The Bay Area Newsgroup just interviewed the author of "Abolish Silicon Valley: How to liberate technology from capitalism". Q: How do you fix this broken system?

A: Overall the goal that I'm thinking about is that you have the private sector so overfunded and glorified that it seems like the only way to do things, but things could be much better serviced by the public sector without the profit motive that the private sector demands. Reclaim the wealth from capital, push back capital and fund public innovation... Right now the way it works is all these tech companies are predicated on a very particular way of regulating work and will hire people short-time and pay them nothing and not provide them with safety nets.

There are also companies that shouldn't necessarily exist. A lot of companies are being funded to do something the public sector could've provided. Instead of good public transit, we have Uber. Instead of a good social mobility system, we get paid scooters. What people want is to streamline a centralized system that is run in a way that is accountable and actually serves the public...

My Utopian view is to put tech companies in full public view. Expropriate platforms and turn them into municipal services, public services and make them open-source.

Turkey will require foreign social media companies with high internet traffic to appoint a representative in the country to address concerns raised by authorities over content on their platforms, a draft law seen by Reuters showed. From the report: Companies that do not comply with the new measure could face having their bandwith halved after 30 days by court order, and then slashed by 95% if they hold out another 30 days, it said. The law will apply to social media networks accessed by more than 1 million people daily from Turkey, the draft law said. Ankara strictly polices social media content, especially during periods such as military operations and the current coronavirus pandemic. In the three weeks to April 6, more than 3,500 social media accounts were reviewed, 616 suspects were identified and 229 were detained for "provocative" social media posts, according to the Interior Ministry.

A group of U.S. security agencies is urging the Federal Communications Commission to revoke China Telecom's permission to operate in the United States. From a report: "This recommendation reflects the substantial and unacceptable national security and law enforcement risks" associated with China Telecom's access to the U.S. telecommunications network, the agencies said in a filing at the FCC. The U.S. and China are at odds over a suite of issues such as the spread of the novel coronavirus, trade, and security of telecommunications networks. U.S. officials have moved to bar Chinese gear maker Huawei Technologies as a security threat, a assertion the company denies.

Thursday's recommendation to revoke an authorization held by China Telecom since 2007 is part of a review announced last year by the FCC, as the agency barred China Mobile Ltd. from the U.S. market. The FCC usually follows recommendations from security agencies. "The threat from China Telecom is a reflection of the threat that we see from Chinese telecommunications companies generally," said John Demers, assistant attorney general for national security. "They are beholden to the government of China both by law and in fact to do its bidding."

Signal is warning that an anti-encryption bill circulating in Congress could force the private messaging app to pull out of the U.S. market. PC Magazine reports: Since the start of the coronavirus pandemic, the free app, which offers end-to-end encryption, has seen a surge in traffic. But on Wednesday, the nonprofit behind the app published a blog post, raising the alarm around the EARN IT Act. "At a time when more people than ever are benefiting from these (encryption) protections, the EARN IT bill proposed by the Senate Judiciary Committee threatens to put them at risk," Signal developer Joshua Lund wrote in the post. Although the goal of the legislation, which has bipartisan support, is to stamp out online child exploitation, it does so by letting the U..S government regulate how internet companies should combat the problem -- even if it means undermining the end-to-end encryption protecting your messages from snoops.

If the companies fail to do so, they risk losing legal immunity under Section 230 of the Communications Decency Act, which can shield them from lawsuits concerning objectionable or illegal content posted on their websites or apps. "Some large tech behemoths could hypothetically shoulder the enormous financial burden of handling hundreds of new lawsuits if they suddenly became responsible for the random things their users say, but it would not be possible for a small nonprofit like Signal to continue to operate within the United States," Lund wrote in the blog post.

More than 3.5 million iOS users have installed "fleeceware" apps on their devices, UK security firm Sophos warned in a report published earlier this week. From a report: The term fleeceware is a new addition to the cyber-security jargon and describes apps engaging in a new form of online fraud. Coined last year by Sophos researchers, the term refers to mobile apps that abuse legal loopholes in the app trial mechanism on Android -- and now iOS. Both the Google and Apple app stores allow app makers to create trial periods for commercial/paid/subscription apps. Users can install these apps and sign-up for a trial by giving the app permission to incur a charge on the user's Play Store or App Store account. Once the trial period ends, the user is charged automatically on their card and allowed to use the app.

