AeroGarden, which sells Wi-Fi-connected indoor gardening systems, is going out of business on January 1. While Scotts Miracle-Gro has continued selling AeroGarden products after announcing the impending shutdown, the future of the devices' companion app is uncertain.

The Register's Jessica Lyons reports: Apple wants to shorten SSL/TLS security certificates' lifespans, down from 398 days now to just 45 days by 2027, and sysadmins have some very strong feelings about this "nightmarish" plan. As one of the hundreds that took to Reddit to lament the proposal said: "This will suck. My least favorite vendor manages something like 10 websites for us, and we have to provide the certs manually every time. Between live and test this is gonna suck."

The Apple proposal, a draft ballot measure that will likely go up for a vote among Certification Authority Browser Forum (CA/B Forum) members in the upcoming months, was unveiled by the iThings maker during the Forum's fall meeting. If approved, it will affect all Safari certificates, which follows a similar push by Google, that plans to reduce the max-validity period on Chrome for these digital trust files down to 90 days.

... [W]hile it's generally agreed that shorter lifespans improve internet security overall -- longer certificate terms mean criminals have more time to exploit vulnerabilities and old website certificates -- the burden of managing these expired certs will fall squarely on the shoulders of systems administrators. [...] Even certificate provider Sectigo, which sponsored the Apple proposal, admitted that the shortened lifespans "will no doubt prove a headache for busy IT security teams, juggling with lots of certificates expiring at different times." While automation is often touted as the solution to this problem, sysadmins were quick to point out that some SSL certs can't be automated. "This is somewhat nightmarish," said one sysadmin. "I have about 20 appliance like services that have no support for automation. Almost everything in my environment is automated to the extent that is practical. SSL renewal is the lone achilles heel that I have to deal with once every 365 days."

The Federal Communications Commission announced that it will open a renewed investigation into broadband data caps and how they impact both consumer experience and company competition. From a report: The FCC is soliciting stories from consumers about their experiences with capped broadband service. The agency also opened a formal Notice of Inquiry to collect public comment that will further inform its actions around broadband data caps. "Restricting consumers' data can cut off small businesses from their customers, slap fees on low-income families and prevent people with disabilities from using the tools they rely on to communicate," FCC Chairwoman Jessica Rosenworcel said. "As the nation's leading agency on communications, it's our duty to dig deeper into these practices and make sure that consumers are put first."

Vietnam will convert all its networks to IPv6, under a sweeping digital infrastructure strategy announced last week. From a report: The plan emerged in Decision No. 1132/QD-TTg -- signed into existence by permanent deputy prime minister Nguyen Hoa Binh -- and defines goals for 2025 and 2030. By 2025, the nation intends to connect two new submarine cables -- an important local issue.

Earlier this year, internet speeds slowed when three of the five cables connecting the country broke. Also by 2025, the country wants "universal" fiber-to-the-home, 5G services in all cities and industrial zones, and work to have commenced on an unspecified number of datacenters capable of running AI applications and operating with power usage effectiveness index (PUE) of less than 1.4. [...] Vietnam's population exceeds 100 million and it already has 140 mobile subscriptions per 100 inhabitants. IPv4 with network address translation can scale to those levels -- if Vietnamese carriers have secured sufficient number resources.

An anonymous reader quotes a report from Ars Technica: On Friday, Ward Christensen, co-inventor of the computer bulletin board system (BBS), died at age 78 in Rolling Meadows, Illinois. Christensen, along with Randy Suess, created the first BBS in Chicago in 1978, leading to an important cultural era of digital community-building that presaged much of our online world today. Friends and associates remember Christensen as humble and unassuming, a quiet innovator who never sought the spotlight for his groundbreaking work. Despite creating one of the foundational technologies of the digital age, Christensen maintained a low profile throughout his life, content with his long-standing career at IBM and showing no bitterness or sense of missed opportunity as the Internet age dawned.

"Ward was the quietest, pleasantest, gentlest dude," said BBS: The Documentary creator Jason Scott in a conversation with Ars Technica. Scott documented Christensen's work extensively in a 2002 interview for that project. "He was exactly like he looks in his pictures," he said, "like a groundskeeper who quietly tends the yard." Tech veteran Lauren Weinstein initially announced news of Christensen's passing on Sunday, and a close friend of Christensen's confirmed to Ars that Christensen died peacefully in his home. The cause of death has not yet been announced.

Pior to creating the first BBS, Christensen invented XMODEM, a 1977 file transfer protocol that made much of the later BBS world possible by breaking binary files into packets and ensuring that each packet was safely delivered over sometimes unstable and noisy analog telephone lines. It inspired other file transfer protocols that allowed ad-hoc online file sharing to flourish.

