Intel has told lawmakers and officials that it is delaying indefinitely the groundbreaking ceremony for a planned multibillion-dollar chip-manufacturing facility in Ohio, signaling frustration over uncertainty in Congress about legislation that would provide support for the U.S. chip industry. From a report: The ceremony had been tentatively scheduled for July 22. Intel informed the office of Ohio Gov. Mike DeWine and members of Ohio's congressional delegation on Wednesday that it was delaying the groundbreaking "due in part to uncertainty around" the chips-related legislation, known as the Bipartisan Innovation Act, according to an email reviewed by The Wall Street Journal.

Intel still plans to build the facility and hasn't pushed back the start of construction, said Intel spokesman Will Moss. Intel, which announced the plant plans in January, said it intended to invest at least $20 billion in the Ohio facility, with construction expected to begin in late 2022 and production to start in 2025. The company said in its announcement that spending on the Ohio project could reach around $100 billion over the next decade, but that the expansion depends in part on progress on the U.S. chips legislation.

An anonymous reader quotes a report from BleepingComputer: The National Security Agency (NSA) and cybersecurity partner agencies issued an advisory today recommending system administrators to use PowerShell to prevent and detect malicious activity on Windows machines. PowerShell is frequently used in cyberattacks, leveraged mostly in the post-exploitation stage, but the security capabilities embedded in Microsoft's automation and configuration tool can also benefit defenders in their forensics efforts, improve incident response, and to automate repetitive tasks. The NSA and cyber security centers in the U.S. (CISA), New Zealand (NZ NCSC), and the U.K. (NCSC-UK) have created a set of recommendations for using PowerShell to mitigate cyber threats instead of removing or disabling it, which would lower defensive capabilities.

Reducing the risk of threat actors abusing PowerShell requires leveraging capabilities in the framework such as PowerShell remoting, which does not expose plain-text credentials when executing commands remotely on Windows hosts. Administrators should be aware that enabling this feature on private networks automatically adds a new rule in Windows Firewall that permits all connections. Customizing Windows Firewall to allow connections only from trusted endpoints and networks helps reduce an attacker's chance for successful lateral movement. For remote connections, the agencies advise using the Secure Shell protocol (SSH), supported in PowerShell 7, to add the convenience and security of public-key authentication:

- remote connections don't need HTTPS with SSL certificates
- no need for Trusted Hosts, as required when remoting over WinRM outside a domain
- secure remote management over SSH without a password for all commands and connections
- PowerShell remoting between Windows and Linux hosts

Another recommendation is to reduce PowerShell operations with the help of AppLocker or Windows Defender Application Control (WDAC) to set the tool to function in Constrained Language Mode (CLM), thus denying operations outside the policies defined by the administrator. Recording PowerShell activity and monitoring the logs are two recommendations that could help administrators find signs of potential abuse. The NSA and its partners propose turning on features like Deep Script Block Logging (DSBL), Module Logging, and Over-the-Shoulder transcription (OTS). The first two enable building a comprehensive database of logs that can be used to look for suspicious or malicious PowerShell activity, including hidden action and the commands and scripts used in the process. With OTS, administrators get records of every PowerShell input or output, which could help determine an attacker's intentions in the environment. The full document, titled "Keeping PowerShell: Security Measures to Use and Embrace" is available here (PDF).

An anonymous reader quotes a report from TechCrunch: Another strike against use of Google Analytics in Europe: The Italian data protection authority has found a local web publisher's use of the popular analytics tool to be non-compliant with EU data protection rules owing to user data being transferred to the U.S. -- a country that lacks an equivalent legal framework to protect the info from being accessed by US spooks. The Garante found the web publisher's use of Google Analytics resulted in the collection of many types of user data, including device IP address, browser information, OS, screen resolution, language selection, plus the date and time of the site visit, which were transferred to the U.S. without adequate supplementary measures being applied to raise the level of protection to the necessary EU legal standard.

