schoolchildren's appetite for rigorous computer science.

"We're taking Hour of Code to new heights with 'Hour of Code: Creativity with AI'," explained Code.org. "Whether it's coding new apps and algorithms, generating unique art, or crafting choreography to get us dancing, AI is opening up fresh opportunities for digital expression that expand our understanding of creativity. What's new? Did you catch that reference to 'dancing'? That's right: Code.org's Dance Party [a 'CS lesson' developed in partnership with the 'childhood to career' Amazon Future Engineer program] will be better than ever this year! Coming soon, this Hour of Code activity will use generative AI to help students add awesome backgrounds and visuals to the dance parties they build with code."
Google

Apple Considered, Rejected Switch To DuckDuckGo From Google (bloomberg.com) 25

Apple held talks with DuckDuckGo to replace Alphabet's Google as the default search engine for the private mode on Apple's Safari browser, but ultimately rejected the idea. From a report: The details of those talks -- and Apple's discussions about buying Microsoft's Bing search engine in 2018 and 2020 -- were revealed late Wednesday in transcripts unsealed by the judge overseeing the US government's antitrust trial against Google. US District Judge Amit Mehta ruled Wednesday that he would unseal the testimony of DuckDuckGo Chief Executive Officer Gabriel Weinberg and Apple executive John Giannandrea, both of whom testified in the Washington trial in closed sessions. Weinberg testified that DuckDuckGo had about 20 meetings and phone calls with Apple executives, including the head of Safari, in 2018 and 2019 about becoming the default search engine for private browsing mode. In private mode, Safari doesn't track websites that a user visits or keep a history of what a person has accessed.

"We were talking about it, I thought they would launch it," Weinberg said, noting that Apple had integrated several of DuckDuckGo's other privacy technologies into Safari. "Multiple times we've gotten integrations all the way through the finish line. Really, almost everything we've pitched except for search." But Giannandrea, who joined Apple as the head of search in 2018, said that to his knowledge Apple hadn't considered switching to DuckDuckGo. In a February 2019 email to other Apple executives, Giannandrea said it was "probably a bad idea" to switch to DuckDuckGo for private browsing in Safari. "The motivating factor for setting DuckDuckGo as the default for private browsing was an assumption" that it would be more private, Giannandrea testified. Because DuckDuckGo relies on Bing for its search information, it also likely provides Microsoft some user information, he said, which led him to believe that DuckDuckGo's "marketing about privacy is somewhat incongruent with the details."

AI

Researchers Say Current AI Watermarks Are Trivial To Remove 9

Researchers from the University of Maryland (UMD) were able to easily evade the current methods of AI watermarking during testing and found it even easier to add fake emblems to images that weren't generated by AI. "But beyond testing how easy it is to evade watermarks, one UMD team notably developed a watermark that is near impossible to remove from content without completely compromising the intellectual property," reports Engadget. "This application makes it possible to detect when products are stolen." From the report: In a similar collaborative research effort (PDF) between the University of California, Santa Barbara and Carnegie Mellon University, researchers found that through simulated attacks, watermarks were easily removable. The paper discerns that there are two distinct methods for eliminating watermarks through these attacks: destructive and constructive approaches. When it comes to destructive attacks, the bad actors can treat watermarks like it's a part of the image. Tweaking things like the brightness, contrast or using JPEG compression, or even simply rotating an image can remove a watermark. However, the catch here is that while these methods do get rid of the watermark, they also mess with the image quality, making it noticeably worse. In a constructive attack, watermark removal is a bit more sensitive and uses techniques like the good old Gaussian blur.