Apple is working on a new way to offer specific parts of third-party apps across the system without needing to have them installed, 9to5Mac has learned based on an early build of iOS 14. From a report: The feature would allow users to experience parts of an app's functionality by scanning a QR Code. If you open a link or scan a QR code today from an app that you haven't installed on your iPhone or iPad, it will open that link in Safari. Apps can provide universal links, which open the app instead of Safari when the app is installed. But that could change in the near future with a new API internally referred to as "Clips" found on iOS 14 code. As 9to5Mac has analyzed this new API, we can say that it allows developers to offer interactive and dynamic content from their apps even if you haven't installed them. The Clips API is directly related to the QR Code reader in the build we have access to, so the user can scan a code linked to an app and then interact with it directly from a card that will appear on the screen.

Internet web infrastructure company Cloudflare announced plans to drop support for Google's reCAPTCHA service and move to a new bot detection provider named hCaptcha. From a report: Cloudflare co-founder and CEO Matthew Prince said the move was motivated by Google's future plans to charge for the use of the reCAPTCHA service, which would have "added millions of dollars in annual costs" for his company, costs that Cloudflare would have undoubtedly had to unload on its customers. "That is entirely within their right," Prince said yesterday. "Cloudflare, given our volume, no doubt imposed significant costs on the reCAPTCHA service, even for Google." "If the value of the image classification training did not exceed those costs, it makes perfect sense for Google to ask for payment for the service they provide," he added.

Linux malware is real and Advanced Persistent Threat (APT) groups have been infiltrating critical servers with these tools for at least eight years, according to a new report from BlackBerry. From a report: In "Decade of the RATs: Cross-Platform APT Espionage Attacks Targeting Linux, Windows and Android," security researchers found that these groups have attacked companies around the world and across all industries with goals ranging from simple cybercrime to full-blown economic espionage. The RATs report describes how five APT groups are working with the Chinese government and the remote access trojans (RATs) the cybercriminals are using to get and maintain access to Linux servers.

According to the report, the groups appeared to be using WINNTI-style tooling to take aim at Linux servers and remain relatively undetected for almost a decade. These groups are targeting Red Hat Enterprise, CentOS, and Ubuntu Linux environments for espionage and intellectual property theft. The APT groups examined include the original WINNTI GROUP, PASSCV, BRONZE UNION, CASPER (LEAD), and a newly identified group BlackBerry researchers are tracking as WLNXSPLINTER. The BlackBerry researchers think all five groups are working together, given the distinct similarities in their preferred tools, tactics, and procedures.

"Soil gets its characteristic earthy smell from certain chemicals produced primarily by soil-dwelling bacteria called Streptomyces," reports New Scientist. But as for why these bacteria produce these odors, researchers at the Swedish University of Agriculture Science in Alnarp discovered that the smell seems to attract invertebrates that help the bacteria disperse their spores. From the report: Paul Becher at the Swedish University of Agricultural Sciences in Alnarp and his colleagues set up field traps in woodland containing colonies of Streptomyces. They thought that the smell may act as a signal to other organisms that they are poisonous, because some bacteria like Streptomyces can be toxic. Instead, the smell -- which comes from gases released by Streptomyces, including geosmin and 2-methylisoborneol (2-MIB) -- seems to attract invertebrates that help the bacteria disperse their spores. Becher and his team found that springtails -- tiny cousins of insects -- that feed on Streptomyces were drawn to the traps containing the bacterial colonies, but weren't drawn to control traps that didn't contain Streptomyces. By comparison, insects and arachnids weren't attracted to the traps containing Streptomyces. The findings have been reported in the journal Nature Microbiology.

Video conferencing company Zoom is being used by a shareholder over allegations of fraud and overstating the security protocols in place on its service. Gizmodo reports: In the lawsuit filed Tuesday in the U.S. District Court for the Northern District of California, plaintiff Michael Drieu -- on behalf of individuals who purchased Zoom securities after the company went public last year -- accuses the company of making "materially false and misleading statements" about its product and failing to disclose key information about the service. Namely, the suit cites Zoom as claiming that its product supported end-to-end encryption, when in fact it supports a different form of encryption called transport encryption -- as the Intercept reported last month -- that still allows Zoom to access data.