The first 5G Internet of Things (IoT) devices are launching soon. According to Fierce Wireless, T-Mobile plans to launch its first RedCap devices by the end of the year, while AT&T's devices are expected sometime in 2025. From the report: All of this should pave the way for higher performance 5G gadgets to make an impact in the world of IoT. RedCap, which stands for reduced capabilities, was introduced as part of the 3GPP's Release 17 5G standard, which was completed -- or frozen in 3GPP terms -- in mid-2022. The specification, which is also called NR-Light, is the first 5G-specific spec for IoT.

RedCap promises to offer data transfer speeds of between 30 Mbps to 80 Mbps. The RedCap spec greatly reduces the bandwidth needed for 5G, allowing the signal to run in a 20 MHz channel rather than the 100 MHz channel required for full scale 5G communications.

The Internet Archive has resumed operations in a read-only state following a cyberattack that took the digital library offline on October 9, coupled with the theft of 31 million user authentication records. "Safe to resume but might need further maintenance, in which case it will be suspended again," said Brewster Kahle, Internet Archive's founder. The website is currently now allowing users to save pages.

Meta's Oversight Board "is spinning off a new appeals center," reports the Washington Post, "to handle content disputes from European social media users on multiple platforms".

It will operate under Europe's Digital Services Act, "which requires tech companies to allow users to appeal restrictions on their accounts before an independent group of experts." "I think this is really a game changer," Appeals Centre Europe CEO Thomas Hughes said in an interview. "It could really drive platform accountability and transparency."

The expansion arrives as the Oversight Board, an independent collection of academics, experts and lawyers funded by Meta, has been seeking to expand its influence beyond the social media giant... [The Board] has tried for years to court other major internet companies, offering to help them referee debates about content, The Post has reported...

Oversight Board members and Oversight Board Trust Chairman Stephen Neal said in statements that both the Appeals Centre Europe and the Oversight Board will play critical but complimentary roles in holding tech companies accountable for their decisions on content. "Both entities are committed to improving user redress, transparency and upholding users' rights online," Neal said...

Hughes, who used to be the Oversight Board's administration director, said that he was "proud" of what the Oversight Board is accomplishing but that it is different from what the Appeals Centre Europe will offer. When Facebook, YouTube or TikTok removes a post, European social media users will be able to appeal the decision to the center. Users also will also be able to flag the center with posts they think violate the rules but were not removed. While the Appeals Centre Europe's decisions will be nonbinding, the group will generate data that could power decisions by regulators, civil society groups and the general public, Hughes said. By contrast, the Oversight Board's decisions on Meta content are binding.
Last year the original Oversight Board completed more than 50 cases, "and is on track to exceed that number in 2024," according to the article. But this board is different, CEO Hughes told the Post. They'll have about two dozen staffers, with expertise in human rights and tech policy — or fluency in various languages.

And he added that though the center is funded by an initial grant, future operating costs will be covered by the fees social media companies pay the appeal center — roughly 90 euros ($100) per case.

The Fifth Circuit Court of Appeals has affirmed a copyright infringement verdict against Internet provider Grande, which failed to take action against allegedly pirating subscribers. The jury's $47 million damages award in favor of the major music label plaintiffs is vacated. According to the Court (PDF), individual tracks that are part of an album, should not be counted as separate works. TorrentFreak reports: After hearing both sides, the Fifth Circuit Court of Appeals affirmed the jury verdict yesterday. Grande's arguments, suggesting that the district court mistakenly upheld the verdict earlier, were rejected. "The district court did not err in upholding the jury's unanimous liability verdict because Plaintiffs satisfied each element legally and factually," the decision reads. "The court correctly interpreted the law and instructed the jury on the relevant legal standards in light of the factual issues disputed by the parties, and Plaintiffs introduced ample evidence from which a reasonable jury could find in Plaintiffs' favor." [...]

In addition to the material contribution challenge, Grande and its supporters also pointed out that terminating Internet access isn't a "simple measure," as the jury concluded. Instead, it is drastic and overbroad, which could also impact innocent subscribers. The Court of Appeals rejects this reasoning. Instead, it states that the jury could and did conclude that terminations are a simple measure. There is no evidence to reach a different conclusion. All in all, the Court sees no reason to reverse the jury's verdict that Grande is liable for contributory infringement. This means that the jury verdict is affirmed.