Although watermarking AI-generated content needs to improve before it can successfully navigate simulated tests similar to those featured in these research studies, it's easy to envision a scenario where digital watermarking becomes a competitive race against hackers. Until a new standard is developed, we can only hope for the best when it comes to new tools like Google's SynthID, an identification tool for generative art, which will continue to get workshopped by developers until it hits the mainstream.
Further reading: Researchers Tested AI Watermarks -- and Broke All of Them
Google

Gmail Unleashes 'Email Emoji Reactions' Onto an Unsuspecting World (arstechnica.com) 35

An anonymous reader quotes a report from Ars Technica: You can now reply to an email just like it's an instant messaging chat, tacking on a "crying laughing" emoji to an email instead of replying. Google has a whole support article detailing the new feature, which allows you to "express yourself and quickly respond to emails with emojis." Like a messaging app, a row of emoji reaction counts will appear below your email now, and other people on the thread can tap to add to the reaction count. Currently, it's only on the Android Gmail app, but it's presumably coming to other Gmail clients.

Of course, email is from the 1970s and does not natively support emoji reactions. That makes this a Gmail-proprietary feature, which is a problem for federated emails that are expected to work with a million different clients and providers. If you send an emoji reaction and someone on the email chain is not using an official Gmail client, they will get a new, additional email containing your singular reactive emoji. Google is not messing with the email standard, so people not using Gmail will be the most affected.

Another weird quirk is that because emoji reactions are just emails (that Gmail sends to other clients and hides for itself), any emoji reactions you send can't be taken back. There's only Gmail's "Undo send" feature for taking back reactions, which delays sending emails for about 30 seconds, so you can second-guess yourself. After that, you're creating a permanent emoji reaction paper trail. [...] If the idea of emoji reactions to email has you selecting the puke emoji, as far as we can tell, there's no way to just turn this off.
The report notes that this new feature won't work on business or school accounts. "Emoji reactions also aren't available for group email lists, messages with more than 20 recipients, emails on which you're BCC'd, encrypted emails, and emails where the sender has a custom reply-to address."
Google

The Pixel Watch 2 Adds New Sensors, Longer Battery Life, and Better Accuracy (theverge.com) 12

Alongside the Pixel 8 and Android 14, Google today launched the new Pixel Watch 2 -- a $350 second-gen smartwatch featuring a faster processor, overhauled sensor array, and longer battery life. The Verge reports: At a glance, the main difference is that the screen sits flush with the digital crown, where the original had a slight cutout. Another change imperceptible to the naked eye: the body is now made of 100 percent recycled aluminum instead of stainless steel. The result is a slightly lighter watch, but not by much. The Pixel Watch weighed 36 grams, while the Pixel Watch 2 is 31g. That's a bit disappointing, considering the Watch 2's price remains the same as last year. We're looking at the same 41mm case size and OLED display on top. But flip the watch over, and you'll find a completely different sensor array. Instead of a single line of LEDs, there are now multiple LEDs and photodiodes to take measurements from several angles and positions. That then feeds into an algorithm that Fitbit CEO James Park says is 40 percent more accurate for vigorous activities.

This year, Google also added a skin temperature and continuous electrodermal activity (EDA) sensor. Both help enable proactive stress tracking, which Fitbit introduced with its Sense 2. The EDA sensor detects minuscule amounts of sweat, which can help determine bodily stress when combined with metrics like heart rate variability, heart rate, and skin temperature. As with the Sense 2, you're supposed to get a slightly delayed notification when a stressful event has been detected. You're then encouraged to log how that event made you feel. Battery life was a major pain point when the Pixel Watch first launched. Park acknowledges that you couldn't use the always-on display on the first-gen watch if you wanted that 24-hour battery life. This time around, he says that the team has worked hard to make sure the Pixel Watch 2's 306mAh battery can get 24 hours with the always-on display enabled. Users should also be able to get a 50 percent charge in 30 minutes and a full day's worth in 75 minutes. Helping that should be Wear OS 4 -- which Google says ought to extend battery life -- and the new, more power-efficient Qualcomm Snapdragon W5 processor. (Speaking of Wear OS 4, Google says that, at first, it'll be exclusive to Pixel Watch 2.)
Other features include the ability to automatically record workouts and do heart rate zone training; a new Safety Check feature that will alert your loved ones of your location after a preset timer expires (e.g. taking an Uber across town or going on a late-night walk); and support for Google services like Gmail, Google Wallet, and Calendar.