Protections applied by Google were not sufficient to address the risk, it added, echoing the conclusion of several other EU DPAs who have also found use of Google Analytics violates the bloc's data protection rules over the data export issue. Italy's DPA has given the publisher in question (a company called Caffeina Media Srl) 90 days to fix the compliance violation. But the decision has wider significance as it has also warned other local websites that are using Google Analytics to take note and check their own compliance, writing in a press release [translated from Italian with machine translation]: "[T]he Authority draws the attention of all Italian managers of websites, public and private, to the illegality of transfers made to the United States through GA [Google Analytics], also in consideration of the numerous reports and questions that are being received by the Office, and invites all data controllers to verify the compliance of the methods of use of cookies and other tracking tools used on its websites, with particular attention to Google Analytics and other similar services, with the legislation on the protection of personal data." A Google spokesperson issued the following statement: "People want the websites they visit to be well designed, easy to use, and respectful of their privacy. Google Analytics helps publishers understand how well their sites and apps are working for their visitors -- but not by identifying individuals or tracking them across the web. These organizations, not Google, control what data is collected with these tools, and how it is used. Google helps by providing a range of safeguards, controls and resources for compliance."

Google is reviewing the Italian DPA's decision, according to the spokesperson.

The group responsible for developing and updating the PCI Express standard, the PCI-SIG, aims to update that standard roughly every three years. From a report: Version 6.0 was released earlier this year, and the group has announced that PCIe version 7.0 is currently on track to be finalized sometime in 2025. Like all new PCI Express versions, its goal is to double the available bandwidth of its predecessor, which in PCIe 7.0's case means that a single PCIe 7.0 lane will be able to transmit at speeds of up to 32GB per second. That's a doubling of the 16GB per second promised by PCIe 6.0, but it's even more striking when compared to PCIe 4.0, the version of the standard used in high-end GPUs and SSDs today. A single PCIe 4.0 lane provides bandwidth of about 4GB per second, and you need eight of those lanes to offer the same speeds as a single PCIe 7.0 lane.

Increasing speeds opens the door to ever-faster GPUs and storage devices, but bandwidth gains this large would also make it possible to do the same amount of work with fewer PCIe lanes. Today's SSDs normally use four lanes of PCIe bandwidth, and GPUs normally use 16 lanes. You could use the same number of lanes to support more SSDs and GPUs while still providing big increases in bandwidth compared to today's accessories, something that could be especially useful in servers.

At its re:Mars conference, Amazon today announced the launch of CodeWhisperer, an AI pair programming tool similar to GitHub's Copilot that can autocomplete entire functions based on only a comment or a few keystrokes. From a report: The company trained the system, which currently supports Java, JavaScript and Python, on billions of lines of publicly available open-source code and its own codebase, as well as publicly available documentation and code on public forums. It's now available in preview as part of the AWS IDE Toolkit, which means developers can immediately use it right inside their preferred IDEs, including Visual Studio Code, IntelliJ IDEA, PyCharm, WebStorm and Amazon's own AWS Cloud 9. Support for the AWS Lambda Console is also coming soon. Ahead of today's announcement, Vasi Philomin, Amazon's VP in charge of its AI services, stressed that the company didn't simply create this in order to offer a copy of Copilot. He noted that with CodeGuru, its AI code reviewer and performance profiler, and DevOps Guru, its tool for finding operation issues, the company laid the groundwork for today's launch quite a few years ago.

Google is still useful for many, but the harder question is why its results feel more sterile than they did five years ago. From a report: SEO expert Marie Haynes's theory is that this is the result of Google trying to crack down on misinformation and low-quality content -- especially around consequential search topics. In 2017, the company started talking publicly about a Search initiative called EAT, which stands for "expertise, authoritativeness, and trustworthiness." The company has rolled out numerous quality rater guidelines, which help judge content to determine authenticity. One such effort, titled Your Money or Your Life, applies rigorous standards to any pages that show up when users search for medical or financial information.

"Take crypto," Haynes explained. "It's an area with a lot of fraud, so unless a site has a big presence around the web and Google gets the sense they're known for expertise on that topic, it'll be difficult to get them to rank." What this means, though, is that Google's results on any topic deemed sensitive enough will likely be from established sources. Medical queries are far more likely to return WebMD or Mayo Clinic pages, instead of personal testimonials. This, Haynes said, is especially challenging for people looking for homeopathic or alternative-medicine remedies.