Additionally, the suit alleges that Zoom's security failures put users "eat an increased risk of having their personal information accessed by unauthorized parties, including Facebook," that these facts would necessarily result in a decline in users, and that the company's responses to ongoing reporting on myriad problems on the service were "misleading at all relevant times." The suit states that the fallout from these incidents was exacerbated by the covid-19 crisis, during which time users of the service jumped from just 10 million to 200 million in a matter of months as schools and organizations turned to Zoom amid social distancing measures and shelter-in-place orders. The suit cites documentation related to Zoom's IPO as evidence that the company misrepresented the security protocols in place for protecting users. Specifically, the suit states, Zoom said it offered "robust security capabilities, including end-to-end encryption, secure login, administrative controls and role-based access controls," and -- in what was clearly an embarrassing claim by the company -- that it strives "to live up to the trust our customers place in us by delivering a communications solution that "just works.'"

An anonymous reader quotes a report from Ars Technica: A study published on Wednesday by Cisco's Talos security group makes clear that the alternative isn't suitable for everyone -- namely those who may be targeted by nation-sponsored hackers or other skilled, well-financed, and determined attack groups. The researchers spent about $2,000 over several months testing fingerprint authentication offered by Apple, Microsoft, Samsung, Huawei, and three lock makers. The result: on average, fake fingerprints were able to bypass sensors at least once roughly 80 percent of the time.

The percentages are based on 20 attempts for each device with the best fake fingerprint the researchers were able to create. While Apple Apple products limit users to five attempts before asking for the PIN or password, the researchers subjected the devices to 20 attempts (that is, multiple groups of from one or more attempts). Of the 20 attempts, 17 were successful. Other products tested permitted significantly more or even an unlimited number of unsuccessful tries. Tuesday's report was quick to point out that the results required several months of painstaking work, with more than 50 fingerprint molds created before getting one to work. The study also noted that the demands of the attack -- which involved obtaining a clean image of a target's fingerprint and then getting physical access to the target's device -- meant that only the most determined and capable adversaries would succeed. The most susceptible devices were the AICase padlock and Huawei's Honor 7x and Samsung's Note 9 Android phones, "all of which were bypassed 100 percent of the time," the report says. "Fingerprint authentication in the iPhone 8, MacBook Pro 2018, and the Samsung S10 came next, where the success rate was more than 90 percent. Five laptop models running Windows 10 and two USB drives -- the Verbatim Fingerprint Secure and the Lexar Jumpdrive F35 -- performed the best, with researchers achieving a 0-percent success rate."

BuzzFeed News has learned that Google has banned the popular videoconferencing software Zoom from its employees' devices. From the report: Zoom, a competitor to Google's own Meet app, has seen an explosion of people using it to work and socialize from home and has become a cultural touchstone during the coronavirus pandemic. Last week, Google sent an email to employees whose work laptops had the Zoom app installed that cited its "security vulnerabilities" and warned that the videoconferencing software on employee laptops would stop working starting this week.

"We have long had a policy of not allowing employees to use unapproved apps for work that are outside of our corporate network," Jose Castaneda, a Google spokesperson, told BuzzFeed News. "Recently, our security team informed employees using Zoom Desktop Client that it will no longer run on corporate computers as it does not meet our security standards for apps used by our employees. Employees who have been using Zoom to stay in touch with family and friends can continue to do so through a web browser or via mobile.â Earlier this month, Elon Musk's SpaceX also banned employees from Zoom, citing "significant privacy and security concerns." And on Monday, New York City's Department of Education urged schools to abandon Zoom and switch to a service from Microsoft.

Tail OS, an operating system optimized for privacy and anonymity, has released version 4.5 this week, the first version that supports a crucial security feature named UEFI Secure Boot. From a report: Secure Boot works by using cryptographic signatures to verify that firmware files loaded during a computer's boot-up process are authentic and have not been tampered. If any of the firmware checks fail, Secure Boot has the authority to stop the boot process, preventing the operating system from launching. The feature has been available as part of the UEFI specification for almost two decades but is rarely used. The reason is because not all firmware vendors cryptographically sign their files, leaving the door open to verification errors that -- when Secure Boot is enabled -- block many operation systems from launching.

In ordinary times, they moved among us largely unnoticed. Now we can't get enough of them. The Covid-19 pandemic has thrust once-anonymous IT support workers into a new role: corporate saviors. From a report: As millions of employees make the transition from well-maintained office equipment to jury-rigged kitchen table setups, information technology departments have been called upon to keep companies online and connected. Requests range in size and scale, from replacing employees' $5 mouses, to speeding up networks, to keeping multimillion-dollar data centers up and running. For many departments, the result has been virtually unprecedented workloads. On March 12, Qualcomm told all staff to prepare to start working remotely in three days. Vice president of IT infrastructure, Zeeshan Sabir, and his team then worked about 72 hours straight trying to prepare a lot of laptops for secure, remote access and get other corporate systems ready. "I just saw heroics," he said. "I didn't see a blip of complaint from anyone."