You can learn more about the Pixel Watch 2 here.
Android

Android 14 Officially Releases for Pixel Phones 20

Android 14 is out today, along with a new Pixel phone. The OS is shipping to supported Pixel devices now, which means the Pixel 4a (5G) and every variant of the Pixel 5, 6, and 7, plus the Fold and Tablet. From a report: The big feature this year is a somewhat customizable home screen. You can pick from several different lock screen clock styles and customize the two bottom app shortcuts. This feels like a response to iOS 16's lock screen widgets (a feature Android used to have back in the 4.2 days) but not nearly as customizable. It's honestly hard to highlight a second Android 14 feature because this is one of the smallest Android releases ever. The first feature Google mentions in its blog post is a new wallpaper picker. On the Pixel 8, Android now has a built-in text-to-image AI wallpaper maker, presumably a feature that lets the Android team adhere to Google's "mandatory AI" company mandate. There's also a new monochrome theme if you're tired of all those "Material You" colors.
Google

Google's New Virtual Assistant To Include Bard AI Tools (bloomberg.com) 14

Google will soon release a version of its virtual assistant that is powered by the company's Bard artificial intelligence technology, helping users handle more complex tasks. From a report: The new offering, called Assistant with Bard, will be available in a test phase shortly and then roll out to the general public in the coming months, the company said Wednesday. The release will equip the Assistant, which helps users of Android and Google devices complete tasks and find information, with some of the capabilities of Bard, a chatbot that is the company's answer to OpenAI's wildly popular ChatGPT. "Generative AI is creating new opportunities to build a more intuitive, intelligent, personalized digital assistant," Sissie Hsiao, a Google vice president, wrote in a blog post accompanying the news.
Google

The Google Pixel 8 is Official With 7 Years of Updates (arstechnica.com) 77

Google's newest flagship phone is finally official. The Pixel 8 and Pixel 8 Pro were both unveiled today, with the headline changes being a whopping seven years of updates, flat screens across the board, new CPUs, and a $100 price increase. The Pixel 8 Pro is officially $999, while the Pixel 8 is $699. ArsTechnica: As for specs, the Pro display is a 6.7-inch, 120 Hz, 2992x1344 OLED. Google is branding this display "Super Actua" because it's one of the brightest phone displays on the market at 1600 nits for HDR content and 2400 nits in sunlight mode. That beats the sunlight modes on the S23 Ultra (1750 nits) and iPhone 15 Pro Max (2000 nits) but not the Xiaomi 13T Pro (2600 nits). The storage situation here isn't great. The Pixel 8 Pro has 12GB of RAM and storage tiers of 128GB, 256GB, 512GB, and 1TB. Most other phones in this price range start at 256GB, and the 8 Pro uses slower UFS 3.1 storage instead of the speedy UFS 4.0 a lot of phones ship with now. The 8 Pro battery is 5050 mAh, and there's 30 W wired charging. Wireless charging will hit 23 W on the Pixel charging stand, while Qi chargers will only hit 12 W (it would be great if Qi2 would get its act together). Both phones have IP68 dust and water resistance. On the software update support lifecycle: This year, there is finally something tangible to point to -- 7 years of OS updates. Unlike with previous models, there are no games being played here, as Google says there are "7 years of OS, security, and Feature Drop updates." That's more major OS updates than even iPhone owners are getting, with the iPhone X getting iOS versions 11-16.
Encryption

New Group Attacking iPhone Encryption Backed By US Political Dark-Money Network (theintercept.com) 52

Long-time Slashdot reader schwit1 shares a report from The Intercept: The Heat Initiative, a nonprofit child safety advocacy group, was formed earlier this year to campaign against some of the strong privacy protections Apple provides customers. The group says these protections help enable child exploitation, objecting to the fact that pedophiles can encrypt their personal data just like everyone else. When Apple launched its new iPhone this September, the Heat Initiative seized on the occasion, taking out a full-page New York Times ad, using digital billboard trucks, and even hiring a plane to fly over Apple headquarters with a banner message. The message on the banner appeared simple: 'Dear Apple, Detect Child Sexual Abuse in iCloud' -- Apple's cloud storage system, which today employs a range of powerful encryption technologies aimed at preventing hackers, spies, and Tim Cook from knowing anything about your private files.