There's a strange irony to all of this. For years, researchers, technologists, politicians, and journalists have agonized and cautioned against the wildness of the internet and its penchant for amplifying conspiracy theories, divisive subject matter, and flat-out false information. Many people, myself included, have argued for platforms to surface quality, authoritative information above all else, even at the expense of profit. And it's possible that Google has, in some sense, listened (albeit after far too much inaction) and, maybe, partly succeeded in showing higher-quality results in a number of contentious categories. But instead of ushering in an era of perfect information, the changes might be behind the complainers' sense that Google Search has stopped delivering interesting results.

Security researchers at Lookout recently tied a previously unattributed Android mobile spyware, dubbed Hermit, to Italian software house RCS Lab. Now, Google threat researchers have confirmed much of Lookout's findings, and are notifying Android users whose devices were compromised by the spyware. From a report: Hermit is a commercial spyware known to be used by governments, with victims in Kazakhstan and Italy, according to Lookout and Google. Lookout says it's also seen the spyware deployed in northern Syria. The spyware uses various modules, which it downloads from its command and control servers as they are needed, to collect call logs, record ambient audio, redirect phone calls and collect photos, messages, emails, and the device's precise location from a victim's device. Lookout said in its analysis that Hermit, which works on all Android versions, also tries to root an infected Android device, granting the spyware even deeper access to the victim's data. Lookout said that targeted victims are sent a malicious link by text message and tricked into downloading and installing the malicious app -- which masquerades as a legitimate branded telco or messaging app -- from outside of the app store.

Monica Alleven writes via Fierce Wireless: So much for the "win-win-win" scenario that Dish Network envisioned for the 12 GHz band. Dish and fellow MVDDS licensee RS Access have argued that the 12 GHz band can be used by both satellite players like SpaceX's Starlink and by companies like Dish that want to use it for 5G, all for the public's benefit. SpaceX on Tuesday submitted its own analysis (PDF) of the effect of terrestrial mobile deployment on non-geostationary orbit fixed satellite service (NGSO FSS) downlink operations. The upshot: The SpaceX study shows terrestrial mobile service would cause harmful interference to SpaceX's Starlink terminals in the 12.2-12.7 GHz band more than 77% of the time, resulting in full outages 74% of the time.

Although entities like RS Access note that SpaceX has access to plenty of other spectrum to accomplish its broadband mission, SpaceX insists that the 12 GHz band has become one of the most important and intensely used spectrum bands for Americans who depend on satellite services. In fact, SpaceX said it depends on the 12 GHz band for the workhorse frequencies in critical downlink services to serve Americans "in every corner of the nation." [...] SpaceX would like the FCC to drop the 12 GHz proceeding, but Dish and RS Access have been urging the FCC for years to change the rules so that their MVDDS licenses can be used for two-way 5G services. In response to SpaceX's submission, the 5G for 12 GHz Coalition, issued the following statement: "We understand that SpaceX has -- after 18 months and both a robust comment and reply period -- just filed its own in-house technical submission to the 12 GHz proceeding. Our engineers and technical experts are reviewing the filing in depth and remain committed to working in good faith with the FCC and stakeholders to ensure that the American public is able to reap the immense benefits of 5G services in this band."

Russia has levied dozens of cyber espionage campaigns in 42 countries since it invaded Ukraine in February, according to a new Microsoft report. From a report: The report says those efforts have targeted entities across six continents and primarily focused on NATO allies and groups supporting Ukraine. "The Russian invasion relies in part on a cyber strategy that includes at least three distinct and sometimes coordinated efforts -- destructive cyberattacks within Ukraine, network penetration and espionage outside Ukraine and cyber influence operations targeting people around the world," Microsoft President Brad Smith said in the report. The tech giant previously detailed Russian cyber operations against Ukraine itself during the invasion in April. Sixty-three percent of the observed Russian activity in the 42 countries beyond Ukraine targeted NATO members, according to the new report. The United States has been Russia's top target, but the company also noted a large amount of activity in Poland -- which borders Ukraine and has provided significant military and humanitarian assistance to the country -- as well as the Baltic states.

Brave blog: One year ago, we launched Brave Search to give everyone online a real choice over Big Tech: a privacy-protecting, unbiased alternative to Google and Bing, and a truly independent alternative to providers -- such as DuckDuckGo or Startpage -- that rely on Big Tech to run. Today, Brave Search is exiting its beta phase. [...] Brave Search has grown faster than any search provider since Bing. Some numbers: 2.5 billion queries in the past 365 days, a high of 14.1 million queries per day, 5 billion queries annualized (projection based on current monthly totals).