In response to California's new law targeting "false advertising" of "digital goods," Valve has added the following language to its checkout page: "A purchase of a digital product grants a license for the product on Steam." Ars Technica reports: California's AB2426 law, signed by Gov. Gavin Newsom Sept. 26, excludes subscription-only services, free games, and digital goods that offer "permanent offline download to an external storage source to be used without a connection to the internet." Otherwise, sellers of digital goods cannot use the terms "buy, purchase," or related terms that would "confer an unrestricted ownership interest in the digital good." And they must explain, conspicuously, in plain language, that "the digital good is a license" and link to terms and conditions.

Which is what Valve has now added to its cart page before enforcement of these terms was due to start next year. The company has long made it clear, deeper inside its End User License Agreement (EULA), that a purchase is a license, and those licenses cannot be resold, which avoids issues of one's right to resell a game. Now it is something that every user sees on every purchase, however quickly they click-through to get to their download.

penciling_in writes: Ukrainian authorities have arrested a 28-year-old man in Khmelnytskyi for running an illegal VPN service that allowed users to bypass Ukrainian sanctions and access the Russian internet (Runet). The VPN, active since Russia's invasion, enabled Russian sympathizers and people in occupied territories to reach blocked Russian government sites, social media, and news.

Handling over 100GB of data daily and linking to 48 million Russian IP addresses, the VPN may have been exploited by Russian intelligence. Ukrainian cyber police, in collaboration with the National Security Service, seized servers and equipment in multiple locations. The suspect faces charges under Part 5 of Article 361 of Ukraine's Criminal Code, which could lead to a 15-year prison sentence. Investigations are ongoing into further connections and funding sources. The case highlights the growing role of VPNs in the ongoing cyberwar between Ukraine and Russia.

U.S. officials are racing to understand the full scope of a China-linked hack of major U.S. broadband providers, as concerns mount from members of Congress that the breach could amount to a devastating counterintelligence failure. From a report: Federal authorities and cybersecurity investigators are probing the breaches of Verizon Communications, AT&T and Lumen Technologies. A stealthy hacking group known as Salt Typhoon tied to Chinese intelligence is believed to be responsible. The compromises may have allowed hackers to access information from systems the federal government uses for court-authorized network wiretapping requests, The Wall Street Journal reported last week.

Among the concerns are that the hackers may have essentially been able to spy on the U.S. government's efforts to surveil Chinese threats, including the FBI's investigations. The House Select Committee on China sent letters Thursday asking the three companies to describe when they became aware of the breaches and what measures they are taking to protect their wiretap systems from attack. Spokespeople for AT&T, Lumen and Verizon declined to comment on the attack. A spokesman at the Chinese Embassy in Washington has denied that Beijing is responsible for the alleged breaches.

Combined with other Chinese cyber threats, news of the Salt Typhoon assault makes clear that "we face a cyber-adversary the likes of which we have never confronted before," Rep. John Moolenaar, the Republican chairman of the House Select Committee Committee on China, and Raja Krishnamoorthi, the panel's top Democrat, said in the letters. "The implications of any breach of this nature would be difficult to overstate," they said. Hackers still had access to some parts of U.S. broadband networks within the last week, and more companies were being notified that their networks had been breached, people familiar with the matter said. Investigators remain in the dark about precisely what the hackers were seeking to do, according to people familiar with the response.

AMD is launching a new chip to rival Nvidia's upcoming Blackwell chips, which Nvidia called the "world's most powerful chip" for AI when unveiled earlier this year. CNBC reports: The Instinct MI325X, as the chip is called, will start production before the end of 2024, AMD said Thursday during an event announcing the new product. If AMD's AI chips are seen by developers and cloud giants as a close substitute for Nvidia's products, it could put pricing pressure on Nvidia, which has enjoyed roughly 75% gross margins while its GPUs have been in high demand over the past year. In the past few years, Nvidia has dominated the majority of the data center GPU market, but AMD is historically in second place. Now, AMD is aiming to take share from its Silicon Valley rival or at least to capture a big chunk of the market, which it says will be worth $500 billion by 2028.

AMD didn't reveal new major cloud or internet customers for its Instinct GPUs at the event, but the company has previously disclosed that both Meta and Microsoft buy its AI GPUs and that OpenAI uses them for some applications. The company also did not disclose pricing for the Instinct MI325X, which is typically sold as part of a complete server. With the launch of the MI325X, AMD is accelerating its product schedule to release new chips on an annual schedule to better compete with Nvidia and take advantage of the boom in AI chips. The new AI chip is the successor to the MI300X, which started shipping late last year. AMD's 2025 chip will be called MI350, and its 2026 chip will be called MI400, the company said.