Something the Heat Initiative has not placed on giant airborne banners is who's behind it: a controversial billionaire philanthropy network whose influence and tactics have drawn unfavorable comparisons to the right-wing Koch network. Though it does not publicize this fact, the Heat Initiative is a project of the Hopewell Fund, an organization that helps privately and often secretly direct the largesse -- and political will -- of billionaires. Hopewell is part of a giant, tightly connected web of largely anonymous, Democratic Party-aligned dark-money groups, in an ironic turn, campaigning to undermine the privacy of ordinary people.

For an organization demanding that Apple scour the private information of its customers, the Heat Initiative discloses extremely little about itself. According to a report in the New York Times, the Heat Initiative is armed with $2 million from donors including the Children's Investment Fund Foundation, an organization founded by British billionaire hedge fund manager and Google activist investor Chris Cohn, and the Oak Foundation, also founded by a British billionaire. The Oak Foundation previously provided $250,000 to a group attempting to weaken end-to-end encryption protections in EU legislation, according to a 2020 annual report. The Heat Initiative is helmed by Sarah Gardner, who joined from Thorn, an anti-child trafficking organization founded by actor Ashton Kutcher. [...] Critics say these technologies aren't just uncovering trafficked children, but ensnaring adults engaging in consensual sex work.
"My goal is for child sexual abuse images to not be freely shared on the internet, and I'm here to advocate for the children who cannot make the case for themselves," Gardner said, declining to name the Heat Initiative's funders. "I think data privacy is vital. I think there's a conflation between user privacy and known illegal content."
Google

Google Mandates Unsubscribe Button in Emails For Those Sending Over 5,000 Daily Messages (cnbc.com) 91

Google plans to make it harder for spammers to send messages to Gmail users. From a report: The company said it will require emailers who send more than 5,000 messages per day to Gmail users to offer a one-click unsubscribe button in their messages. It will also require them to authenticate their email address, configuring their systems so they prove they own their domain name and aren't spoofing IP addresses. Alphabet-owned Google says it may not deliver messages from senders whose emails are frequently marked as spam and fall under a "clear spam rate threshold" of 0.3% of messages sent, as measured by Google's Postmaster Tools.

Google says it has signed up Yahoo to make the same changes, and they'll come into effect in February 2024. The moves highlight the ongoing fight between big tech companies and spammers who use open systems such as email to send fraudulent messages and annoy users. For years, machine learning techniques have been used to fight spam, but it remains a back-and-forth battle as spammers discover new techniques to get past filters.

Microsoft

Microsoft CEO Says Tech Giants Battling For Content To Build AI 9

Microsoft chief executive Satya Nadella said Monday tech giants were competing for vast troves of content needed to train artificial intelligence, and complained Google was locking up content with expensive and exclusive deals with publishers. From a report: Testifying in a landmark U.S. trial against its rival Google, the first major antitrust case brought by the U.S. since it sued Microsoft in 1998, Nadella testified the tech giants' efforts to build content libraries to train their large language models "reminds me of the early phases of distribution deals." Distribution agreements are at the core of the U.S. Justice Department's antitrust fight against Google. The government says that Google, with some 90% of the search market, illegally pays $10 billion annually to smartphone makers like Apple and wireless carriers like AT&T and others to be the default search engine on their devices.