Chinese President Xi Jinping chaired a meeting Wednesday that approved promoting the "healthy" development of the payment and fintech sectors, a sign that a broad crackdown on tech companies like Ant Group may be easing. From a report: The meeting of the central commission for deepening overall reform also backed enhancing regulation of major payment platforms, state broadcaster China Central Television reported, adding that companies would be encouraged to return to their roots while the authorities will improve regulation. As part of the plans, China would ensure the security of payment and financial infrastructure, and work to prevent and defuse systemic financial risks, CCTV said. The government will also enhance oversight of financial holding companies and financial institutions invested by platform firms, the report said, without adding details.

A new report finds that blockchain systems might not be working as well as many crypto enthusiasts assume. From a report: The report was commissioned by the Defense Advanced Research Projects Agency, or DARPA, and the work was done by the software security research company Trail of Bits. Trail of Bits CEO Dan Guido says blockchain -- the public ledgers that keep track of cryptocurrencies, which are replicated on computers around the world -- isn't the egalitarian tech its advocates claim. "It's been taken for granted that the blockchain is immutable and decentralized, because the community says so," says Guido. But in practice, he says, these networks have evolved in ways that concentrate power in the hands of certain people or companies, including the large pools of "miners" whose computers earn virtual currency by maintaining the blockchains.

Guido's team calls these potential situations "unintended centralities" -- situations in which someone gains leverage over the decentralized system, creating opportunities for tampering with the record of who owns what. Another example in the report of this kind of concentration is the fact that 60% of Bitcoin traffic is handled by just three internet service providers. "Let's say somebody with great top-down control of the internet in their country starts to interfere with that network," Guido says. By slowing down or stopping legitimate blockchain traffic, an attacker could become the "majority" voice in the consensus of what's written to a blockchain at that moment. "They can rewrite history. They can censor transactions. They can make it so that you can't spend your Bitcoin," says Guido. "It's definitely something people would want to do if they want to 'grief' the network."

The Israeli Ministry of Defense plans to begin testing of a Medium Robotic Combat Vehicle (M-RCV) next year. New Atlas reports: Developed by the Ministry of Defense's Directorate of Defense Research and Development (DDR&D), the Tank and APC Directorate, and Israeli security industries, the robotic tank is based on a new robotic platform type BLR-2 made by Israeli firm BL. It features a 30-mm autonomous turret originally developed by the Tank and APC Directorate for the Eitan armored personnel carrier; the Elbit Iron Fist Active Protection System, which is a smaller, mountable version of the Iron Dome anti-projectile defense system; fire control and mission management systems; a robotic autonomous operations kit; and active and passive sensors for situational awareness.

In addition, the robotic vehicle carries a capsuled drone that it can deploy and retrieve for forward reconnaissance missions. It can also carry a variety of heavy loads, as well as an Israeli Aerospace Industries missile launcher and Rafael Advanced Defense Systems Spike missiles. According to Elbit, the robot can operate in all weathers in a largely autonomous mode and can integrate with uncrewed battlefield arrays. Field tests in representative scenarios are scheduled to start in 2023. You can view the M-RCV in action here.

An anonymous reader quotes a report from Ars Technica: The Federal Aviation Administration says it finally has a plan for the industry to replace or retrofit airplane altimeters that can't filter out transmissions from outside their allotted frequencies. The altimeter problem has prevented AT&T and Verizon from fully deploying 5G on the C-Band spectrum licenses the wireless carriers purchased for a combined $69 billion. The FAA was urging airlines to retrofit or replace altimeters in recent months and now says it has finalized a plan. An FAA statement on Friday said that "airlines and other operators of aircraft equipped with the affected radio altimeters must install filters or other enhancements as soon as possible."

AT&T and Verizon said they will be able to accelerate 5G deployments near airports in the coming months, but the carriers agreed to continue some level of "voluntary mitigations" in the airport areas until July 2023. Altimeters are used by airplanes to measure altitude. The FAA said a new "phased approach requires operators of regional aircraft with radio altimeters most susceptible to interference to retrofit them with radio frequency filters by the end of 2022. This work has already begun and will continue on an expedited basis."