An anonymous reader quotes a report from Gizmodo: The Internet Archive and Wayback Machine went down on Tuesday following a sustained cyber attack. In addition, the Archive's user data has been compromised. If you've ever logged into the site to pore over its ample archives, it's time to change your passwords. [...] A pro-Palestenian hacktivist group called SN_BLACKMETA has taken responsibility for the hack on X and Telegram. "They are under attack because the archive belongs to the USA, and as we all know, this horrendous and hypocritical government supports the genocide that is being carried out by the terrorist state of 'Israel,'" the group said on X when someone asked them why they'd gone after the Archive.

The group elaborated on its reasoning in a now-deleted post on X. Jason Scott, an archivist at the Archive, screenshotted it and shared it. "Everyone calls this organization 'non-profit', but if its roots are truly in the United States, as we believe, then every 'free' service they offer bleeds millions of lives. Foreign nations are not carrying their values beyond their borders. Many petty children are crying in the comments and most of those comments are from a group of Zionist bots and fake accounts," the post said.

SN_BLACKMETA also claimed responsibility for a six-day DDoS attack on the Archive back in May. "Since the attacks began on Sunday, the DDoS intrusion has been launching tens of thousands of fake information requests per second. The source of the attack is unknown," Chris Freeland, Director of Library Services at the Archive said in a post about the attacks back in May. SN_BLACKMETA launched its Telegram channel on November 23 and has claimed responsibility for a number of other attacks including a six-day DDoS run at Arab financial institutions and various attacks on Israeli tech companies in the spring.

Alypius shares a report from 9to5Mac: It was revealed this weekend that Chinese hackers managed to access systems run by three of the largest internet service providers (ISPs) in the US. What's notable about the attack is that it compromised security backdoors deliberately created to allow for wiretaps by US law enforcement. [...] Apple famously refused the FBI's request to create a backdoor into iPhones to help access devices used by shooters in San Bernardino and Pensacola. The FBI was subsequently successful in accessing all the iPhones concerned without the assistance it sought.

Our arguments against such backdoors predate both cases, when Apple spoke out on the issue in the wake of terrorist attacks in Paris more than a decade ago: "Apple is absolutely right to say that the moment you build in a backdoor for use by governments, it will only be a matter of time before hackers figure it out. You cannot have an encryption system which is only a little bit insecure any more than you can be a little bit pregnant. Encryption systems are either secure or they're not -- and if they're not then it's a question of when, rather than if, others are able to exploit the vulnerability."

This latest case perfectly illustrates the point. The law required ISPs to create backdoors that could be used for wiretaps by US law enforcement, and hackers have now found and accessed them. Exactly the same would be true if Apple created backdoors into iPhones.

Turkey has blocked access to Discord after the messaging platform refused to share potentially illegal information with authorities. Reuters reports: Justice minister Yilmaz Tunc said an Ankara court decided to block access to Discord from Turkey due to sufficient suspicion that crimes of "child sexual abuse and obscenity" had been committed by some using the platform. The block comes after public outrage in Turkey caused by the murder of two women by a 19-year-old man in Istanbul this month. Content on social media showed Discord users subsequently praising the killing. Transport and infrastructure minister Abdulkadir Uraloglu said the nature of the Discord platform made it difficult for authorities to monitor and intervene when illegal or criminal content is shared.

"Security personnel cannot go through the content. We can only intervene when users complain to us about content shared there," he told reporters in parliament. "Since Discord refuses to share its own information, including IP addresses and content, with our security units, we were forced to block access." Russia also recently blocked Discord for violating Russian law, after previously fining the company for failing to remove banned content.

BleepingComputer's Lawrence Abrams: Internet Archive's "The Wayback Machine" has suffered a data breach after a threat actor compromised the website and stole a user authentication database containing 31 million unique records. News of the breach began circulating Wednesday afternoon after visitors to archive.org began seeing a JavaScript alert created by the hacker, stating that the Internet Archive was breached.

"Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!," reads a JavaScript alert shown on the compromised archive.org site. The text "HIBP" refers to is the Have I Been Pwned data breach notification service created by Troy Hunt, with whom threat actors commonly share stolen data to be added to the service.

Hunt told BleepingComputer that the threat actor shared the Internet Archive's authentication database nine days ago and it is a 6.4GB SQL file named "ia_users.sql." The database contains authentication information for registered members, including their email addresses, screen names, password change timestamps, Bcrypt-hashed passwords, and other internal data. Hunt says there are 31 million unique email addresses in the database, with many subscribed to the HIBP data breach notification service. The data will soon be added to HIBP, allowing users to enter their email and confirm if their data was exposed in this breach.