The clout in search makes Google a heavy hitter in the lucrative advertising market, boosting its profits. Nadella said building artificial intelligence took computing power, or servers, and data to train the software. On servers, he said: "No problem, we are happy to put in the dollars." But without naming Google, he said it was "problematic" if other companies locked up exclusive deals with big content makers. "When I am meeting with publishers now, they say Google's going to write this check and it's exclusive and you have to match it," he said.
Security

Vulnerable Arm GPU Drivers Under Active Exploitation, Patches May Not Be Available (arstechnica.com) 30

An anonymous reader quotes a report from Ars Technica: Arm warned on Monday of active ongoing attacks targeting a vulnerability in device drivers for its Mali line of GPUs, which run on a host of devices, including Google Pixels and other Android handsets, Chromebooks, and hardware running Linux. "A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory," Arm officials wrote in an advisory. "This issue is fixed in Bifrost, Valhall and Arm 5th Gen GPU Architecture Kernel Driver r43p0. There is evidence that this vulnerability may be under limited, targeted exploitation. Users are recommended to upgrade if they are impacted by this issue."

The advisory continued: "A local non-privileged user can make improper GPU processing operations to access a limited amount outside of buffer bounds or to exploit a software race condition. If the system's memory is carefully prepared by the user, then this in turn could give them access to already freed memory." [...] Getting access to system memory that's no longer in use is a common mechanism for loading malicious code into a location an attacker can then execute. This code often allows them to exploit other vulnerabilities or to install malicious payloads for spying on the phone user. Attackers often gain local access to a mobile device by tricking users into downloading malicious applications from unofficial repositories. The advisory mentions drivers for the affected GPUs being vulnerable but makes no mention of microcode that runs inside the chips themselves.

The most prevalent platform affected by the vulnerability is Google's line of Pixels, which are one of the only Android models to receive security updates on a timely basis. Google patched Pixels in its September update against the vulnerability, which is tracked as CVE-2023-4211. Google has also patched Chromebooks that use the vulnerable GPUs. Any device that shows a patch level of 2023-09-01 or later is immune to attacks that exploit the vulnerability. The device driver on patched devices will show as version r44p1 or r45p0. CVE-2023-4211 is present in a range of Arm GPUs released over the past decade. The Arm chips affected are:

- Midgard GPU Kernel Driver: All versions from r12p0 - r32p0
- Bifrost GPU Kernel Driver: All versions from r0p0 - r42p0
- Valhall GPU Kernel Driver: All versions from r19p0 - r42p0
- Arm 5th Gen GPU Architecture Kernel Driver: All versions from r41p0 - r42p0

Google

Chromebook Plus is Google's New Certification for Premium Chromebooks (theverge.com) 17

Google has introduced Chromebook Plus, a new certification that's meant to help shoppers identify high-quality Chromebooks to buy. From a report: Much like Intel's Evo program for Windows PCs, the Chromebook Plus branding will be awarded to laptops that meet a set of minimum requirements. The idea is that even a shopper who's not familiar with PC specs can see the "Chromebook Plus" label on a product and be assured that Google thinks it's a good product. Chromebook Plus devices must have:

An Intel Core (i3 or higher) or AMD Ryzen 7000 CPU
An IPS panel with at least 1080p resolution
A 1080p webcam
8GB of RAM
128GB of storage

There's an interesting absence here: battery life. In fact, the phrase "battery life" does not appear once in Google's press release. Curious! I asked Google spokesperson Peter Du about this, and he provided the following statement: "All Chromebooks are required to meet a 10 hours battery life requirement based on internal testing standards. While not a new requirement for Chromebook Plus like the 1080p screen or 8GB of RAM, Chromebook Plus laptops must also adhere to this."

Microsoft

Microsoft CEO Says AI Will Help Google Extend Search Edge (bloomberg.com) 17

Microsoft Chief Executive Officer Satya Nadella said AI could help Google extend its dominance of the search market, as he took the stand Monday in the Google antitrust trial. From a report: When Microsoft introduced its new Bing AI-based search in February, beating Google to the punch, Nadella touted the technology as a way for Bing to get back in the market and make Google uncomfortable. But now, he told the judge, Google could accelerate its current lead by using the massive profits it makes from search to pay publishers for exclusive rights to content it can use to make its search AI better than rivals. Nadella also left no doubt about his perception of Google's dominance.