Additionally, "filters and replacement units for the mainline commercial fleet should be available on a schedule that would permit the work to be largely completed by July 2023," the FAA said, continuing: "The radio-altimeter manufacturers have worked at an unprecedented pace with Embraer, Boeing, Airbus and Mitsubishi Heavy Industries to develop and test filters and installation kits for these aircraft. Customers are receiving the first kits now. In most cases, the kits can be installed in a few hours at airline maintenance facilities. Throughout this process, the FAA will work with both industries to track the pace of the radio altimeter retrofits while also working with the wireless companies to relax mitigations around key airports in carefully considered phases."

An anonymous reader quotes a report from BleepingComputer: Security researchers found that Adobe Acrobat is trying to block security software from having visibility into the PDF files it opens, creating a security risk for the users. Adobe's product is checking if components from 30 security products are loaded into its processes and likely blocks them, essentially denying them from monitoring for malicious activity. [...] In a post on Citrix forums on March 28, a user complaining about Sophos AV errors due to having an Adobe product installed said that the company "suggested to disable DLL-injection for Acrobat and Reader.

Replying to BleepingComputer, Adobe confirmed that users have reported experiencing issue due to DLL components from some security products being incompatible with Adobe Acrobat's usage of the CEF library: "We are aware of reports that some DLLs from security tools are incompatible with Adobe Acrobat's usage of CEF, a Chromium based engine with a restricted sandbox design, and may cause stability issues." The company added that it is currently working with these vendors to address the problem and "to ensure proper functionality with Acrobat's CEF sandbox design going forward." Minerva Labs researchers argue that Adobe chose a solution that solves compatibility problems but introduces a real attack risk by preventing security software from protecting the system.

RISC OS, the operating system of the original Arm computer, the Acorn Archimedes, is still very much alive -- and doing relatively well for its age. The Register reports: In June 1987, Acorn launched the Archimedes A305 and A310, starting at $982 and running a new operating system called Arthur. At the time, it was a radical and very fast computer. In his review (PDF) for Personal Computer World, Dick Pountain memorably said: "It loads huge programs with a faint burping noise, in the time it takes to blink an eye." Arthur was loosely related to Acorn's earlier MOS, the BBC Micro operating system but looked very different thanks to a prototype graphical desktop, implemented in BBC BASIC, that could charitably be called "technicolor." Renamed RISC OS, version 2 followed in 1989 -- the same year that Sun started selling its new SPARCstation 1 (a snip at $9,200) and DEC launched the MIPS R2000-chipset-based DECstation 3100 (for $10,800).

RISC OS has had a rather convoluted history, partly due to Acorn spinning out Arm, eventually pulling out of the computer market, rebranding as Element 14 and being acquired by Broadcom, where Arm co-designer Sophie Wilson still works today. And partly due to drama over the ownership of the OS post-Acorn at one point. One fork of RISC OS still supports Acorn-era Arm's odd 26-bit mode, meaning that today it mostly runs on the commercial Virtual Acorn emulator. The other branch, designed for the 32-bit mode of more recent Arm chips, is now owned by RISC OS Developments, which made it fully open source back in 2018. Development and maintenance is done by the team at RISC OS Open Ltd -- ROOL for short -- which offers downloads for a variety of current Arm hardware, such as the Titanium desktops. [...]

RISC OS Developments are still working on new functionality for the OS. Notably, it recently released a new TCP/IP stack, derived from OpenBSD. Right now, the main benefit is IPv6 support. A feature more significant to most users is still in development: Wi-Fi support. Also still under development, but available to paid backers, is a new RISC OS web browser, Iris. RISC OS does come with a choice of browsers -- NetSurf and Otter -- but the plan is that the new Iris browser will be a native app, with the RISC OS look and feel, but using the WebKit engine for better compatibility with the modern web. The main remaining limitation is SMP. As an OS from the 1980s, long before the 21st-century technology of mainstream multicore processors, RISC OS practically only supports a single CPU core. Various experimental efforts are under way to address this. One has got NetBSD running on another core, and another has the experimental Genode OS running alongside RISC OS. Another effort is working on adding SMP support into the RISC OS kernel itself.

