An anonymous reader writes: Hackers have gained access to the core infrastructure of LineageOS, a mobile operating system based on Android, used for smartphones, tablets, and set-top boxes. The intrusion took place on Saturday night at around 8 pm (US Pacific coast), and was detected before the attackers could do any harm, the LineageOS team said in a statement published less than three hours after the incident. The LineageOS team said the operating system's source code was unaffected, and so were any operating system builds, which had been already paused since April 30, because of an unrelated issue. Signing keys, used to authenticate official OS distributions, were also unaffected, as these hosts were stored separately from the LineageOS main infrastructure. LineageOS developers said the hack took place after the attacker used an unpatched vulnerability to breach its Salt installation.

Microsoft is confirming today that it's planning to refocus Windows 10X on single-screen devices. "The world is a very different place than it was last October when we shared our vision for a new category of dual-screen Windows devices," explains Panos Panay, Microsoft's Windows and devices chief. From a report: "With Windows 10X, we designed for flexibility, and that flexibility has enabled us to pivot our focus toward single-screen Windows 10X devices that leverage the power of the cloud to help our customers work, learn and play in new ways." Microsoft isn't saying exactly when single-screen devices like laptops will support Windows 10X, nor when dual-screen devices will launch with the OS. However, Windows 10X will launch on single-screen devices first. "We will continue to look for the right moment, in conjunction with our OEM partners, to bring dual-screen devices to market," says Panay. Microsoft is reprioritizing Windows 10X for laptops and single-screen devices because of the coronavirus pandemic. The software maker has seen a 75 percent year-over-year increase in the time spent in Windows 10. More people are turning to using their laptops or PCs instead of a smartphone or tablet during the lockdowns we've seen worldwide to work or study.

Academics from an Israeli university have published new research last week showing how an attacker could turn a computer's power supply unit into a rudimentary speaker that can secretly transmit data from an infected host using audio waves. From a report: The technique, named POWER-SUPPLaY, is the work of Mordechai Guri, the head of R&D at the Ben-Gurion University of the Negev, in Israel. Over the last half-decade, Guri has been pioneering research into new covert data exfiltration channels. The techniques Guri has been developing can be used for stealing data through unconventional means. Guri has been developing these techniques specifically for extracting data from air-gapped systems -- computers isolated on local networks with no internet access. Such computers are often used on government or corporate networks to store sensitive data, such as classified files or intellectual property. Air-gapped systems are protected by several layers of defenses, on top of the "air gap," and you need novel data transmission techniques to go around these defenses. For example, some air-gapped systems don't have speakers, because it's been proven in the past that speakers could be abused to leak information from a secure system using inaudible sound waves.

This week long-time open source advocate Matt Asay warned employers that the best way to keep their developers happy was to let them contribute to open source projects: SlashData recently surveyed over 16,000 developers to see what makes them tick... what they care about. The data is collected in SlashData's State of the Developer Nation, though let me give you the tl;dr: 59% of developers contribute to open source software today. Why do they contribute? The top two reasons are: To improve coding skills and because they believe in open source.

Want to keep those developers happy and employed with you? Let them contribute...

[Y]our employees want to contribute both code and knowledge — they want to be part of something. Talking to Bert Hubert, founder of PowerDNS, a supplier of open source DNS software, services, and support, he stressed that an open source project must be "a fun place where people feel that they are learning things, that they're contributing things, that they're being valued." Perhaps not surprisingly, these are the same elements developers expect from their employers. By making open source a valued part of workplace expectations, employers tick both boxes.

Is it an absolute requirement that you encourage your developers to contribute to open source projects? No. But many of your best developers will chafe at keeping their talents locked up behind the firewall, and other developers simply won't apply if you have a reputation for being an open source scrooge.
The article was written by Matt Asay, a former COO of Canonical now working at AWS. (Right before becoming Canonical's COO, Matt answered questions from Slashdot readers).

The survey he cites also found that out of 17,000 developers they talked to, just 3% said they were paid to contribute to open source.

The other 97% contributed for free.

An anonymous reader quotes Infosecurity magazine: New research from Barracuda Networks has revealed that cyber-criminals are increasingly using official reCAPTCHA walls to disguise malicious content from email security systems and trick unsuspecting users... [S]ophisticated scammers are beginning to use the Google-owned service to prevent automated URL analysis systems from accessing the actual content of phishing pages, and to make phishing sites more believable in the eyes of the victim, Barracuda Networks warned.