"You get up in the morning, you brush your teeth and you search on Google," he said. The Department of Justice has accused Alphabet's search division of unlawfully maintaining a monopoly by paying $10 billion a year to rivals, smartphone manufacturers and wireless carriers to make its search engine the default option on mobile devices and web browsers. Google has denied the allegations. To help prove its case, the DOJ hopes to use testimony from Nadella and other executives from Microsoft to show how even a company of its size and resources couldn't unlock Google's hold on the search market.

The Internet

European Telecom Groups Ask Brussels To Make Big Tech Pay More For Networks (ft.com) 60

Europe's biggest telecoms companies have called on the EU to compel Big Tech to pay a "fair" contribution for using their networks, the latest stage in a battle for payments that has pitched the sector against companies such as Netflix and Google. From a report: Technology companies that "benefit most" from telecoms infrastructure and drive traffic growth should contribute more to costs, according to the chief executives of 20 groups including BT, Deutsche Telekom and Telefonica, who signed an open letter seen by the Financial Times. It will be sent to the European Commission and members of the European parliament. "Future investments are under serious pressure and regulatory action is needed to secure them," they warned. "A fair and proportionate contribution from the largest traffic generators towards the costs of network infrastructure should form the basis of a new approach."

They added that regulators need to take action to help secure future investment, with telecoms groups having to spend billions to support the rollout of 5G and upgrade to full-fibre networks. Signatories included Timotheus Hottges at Deutsche Telekom, Christel Heydemann at Orange, Jose Mara Alvarez-Pallete at Telefonica and Pietro Labriola at Telecom Italia. It was also supported by outgoing BT chief executive Philip Jansen, his successor Allison Kirkby, who is currently chief executive at Telia, as well as Vodafone's chief executive Margherita Della Valle. They suggested that a payment mechanism might only make demands on "the very largest traffic generators" with a focus on "accountability and transparency on contributions...so that operators invest directly into Europe's digital infrastructure."

The Courts

'Embarrassing' Court Document Google Wanted to Hide Finally Posted Online (arstechnica.com) 44

America's Department of Justice "has finally posted what judge Amit Mehta described at the Google search antitrust trial as an 'embarrassing' exhibit that Google tried to hide from the public," reports Ars Technica: The document in question contains meeting notes that Google's vice president for finance, Michael Roszak, "created for a course on communications," Bloomberg reported. In his notes, Roszak wrote that Google's search advertising "is one of the world's greatest business models ever created" with economics that only certain "illicit businesses" selling "cigarettes or drugs" "could rival."

At trial, Roszak told the court that he didn't recall if he ever gave the presentation. He said that the course required that he tell students "things I don't believe as part of the presentation." He also claimed that the notes were "full of hyperbole and exaggeration" and did not reflect his true beliefs, "because there was no business purpose associated with it." According to Bloomberg, Google repeatedly objected to the document being shared in court, claiming it was irrelevant to the DOJ's case. Then, after Mehta allowed the DOJ to present the document as evidence, Google tried to seal off Roszak's testimony on the document...

Beyond likening Google's search advertising business to illicit drug markets, Roszak's notes also said that because users got hooked on Google's search engine, Google was able to "mostly ignore the demand side" of "fundamental laws of economics" and "only focus on the supply side of advertisers, ad formats, and sales." This was likely the bit that actually interested the DOJ. "We could essentially tear the economics textbook in half," Roszak's notes said. Part of the DOJ's case argues that because Google has a monopoly over search, it's less incentivized to innovate products that protect consumers from harm like invasive data collection.