[...] The way most IT departments are set up has meant many directors have been juggling major issues alongside relatively minor ones. At Bay Area transit agency SamTrans, IT manager Edward Kelly got help from AT&T to quickly increase the speed of connections to the agency's networks once its 200 employees made the switch to remote work. At the same time, Kelly's team of five was flooded by calls from employees who'd forgotten their computer password and guessed wrong too many times. He said he's also hoping people learn to use the "reply-all" button on group emails more sparingly. As many employees' home computers infuriate them, tensions can run high, said Jennifer Reed, a consultant at IT outsourcing firm Viqtor Davis North America.

An anonymous reader quotes a report from ZDNet: The new normal telecommuting may be a bit more permanent than realized, as 74% of CFOs say they expect to move previously on-site employees remote post-COVID-19, according to a Gartner survey. The survey, which had 317 CFO respondents on March 30, highlighted how remote work may become more of the norm as companies look to cut commercial real estate costs. Gartner found that almost a quarter of respondents said they will move at least 20% of their on-site employees to remote work permanently. The research firm is taking the pulse of the COVID-19 CXO shifts in a series of surveys.

Among the key shifts from CFOs and enterprises as they manage cash via COVID-19 shutdowns:
- 81% of CFOs plan to exceed their contractual obligations to hourly workers and to fund that they are using remote work to offer flexible schedules and maintain operations.
- 90% of CFOs said their accounting close operations will be able to run effectively without disruptions off-site.
- 20% of CFOs said they are cutting their on-premise technology spending with 12% planning the same move.
- 13% of CFOs have already cut real estate expenses with another 9% planning cuts in the months to come.

An anonymous reader quotes a report from Ars Technica: A padlock -- whether it uses a combination, a key, or "smart" tech -- has exactly one job: to keep your stuff safe so other people can't get it. Tapplock, Inc., based in Canada, produces such a product. The company's locks unlock with a fingerprint or an app connected by Bluetooth to your phone. Unfortunately, the Federal Trade Commission said, the locks are full of both digital and physical vulnerabilities that leave users' stuff, and data, at risk. The FTC's complaint (PDF) against Tapplock, released Monday, basically alleges that the company misrepresented itself, because it marketed its products as secure and tested when they were neither. A product -- any product -- simply being kind of crappy doesn't necessarily fall under the FTC's purview. Saying untrue things about your product in your advertisement or privacy policy, however, will make the commission very unhappy with you indeed.

The lock may be built with "7mm reinforced stainless steel shackles, strengthened by double-layered lock design with anti-shim and anti-pry technologies," as Tapplock's website promises, but according to the FTC, perhaps it should have considered anti-screwdriver technologies. As it turns out, a researcher was able to unlock the lock "within a matter of seconds" by unscrewing the back panel. Oops. The complaint also pointed to several "reasonably foreseeable" software vulnerabilities that the FTC alleges Tapplock could have avoided if the company "had implemented simple, low-cost steps."

One vulnerability security researchers identified allowed a user to bypass the account authentication process entirely in order to gain full access to the account of literally any Tapplock user, including their personal information. And how could this happen? "A researcher who logged in with a valid user credential could then access another user's account without being re-directed back to the login page, thereby allowing the researcher to circumvent Respondent's authentication procedures altogether," the complaint explains. A second vulnerability allowed researchers the ability to access and unlock any lock they could get close enough to with a working Bluetooth connection. That's because Tapplock "failed to encrypt the Bluetooth communication between the lock and the app," leaving the data wide open for the researchers to discover and replicate. The third vulnerability outlined in the complaint also has to do with a failure to secure communication data. That app that allows "unlimited" connections? The primary owner can of course add and revoke authorized users from the lock. But someone whose access was revoked could still access the lock because the vulnerability allowed for sniffing out the relevant data packets. As part of the settlement, the FTC is requiring Tapplock to create a security program for its products. "That program is required to include training for employees; timely disclosure of 'covered incidents,' including both loss of personal information and also unauthorized access to systems; actual penetration testing of the network; and several other elements, including annual review," reports Ars Technica.