In fact, the security solutions provider observed a single phishing campaign that sent out 128,000 emails to a variety of organizations and employees using reCAPTCHA walls to conceal fake Microsoft log-in pages. This campaign used the lure of a voicemail receipt to fool users into solving the reCAPTCHA wall before being redirected to the malicious page, with any log-in info entered then sent straight to the scammers.

"The man behind the world's first major computer virus outbreak has admitted his guilt, 20 years after his software infected millions of machines worldwide," reports the BBC: Filipino Onel de Guzman, now 44, says he unleashed the Love Bug computer worm to steal passwords so he could access the internet without paying. He claims he never intended it to spread globally.

And he says he regrets the damage his code caused. "I didn't expect it would get to the US and Europe. I was surprised," he said in an interview for Crime Dot Com, a forthcoming book on cyber-crime.

The Love Bug pandemic began on 4 May, 2000. Victims received an email attachment entitled LOVE-LETTER-FOR-YOU. It contained malicious code that would overwrite files, steal passwords, and automatically send copies of itself to all contacts in the victim's Microsoft Outlook address book. Within 24 hours, it was causing major problems across the globe, reportedly infecting 45 million machines...

He claims he initially sent the virus only to Philippine victims, with whom he communicated in chat rooms, because he only wanted to steal internet access passwords that worked in his local area. However, in spring 2000 he tweaked the code, adding an auto-spreading feature that would send copies of the virus to victims' Outlook contacts using a flaw in Microsoft's Windows 95 operating system.
"It's not really a virus," wrote CmdrTaco back on May 4, 2000. "It's a trojan that proclaims its love for the recipient and requests that you open its attachment. On a first date even! It then loves you so much that it sends copies of itself to everyone in your address book and starts destroying files on your drive...

"Pine/Elm/Mutt users as always laugh maniacally as the trojan shuffles countless wasted packets over saturated backbones filling overworked SMTP servers everywhere. Sysadmins are seen weeping in the alleys."

Researchers at the email security company Abnormal Security have discovered "a multi-prong Microsoft Teams impersonation attack" involving "convincingly-crafted emails impersonating the automated notification emails from Microsoft Teams," reports Forbes: The aim, simply to steal employee Microsoft Office 365 login credentials. To date, the researchers report that as many as 50,000 users have been subject to this attack as of May 1.

This is far from your average phishing scam, however, and comes at precisely the right time to fool already stressed and somewhat disoriented workers. Instead of the far more commonly used "sort of look-alike" alerts and notifications employed by less careful cybercriminals, this new campaign is very professional in approach. "The landing pages that host both attacks look identical to the real webpages, and the imagery used is copied from actual notifications and emails from this provider," the researchers said. The attackers are also using newly-registered domains that are designed to fool recipients into thinking the notifications are from an official source...

As far as the credential-stealing payload is concerned, this is delivered in an equally meticulous way. With multiple URL redirects employed by the attackers, concealing the real hosting URLs, and so aiming to bypass email protection systems, the cybercriminals will eventually drive the user to the cloned Microsoft Office 365 login page.

"The COVID crisis has led to a 35% drop in live projects" says Kickstarter communications officer David Gallagher -- who points out that fees on those projects are the company's sole source of income. This led Kickstarter's CEO to announce "sweeping layoffs of up to 45 percent of employees," the union of Kickstarter employees tells Gizmodo. (Though Gallagher says the final numbers will first include some voluntary buyouts, followed by a re-assessment to "better understand the scale of any layoffs that may be required.")

But Kickstarter is also the first major tech company to unionize. So what happened next? An anonymous reader shares this report from the two-months-old Kickstarter United (KSRU) union: The bargaining unit was faced with the prospect of involuntary layoffs with two to three weeks of severance per year of employment in the midst of a global pandemic... After two weeks of bargaining, we negotiated a severance package that we are incredibly proud of, which has been unanimously ratified by KSRU.

The package prioritizes extended severance payments and health insurance coverage, and we were inspired to see dozens of our highest-paid colleagues volunteer to take layoffs in order to save jobs and increase payouts for lower-paid bargaining unit members. We also negotiated additional terms that are previously unheard-of in tech severance agreements, fulfilling another of our longstanding goals: moving our industry forward and demonstrating the necessity of organizing in tech.