A Google spokesman told Bloomberg that Roszak's statements "don't reflect the company's opinion" and "were drafted for a public speaking class in which the instructions were to say something hyperbolic and attention-grabbing." The spokesman also noted that Roszak "testified he didn't believe the statements to be true."

Businesses

H&R Block, Meta, and Google Slapped With RICO Suit, Allegedly Schemed to Scrape Taxpayer Data (gizmodo.com) 31

Anyone who has used H&R Block's tax return preparation services since 2015 "may have unintentionally helped line Meta and Google's pocket," reports Gizmodo: That's according to a new class action lawsuit which alleges the three companies "jointly schemed" to install trackers on the H&R Block site to scan and transmit tax data back to the tech companies which then used elements of the data to engage in targeted advertising.

Attorneys bringing the case forward claim the three companies' conduct amounts to a "pattern of racketeering activity" covered under the Racketeer Influenced and Corrupt Organizations Act (RICO), a tool typically reserved for organized crime. "H&R Block, Google, and Meta ignored data privacy laws, and passed information about people's financial lives around like candy," Brent Wisner, one of the attorneys bringing forward the complaint said.

The lawsuit, filed in the Northern District of California this week, stems from a bombshell Congressional report released earlier this year detailing the way multiple tax preparation firms, including H&R Block, "recklessly" shared the sensitive tax data of tens of millions of Americans without proper safeguards. At issue are the tax preparation firms' use of tracking "pixels" placed on their websites. These trackers, which the lawsuit refers to as "spy cams" would allegedly scan tax documents and reveal a variety of personal tax information, including a filer's name, filing status, federal taxes owed, address, and number of dependents. That data was then anonymized and used for targeted advertising and to train Meta's AI algorithms, the congressional report notes.

The attorneys argue that H&R Block, Meta, and Google "explicitly and intentionally" entered into an agreement to violate taxpayers' privacy rights for financial gain, according to the article. The suit seeks refunds and punitive damages.
Google

Web Sites Can Now Choose to Opt Out of Google Bard and Future AI Models (mashable.com) 35

"We're committed to developing AI responsibly," says Google's VP of Trust, "guided by our AI principles and in line with our consumer privacy commitment. However, we've also heard from web publishers that they want greater choice and control over how their content is used for emerging generative AI use cases."

And so, Mashable reports, "Websites can now choose to opt out of Google Bard, or any other future AI models that Google makes." Google made the announcement on Thursday introducing a new tool called Google-Extended that will allow sites to be indexed by crawlers (or a bot creating entries for search engines), while simultaneously not having their data accessed to train future AI models. For website administrators, this will be an easy fix, available through robots.txt — or the text file that allows web crawlers to access sites...

OpenAI, the maker of ChatGPT, recently launched a web crawler of its own, but included instructions on how to block it. Publications like Medium, the New York Times, CNN and Reuters have notably done so.

As Google's blog post explains, "By using Google-Extended to control access to content on a site, a website administrator can choose whether to help these AI models become more accurate and capable over time..."
Firefox

New in Firefox 118: Private Local, Browser-Based Website Translating (liliputing.com) 13

An anonymous reader shared this report from Liliputing.com: Web browsers have had tools that let you translate websites for years. But they typically rely on cloud-based translation services like Google Translate or Microsoft's Bing Translator. The latest version of Mozilla's Firefox web browser does things differently. Firefox 118 brings support for Fullpage Translation, which can translate websites entirely in your browser. In other words, everything happens locally on your computer without any data sent to Microsoft, Google, or other companies.

Here's how it works. Firefox will notice when you visit a website in a supported language that's different from your default language, and a translate icon will show up in the address bar. Tap that icon and you'll see a pop-up window that asks what languages you'd like to translate from and to. If the browser doesn't automatically detect the language of the website you're visiting, you can set these manually... You can also tap the settings icon in the translation menu and choose to "always translate" or "never translate" a specific language so that you won't have to manually invoke the translation every time you visit sites in that language.

Firefox is support nine languages so far.

Slashdot Top Deals