China's chip industry is growing faster than anywhere else in the world, after US sanctions on local champions from Huawei to Hikvision spurred appetite for home-grown components. From a report: Nineteen of the world's 20 fastest-growing chip industry firms over the past four quarters, on average, hail from the world's No. 2 economy, according to data compiled by Bloomberg. That compared with just 8 at the same point last year. Those China-based suppliers of design software, processors and gear vital to chipmaking are expanding revenue at several times the likes of global leaders Taiwan Semiconductor Manufacturing Co. or ASML Holding NV.

That supercharged growth underscores how tensions between Washington and Beijing are transforming the global $550 billion semiconductor industry -- a sector that plays an outsized role in everything from defense to the advent of future technologies like AI and autonomous cars. In 2020, the US began restricting sales of American technology to companies like Semiconductor Manufacturing International Corp. and Hangzhou Hikvision Digital Technology, successfully containing their growth -- but also fueling a boom in Chinese chip-making and supply.

Wikimedia Enterprise, a first-of-its-kind commercial product designed for companies that reuse and source Wikipedia and Wikimedia projects at a high volume, today announced its first customers: multinational technology company Google and nonprofit digital library Internet Archive. Wikimedia blog: Wikimedia Enterprise was recently launched by the Wikimedia Foundation, the nonprofit that operates Wikipedia, as an opt-in product. Starting today, it also offers a free trial account to new users who can self sign-up to better assess their needs with the product. As Wikipedia and Wikimedia projects continue to grow, knowledge from Wikimedia sites is increasingly being used to power other websites and products. Wikimedia Enterprise was designed to make it easier for these entities to package and share Wikimedia content at scale in ways that best suit their needs: from an educational company looking to integrate a wide variety of verified facts into their online curricula, to an artificial intelligence startup that needs access to a vast set of accurate data in order to train their systems. Wikimedia Enterprise provides a feed of real-time content updates on Wikimedia projects, guaranteed uptime, and other system requirements that extend beyond what is freely available in publicly-available APIs and data dumps.

Organizations and companies of any size can access Wikimedia Enterprise offerings with dedicated customer-support and Service Level Agreements, at a variable price based on their volume of use. Interested companies can now sign up on the website for a free trial account which offers 10,000 on-demand requests and unlimited access to a 30-day Snapshot. Google and the Wikimedia Foundation have worked together on a number of projects and initiatives to enhance knowledge distribution to the world. Content from Wikimedia projects helps power some of Google's features, including being one of several data sources that show up in its knowledge panels. Wikimedia Enterprise will help make the content sourcing process more efficient.

Unidentified operatives have been using the fitness tracking app Strava to spy on members of the Israeli military, tracking their movements across secret bases around the country and potentially observing them as they travel the world on official business. From a report: By placing fake running "segments" inside military bases, the operation -- the affiliation of which has not been uncovered -- was able to keep tabs on individuals who were exercising on the bases, even those who have applied the strongest possible account privacy settings. In one example seen by the Guardian, a user running on a top-secret base thought to have links to the Israeli nuclear programme could be tracked across other military bases and to a foreign country.

The surveillance campaign was discovered by the Israeli open-source intelligence outfit FakeReporter. The group's executive director, Achiya Schatz, said: "We contacted the Israeli security forces as soon as we became aware of this security breach. After receiving approval from the security forces to proceed, FakeReporter contacted Strava, and they formed a senior team to address the issue." Strava's tracking tools are designed to allow anyone to define and compete over "segments," short sections of a run or bike ride that may be regularly raced over, like a long uphill climb on a popular cycling route or a single circuit of a park. Users can define a segment after uploading it from the Strava app, but can also upload GPS recordings from other products or services.

Microsoft, Epic Games, Meta, and 33 other companies and organizations have formed a standards group for "metaverse" tech. The Metaverse Standards Forum is supposed to foster open, interoperable standards for augmented and virtual reality, geospatial, and 3D tech. From a report: According to a press release, the Metaverse Standards Forum will focus on "pragmatic, action-based projects" like hackathons and prototyping tools for supporting common standards. It's also interested in developing "consistent terminology" for the space -- where many players can't even agree on what a "metaverse" is. In addition to the companies above, the group's founding members include major pre-metaverse entities like the World Wide Web Consortium (W3C), Nvidia, Qualcomm, Sony Interactive Entertainment, and Unity, in addition to newer ones like Lamina1, a blockchain payments startup co-founded by Snow Crash author Neal Stephenson.