The terms we won for our 86-member bargaining unit include:

- Four months of severance pay for all laid-off employees, both voluntary and involuntary.

- Continuing healthcare coverage increased by salary: four months for our higher-paid colleagues, and six months for those who make less than the bargaining unit's median salary.

- Recall rights for a full year, so that if an eliminated position becomes open again in the future, qualified laid-off workers will have priority consideration in filling it.

- A release from the non-compete and a modification of the non-solicitation clauses included in our original hiring agreements — an allowance unprecedented in tech that will enable our members to pursue new avenues of employment unfettered...

This experience has shown us how crucial it is for tech workers to unite, to leverage our collective strength, and to focus on lifting each other up and protecting one another. Kickstarter United is committed to standing alongside workers everywhere, helping to bring our collective visions for a fairer, more just world to life.

"Job interviews are broken," according to a recent New York Times piece by an organizational psychologist at Wharton who argues that his profession has "over a century of evidence on why job interviews fail and how to fix them..." The first mistake is asking the wrong kinds of questions. Some questions are just too easy to fake. What's your greatest weakness? Even Michael Scott, the inept manager in the TV show "The Office," aced that one: "I work too hard. I care too much...." Brainteasers turn out to be useless for predicting job performance, but useful for identifying sadistic managers, who seem to enjoy stumping people.

We're better off asking behavioral questions. Tell me about a time when... Past behavior can help us anticipate future behavior. But sometimes they're easy to game, especially for candidates with more experience... The second error is focusing on the wrong criteria. At banks and law firms, managers often favor people who went to the same school or share their love of lacrosse... A third problem: Job interviews favor the candidates who are the best talkers...

My favorite antidote to faking is to focus less on what candidates say, and more on what they do. Invite them to showcase their skills by collecting a work sample -- a real piece of work that they produced... Credentials are overrated, and motivation is underrated. It doesn't matter how much experience people have if they lack the drive to think creatively, work collaboratively and keep on learning.
The article's subheading argues "Instead of focusing on credentials, let's give candidates the chance to showcase their will and skill to learn." Any Slashdot readers want to share their own experiences?

And are job interviews broken?

Christopher Wray, the FBI director who has been one of the fiercest critics of encryption under the Trump administration, previously worked as a lawyer for WhatsApp, where he defended the practice, according to new court filings. From a report: The documents, which were released late on Wednesday night as part of an unrelated matter, show Wray worked for WhatsApp in 2015 while he was an attorney for the Washington law firm of King & Spalding. While there are sparse details about the precise nature of the work, the filings indicate that Wray strongly defended the need for end-to-end encryption in his previous representation of WhatsApp, the popular messaging application owned by Facebook. Wray's earlier work -- which has not previously been public -- contradicts his current position on encryption, which protects users' communications and other data from being read by outsiders. The Trump administration and major technology companies like Facebook have been at odds over the need to offer customers encryption services, with the White House and law enforcement officials arguing the technology represents a security risk by protecting the communication of terrorists and criminals.

An anonymous reader writes: Browser maker Mozilla is working on a new service called Private Relay that generates unique aliases to hide a user's email address from advertisers and spam operators when filling in online forms. The service entered testing last month and is currently in a closed beta, with a public beta currently scheduled for later this year, ZDNet has learned. Private Relay will be available as a Firefox add-on that lets users generate a unique email address -- an email alias -- with one click. The user can then enter this email address in web forms to send contact requests, subscribe to newsletters, and register new accounts. "We will forward emails from the alias to your real inbox," Mozilla says on the Firefox Private Relay website. "If any alias starts to receive emails you don't want, you can disable it or delete it completely," the browser maker said.

An anonymous reader quotes a report from The New York Times: Millions of people gave their email addresses to Quibi, JetBlue, Wish and other companies (Warning: source may be paywalled; alternative source) -- and those email addresses got away. They ended up in the hands of advertising and analytics companies like Google, Facebook and Twitter, leaving the people with those email addresses more easily targeted by advertisers and able to be tracked by companies that study shopping behavior, according toa reportpublished on Wednesday. The customers unwittingly exposed their email addresses when signing up for apps or clicking on links in marketing emails, said the researcher Zach Edwards, who runs the digital strategy firm Victory Medium. In the report, he described the giveaway of personal data as part of a "sloppy and dangerous growth hack."