AmiMoJo writes: A treaty finalized by the UK may bring about the end of the .io domain. Last week, the British government announced that it has agreed to give up ownership of the Chagos Islands, a territory in the Indian Ocean it has controlled since 1814 -- relinquishing the .io domain with it.

The Internet Assigned Numbers Authority (IANA) has a process for retiring old country code domains within five years (with the possibility for extensions). The IANA established this rule after the Soviet Union's .su domain lingered after its collapse, becoming a domain commonly used among cybercriminals. Since then, IANA has also had to retire the .yu domain previously used for Yugoslavia, but it remained operational for years following the country's breakup while government websites transitioned to new domains. And while the independent Solomon Islands does have the domain name .sb, where 'B' stands for how it used to be a British protectorate, that domain was registered decades after it achieved independence. The UK still has the inactive .gb domain as well, but it's considering getting rid of it.

An anonymous reader shares a report: Wikipedia's "Timeline of the Far Future" is one of my favorite webpages from the internet's pre-slop era. A Londoner named Nick Webb created it on the morning of December 22, 2010. "Certain events in the future of the universe can be predicted with a comfortable level of accuracy," he wrote at the top of the page. He then proposed a chronological list of 33 such events, beginning with the joining of Asia and Australia 40 million years from now. He noted that around this same time, Mars's moon Phobos would complete its slow death spiral into the red planet's surface. A community of 1,533 editors have since expanded the timeline to 160 events, including the heat death of the universe. I like to imagine these people on laptops in living rooms and cafes across the world, compiling obscure bits of speculative science into a secular Book of Revelation.

Like the best sci-fi world building, the Timeline of the Far Future can give you a key bump of the sublime. It reminds you that even the sturdiest-seeming features of our world are ephemeral, that in 1,100 years, Earth's axis will point to a new North Star. In 250,000 years, an undersea volcano will pop up in the Pacific, adding an extra island to Hawaii. In the 1 million years that the Great Pyramid will take to erode, the sun will travel only about 1/200th of its orbit around the Milky Way, but in doing so, it will move into a new field of stars. Our current constellations will go all wobbly in the sky and then vanish.

Some aspects of the timeline are more certain than others. We know that most animals will look different 10 million years from now. We know that the continents will slowly drift together to form a new Pangaea. Africa will slam into Eurasia, sealing off the Mediterranean basin and raising a new Himalaya-like range across France, Italy, and Spain. In 400 million years, Saturn will have lost its rings. Earth will have replenished its fossil fuels. Our planet will also likely have sustained at least one mass-extinction-triggering impact, unless its inhabitants have learned to divert asteroids.

An anonymous reader quotes a report from Ars Technica: The Federal Communications Commission gave Starlink and T-Mobile emergency authority to provide satellite-to-phone coverage in areas hit by Hurricane Helene. "SpaceX and T-Mobile have been given emergency special temporary authority by the FCC to enable Starlink satellites with direct-to-cell capability to provide coverage for cell phones in the affected areas of Hurricane Helene," SpaceX said yesterday. "The satellites have already been enabled and started broadcasting emergency alerts to cell phones on all networks in North Carolina. In addition, we may test basic texting (SMS) capabilities for most cell phones on the T-Mobile network in North Carolina."

SpaceX warned of limits since the service isn't ready for a commercial rollout. "SpaceX's direct-to-cell constellation has not been fully deployed, so all services will be delivered on a best-effort basis," the company said. Starlink is being used to provide wireless emergency alerts to cell phones from all carriers in North Carolina, according to Ben Longmier, senior director of satellite engineering for SpaceX. "We are also closely monitoring Hurricane Milton and standing by ready to take action in Florida," he wrote.

The FCC said (PDF) the approval "enabl[es] SpaceX to operate Supplemental Coverage from Space (SCS) in the 1910-1915 MHz and 1990-1995 MHz frequency bands leased from T-Mobile in areas affected by the Hurricane Helene." An FCC spokesperson told Ars that the approval is for all areas affected by Hurricane Helene, although it's only active in North Carolina so far. The FCC also said (PDF) that it is granting "special temporary authorities to licensees and issuing rule waivers to help communications providers maintain and restore service, support emergency operations, and assist public safety, including search and rescue efforts." Separately, the FCC last week waived (PDF) certain Lifeline program eligibility rules to help people in disaster areas (PDF) apply for discounted phone and broadband service.