An anonymous reader shares an excerpt from a report via BuzzFeed News: A group inside Apple called Information Systems & Technology, or IS&T, builds much of the company's internal technology tools -- from servers and data infrastructure to retail and corporate sales software -- and operates in a state of tumult. IS&T is made up largely of contractors hired by rival consulting companies, and its dysfunction has led to a rolling state of war. "It's a huge contractor org that handles a crazy amount of infrastructure for the company," one ex-employee who worked closely with IS&T told me. "That whole organization is a Game of Thrones nightmare." Interviews with multiple former IS&T employees and its internal clients paint a picture of a division in turmoil, where infighting regularly prevents the creation of useful software, and whose contract workers are treated as disposable parts.

"There's a Cold War going on every single day," Archana Sabapathy, a former IS&T contractor who did two stints in the division, told me. Sabapathy's first stint at IS&T lasted more than three years, the second only a day. Inside the division, she said, contracting companies such as Wipro, Infosys, and Accenture are constantly fighting to fill roles and win projects, which are handed out largely on the basis of how cheaply they can staff up to Apple's needs. "They're just fighting for the roles," Sabapathy told me. "That's all they care about, not the work, not the deliverables, the effort they put in, or even talent. They're not looking for any of those aspects." IS&T is thus filled with vendor tribalism, where loyalty to one's contracting company trumps all. "Making a friendship is -- like you wouldn't even think about that," Sabapathy told me, speaking of cross-vendor relationships. "It's not the traditional American way of working anymore. You build relationships when you come to work because you spend most of your time here -- that's not there." "Sabapathy told [BuzzFeed's Alex Kantrowitz] Apple employees' expectations for their IS&T contractors were unrealistic given that they saw the sum total they were paying the consulting companies ($150 to $120 an hour, she said) but the contractors themselves were making much less ($40 to $55 an hour) after the companies took their cut," writes Kantrowitz. "The approach leaves Apple with lesser contractors but the same high demands, a recipe for disappointment."

In closing, Kantrowitz suggests if Apple wants to become inventive again, "it will need to give its employees more time to develop new ideas." He adds: "IS&T could therefore become a division of strength at Apple one day, building tools that minimize work that supports existing products while making room for those ideas. But until Apple gives the division a hard look, its employees will be stuck spending their time reworking broken internal software, and wishing they were inventing instead."

Just days after SoftBank announced that it would not consummate its $3 billion tender offer for WeWork shares that would have bought out some of the equity held by the company's co-founder Adam Neumann along with venture capital firms like Benchmark and many individual company employees, the company is now retaliating, suing SoftBank over alleged breach of contract and breach of fiduciary duty. TechCrunch reports: In a press statement this morning, the Special Committee of WeWork's board said that it "regrets the fact that SoftBank continues to put its own interests ahead of those of WeWork's minority stockholders." WeWork's Special Committee argues that SoftBank already received the benefits of the contract it signed last year, which included board control provisions. It's demanding that SoftBank either complete the transaction, or offer cash to cover damages related to its scuttling of the deal. Under the terms of the tender offer proposed in November last year, SoftBank would buy upwards of $3 billion in shares from existing shareholders with the transaction closing at the beginning of April. As part of the terms of that contract, the co-working company and SoftBank agreed to a set of performance milestones that WeWork agreed to meet in exchange for the secondary liquidity. Such terms are customary in most financial transactions.

SoftBank in its statement last week said that WeWork failed to meet a number of those performance requirements, and said that it was within its rights under the tender offer contract to walk away from the deal. WeWork's financials have been rocked by the global pandemic of novel coronavirus, which has seen the company's co-working facilities mostly closed worldwide as part of public health mandates for social distancing. Given the disagreement between the parties, a lawsuit was all but inevitable.

Google is now backing a standard proposed by Apple engineers in January to create a default format for one-time passcodes (OTP) sent via SMS to users during the two-factor authentication (2FA) process. From a report: The standard, proposed by Apple engineers working on the Safari WebKit project, has now reached the status of official Web Platform Incubator Community Group (WICG) specification draft. "We've moved 'Origin-bound one-time codes delivered via SMS' to @wicg_, where we're working on a shared spec with our collaborators at Google. Please take a look! Updated explainer, and specification," wrote Apple's Ricky Mondello. The proposal aims to fix some issues with the current state of SMS 2FA/OTP codes, all of which have different formats, unique per the websites sending the codes.

Samsung is killing its Smart View app for Android and iOS, which serves as a remote control for its older smart TVs. From a report: The company has updated the application's descriptions to announce that it will no longer be supported starting on October 5th. Android Police first spotted the changes and noted that, in addition to its capability as a remote control, Smart View can also beam music and media to the company's TVs. It's unclear how Samsung defines "older" -- hence which all models will be impacted.