Mr. Edwards, a contributor to a recent studythat examined potential privacy violations by dating services like Grindr and OkCupid, wrote in the new report that one of the "most egregious" leaks involvedQuibi, a short-form video platform based in Los Angeles that is run by the veteran executives Jeffrey Katzenberg and Meg Whitman. Quibi went live on April 6, long after new data privacy regulations went into effect in Europe and California. People who downloaded the Quibi app were asked to submit their email addresses. Then they received a confirmation link. Clicking on the link made their email addresses available to Google, Facebook, Twitter and Snapchat, according to the report. Quibi said in a statement on Wednesday that data security "is of the highest priority" and that "the moment the issue on our webpage was revealed to our security and engineering team, we fixed it immediately." "Mr. Edwards said customers were probably unaware of leaks at Wish, an e-commerce platform where hundreds of millions of email addresses were most likely exposed starting in 2018," the report adds. "When users clicked on links in marketing emails from the company, their email addresses were shared with Google, Facebook, Pinterest, PayPal and others, he wrote."

Other companies that suffered limited leaks included The Washington Post, JetBlue, and Mailchimp.

WhatsApp has alleged in new court filings that an Israeli spyware company used US-based servers and was "deeply involved" in carrying out mobile phone hacks of 1,400 WhatsApp users, including senior government officials, journalists, and human rights activists. The Guardian reports: The new claims about NSO Group allege that the Israeli company bears responsibility in serious human rights violations, including the hacking of more than a dozen Indian journalists and Rwandan dissidents. For years, NSO Group has said that its spyware is purchased by government clients for the purpose of tracking down terrorists and other criminals and that it had no independent knowledge of how those clients -- which in the past have reportedly included Saudi Arabia and Mexico -- use its hacking software.

But a lawsuit filed by WhatsApp against NSO Group last year -- the first of its kind by a major technology company -- is revealing more technical details about how the hacking software, Pegasus, is allegedly deployed against targets. In the court filings last week, WhatsApp said its own investigation into how Pegasus was used against 1,400 users last year showed that servers controlled by NSO Group -- not its government clients -- were an integral part of how the hacks were executed. WhatsApp has said victims of the hack received phone calls using its messaging app, and were infected with Pegasus. Then, it said: "NSO used a network of computers to monitor and update Pegasus after it was implanted on users' devices. These NSO-controlled computers served as the nerve centre through which NSO controlled its customers' operation and use of Pegasus."

NSO has said in legal filings that it has no insight into how government clients use its hacking tools, and therefore does not know who governments are targeting. But one expert, John Scott-Railton of Citizen Lab, who has worked with WhatsApp on the case, said NSO's control of the servers involved in the hack suggests the company would have had logs, including IP addresses, identifying the users who were being targeted. "Our products are used to stop terrorism, curb violent crime, and save lives. NSO Group does not operate the Pegasus software for its clients," the company said in a statement. "Our past statements about our business, and the extent of our interaction with our government intelligence and law enforcement agency customers, are accurate."

The US National Security Agency (NSA) published last week a security assessment of today's most popular video conferencing, text chatting, and collaboration tools. From a report: The guidance contains a list of security criteria that the NSA hopes companies take into consideration when selecting which telework tool/service they want to deploy in their environments. The NSA document is not only meant for US government and military entities but the private sector as well. The idea behind the NSA's initiative is to give military, public, and private organizations an overview of all of a tools' features, so IT staff don't make wrong decisions, expecting that a tool provides certain features that are not actually living up to the reality. Per the NSA's document, the assessed criteria answers to basic questions like:

Does the service implement end-to-end (E2E) encryption?
Does the E2E encryption use strong, well-known, testable encryption standards?
Is multi-factor authentication (MFA) available?
Can users see and control who connects to collaboration sessions?
Does the tool's vendor share data with third parties or affiliates?
Do users have the ability to securely delete data from the service and its repositories as needed (both on client and server-side)?
Is the tool's source code public (e.g. open source)?
Is the service FedRAMP approved for official US government use?

Google announced this week new rules for the Chrome Web Store in an attempt to cut down the number of shady Chrome extensions submitted and listed on the site. From a report: Starting August 27, Google says it intends to enforce a new set of rules, which will result in a large number of extensions being delisted. These rules are meant to crack down on a series of practices extension developers have been recently employing to flood the Web Store with shady extensions or boost install counts for low-quality content. They include:
1. Developers cannot submit duplicate extensions anymore. (e.g. Wallpaper extensions that have different names but provide the user with the same wallpapers when installed.)
2. Extensions are not allowed to use "keyword spam" techniques to flood metadata fields with multiple terms and have the extension listed across multiple categories to improve the extension's visibility in search results.
3. Developers are not allowed to use misleading, improperly formatted, non-descriptive, irrelevant, excessive, or inappropriate metadata. Extension metadata needs to be accurate, and Google intends to be strict about it.
4. Developers are now forbidden from inflating product ratings, reviews, or install counts by illegitimate means, such as fraudulent or paid downloads, reviews, and ratings.

About a year ago, Microsoft launched Visual Studio Online, its online code editor based on the popular Visual Studio Code project. It')s basically a full code editor and hosted environment that lives in your browser. Today, the company announced that it is changing the name of this service to Visual Studio Codespaces. It's also dropping the price of the service by more than 50% and giving developers the option to run it on relatively low-performance virtual machines that will start at $0.08 per hour. In today's announcement, Microsoft's Scott Hanselman points out that the company learned that most developers who used Visual Studio Online thought of it as being much more than simply an editor in the browser.

As our lives have become a seemingly endless series of work meetings on Zoom and FaceTime or WhatsApp catch-ups with friends, we're all getting a bit sick of seeing people's faces enclosed in a cold, almost lifeless, digital frame. A tech worker from New York had a different idea for his tech conference, which he announced, in all seriousness, on April Fools' Day. The free conference is called Deserted Island DevOps and is happening on Thursday, entirely inside Animal Crossing, the Nintendo Switch hit game released in the midst of the Coronavirus pandemic. From a report: Speakers are doing their talks on an island in Animal Crossing specifically built for the conference, and attendees can follow along in the game, on Twitch, or Zoom, as a fallback option. Other than the unusual, and incredibly colorful and fun setting, the conference is very much like any other conference. The speakers' avatars are standing behind a podium, their slides are being displayed next to them, and attendees sit in the audience. Crucially, the conference isn't about Animal Crossing, it's kind of a standard software development type conference. It just happens to be happening inside a video game.

The Raspberry Pi can be used for all sorts of maker projects, and the foundation has offered camera modules for it since 2013, adding vision-related functionality. The first module was a modest 5-megapixel affair that was eventually replaced by an 8-megapixel Sony sensor four years ago. Today, sees the arrival of a new much higher 12.3 megapixel quality camera, and a range of interchangeable lenses. From a report: The new camera is compatible with all Raspberry Pi models -- from Pi 1 Model B onwards -- with the exception of early Pi Zero boards. The camera is available to buy from today for $50.

Before life can safely return to normalcy, we'll need an enormous increase in our ability to perform contact tracing -- identifying and contacting everyone who's been in contact with a person infected with COVID-19 so that they in turn can hunker down in quarantine and avoid infecting others. But, as Ars Technica reports, there are two huge problems with the massive contact-tracing platform that Google and Apple are working on. "First, billions of phones won't be able to use the tech," reports Ars. "And second: even among those who could, a solid half of Americans would refuse to because they don't trust insurers or tech companies with their health data." From the report: The 82 percent of US adults who have smartphones are exactly split on the issue, according to poll data released today by The Washington Post and University of Maryland. Half of the poll respondents said they probably or definitely would use a contact-tracing app, and the remaining half said they probably or definitely would not. While a majority of respondents (57 percent) expressed a reasonable amount of trust in public health agencies, less than half (47 percent) said they trust health insurance firms, and only 43 percent said they trust tech firms such as Google or Apple. Overall, the poll indicates that only 41 percent of American adults have both the technological capacity and the will to use a contact-tracing app. That's a problem, as research suggests that digital tracing would have to reach about 60 percent of the population to be most effective.

Face ID was a great idea -- until large swathes of the world were forced to wear face masks, rendering it largely useless. Apple has apparently heard our pain. From a report: Users are reporting a subtle new feature in the latest developer version of iOS 13.5 that will make it easier to unlock your iPhone without having to take off your protective face mask. Videos shared on Twitter by Robert Petersen and Guilherme Rambo show that Apple devices with Face ID will jump to the backup passcode-entry screen if it detects a mask. That's not only helpful if you're unlocking your phone dozens of times a day -- which we all do -- but it's also helping to keep people safe by not forcing users to take off their masks and potentially exposing themselves to the virus.