The U.S. government is enlisting the help of tech companies, including Amazon, Microsoft and Google, to bolster the country's critical infrastructure defenses against cyber threats after a string of high-profile attacks. From a report: The Department of Homeland Security, on Thursday, is formally unveiling the initiative called the Joint Cyber Defense Collaborative. The effort will initially focus on combating ransomware and cyberattacks on cloud-computing providers, said Jen Easterly, director of the DHS's Cybersecurity and Infrastructure Security Agency. Ultimately, she said, it aims to improve defense planning and information sharing between government and the private sector.

"This will uniquely bring people together in peacetime, so that we can plan for how we're going to respond in wartime," she said in an interview. Ms. Easterly was sworn in as CISA's director last month. She was previously a counterterrorism official in the Obama White House, and the commander of the Army's first cyber operations unit at the National Security Agency, America's cyberspy agency. Over the past year, ransomware attacks have disrupted large parts of daily life in the U.S. They have diverted ambulances, caused long lines at gas stations in the southeast, and disrupted the production of hot dogs and other meat products.

An anonymous reader quotes a report from Wired: Well over 100 employees at Amazon Prime Air have lost their jobs and dozens of other roles are moving to other projects abroad as the company shutters part of its operation in the UK, WIRED understands. Insiders claim the future of the UK operation, which launched in 2016 to help pioneer Amazon's global drone delivery efforts, is now uncertain. Those working on the UK team in the last few years, who spoke on condition of anonymity, describe a project that was "collapsing inwards," "dysfunctional" and resembled "organized chaos," run by managers that were "detached from reality" in the years building up to the mass redundancies.

They told WIRED about increasing problems within Prime Air in recent years, including managers being appointed who knew so little about the project they couldn't answer basic work questions, an employee drinking beer at their desk in the morning and some staff being forced to train their replacements in Costa Rica. Amazon says it still has staff working for Prime Air in the UK, but has refused to confirm headcount. [...] An Amazon spokesperson says it will still have a Prime Air presence in the UK after the cuts, but refuses to disclose what type of work will take place. The spokesperson also refused to confirm, citing security reasons, if any of the test flights that once filled promotional videos will still take place in the UK. The spokesperson adds that the company has found positions in other parts of its business for some affected employees and that it will keep growing its presence in the region. The spokesperson did not confirm how many employees were offered other jobs internally.

A Spanish company has devised a system to extract drinking water from thin air to supply arid regions where people are in desperate need. Reuters reports: "The goal is to help people," said Enrique Veiga, the 82-year-old engineer who invented the machine during a harsh drought in southern Spain in the 1990s. "The goal is to get to places like refugee camps that don't have drinking water." The devices made by his company, Aquaer, are already delivering clean, safe water to communities in Namibia and a Lebanese refugee camp. "In the villages we visited in Namibia, they were astonished, they didn't understand, asking where the water came from," he said.

The machines use electricity to cool air until it condenses into water, harnessing the same effect that causes condensation in air-conditioning units. While other water generators based on similar technology require high ambient humidity and low temperatures to function effectively, Veiga's machines work in temperatures of up to 40 Celsius (104F) and can handle humidity of between 10% and 15%. A small machine can produce 50-75 liters a day, and be easily carried on a trolley, but bigger versions can produce up to 5,000 liters a day.

People will no longer be able to play the digital version of The New York Times daily crossword puzzle in third-party apps, according to an announcement made by the Times on Monday. The Verge reports: Starting August 10th, the crossword will be available digitally only via the NYT site or on its own crossword app. Downloadable PDFs, in addition to the physical newspaper, will still be available for people who want to print and play. Until now, crosswords were available in the Across Lite .puz file format, so anyone with a Times games subscription could download a puzzle and open it in the desktop or mobile app of their choice. The change applies not just to future puzzles but to the archive of puzzles that are currently in the .puz format.

Everdeen Mason, editorial director of games at the Times, said on Twitter that she made the decision to end .puz support in an effort to build something where editors can "edit and make games rather than adapt things for tools we can't control."

An anonymous reader quotes a report from It's FOSS, written by Ankush Das: Mozilla's Firefox is the only popular alternative to Chromium-based browsers. It has been the default choice for Linux users and privacy-conscious users across every platform. However, even with all benefits as one of the best web browsers around, it is losing its grip for the past few years. I came across a Reddit thread by u/nixcraft, which highlighted more details on the decline in the userbase of Firefox since 2018. And surprisingly, the original source for this information is Firefox's Public Data Report.

As per the official stats, the reported number of active (monthly) users was about 244 million at the end of 2018. And, it seems to have declined to 198 million at the end of Q2 2021. So, that makes it a whopping ~46 million decline in the userbase. Considering 2021 is the year when privacy-focused tools saw a big boost in their userbase, Mozilla's Firefox is looking at a constant decline. Especially when Firefox manages to introduce some industry-first privacy practices. Quite the irony, eh? Just for fun, here's a timeline of our stories reporting on Firefox's download milestones from the mid-2000s:

September 19, 2004: 1 Million Firefoxes in 4 Days
December 12, 2004: Firefox Reaches 10 Million Downloads
February 17, 2005: Firefox Breaks 25 Million Downloads
April 26, 2005: Firefox nears 50 Million Downloads
July 29, 2005: Firefox Downloads Reach 75 Million
October 19, 2005: Firefox Tops 100 Million Downloads
September 11, 2007: Firefox Hits 400 Million Downloads
July 3, 2008: Firefox Breaks 8 Million, Gets Into Guinness

Ron Amadeo writing via Ars Technica: Who remembers the sudden and dramatic death of Google+? Google's Facebook competitor and "social backbone" was effectively dead inside the company around 2014, but Google let the failed service hang around for years in maintenance mode while the company spun off standalone products. In 2018, The Wall Street Journal reported that Google+ had exposed the private data of "hundreds of thousands of users" for years, that Google knew about the problem, and that the company opted not to disclose the data leak for fear of regulatory scrutiny. In the wake of the report, Google was forced to acknowledge the data leak, and the company admitted that the "private" data of 500,000 accounts actually wasn't private. Since nobody worked on Google+ anymore, Google's "fix" for the bug was to close Google+ entirely. Then the lawsuits started.

Today's class-action lawsuit, Matt Matic and Zak Harris v. Google, was filed in October 2018 and blames Google's "lax approach to data security" for the bugs. The complaint added, "Worse, after discovery of this vulnerability in the Google+ platform, Defendants kept silent for at least seven months, making a calculated decision not to inform users that their Personal Information was compromised, further compromising the privacy of consumers' information and exposing them to risk of identity theft or worse." The case website with full details is at googleplusdatalitigation.com. The case was settled in June 2020, with Google agreeing to pay out $7.5 million. After losing about half of that money to legal and administrative fees, and with 1,720,029 people filling out the right forms by the October 2020 deadline, the payout for each person is a whopping $2.15.

An anonymous reader shares a report: It has been over three months since Click Studios, the Australian software house behind the enterprise password manager Passwordstate, warned its customers to "commence resetting all passwords." The company was hit by a supply chain attack that sought to steal the passwords from customer servers around the world. But customers tell TechCrunch that they are still without answers about the attack. Several customers say they were met with silence from Click Studios, while others were asked to sign strict secrecy agreements when they asked for assurances about the security of the software. One IT executive whose company was compromised by the attack said they felt "abandoned" by the software maker in the wake of the attack.

Passwordstate is a standalone web server that enterprise companies can use to store and share passwords and secrets for their organizations, like keys for cloud systems and databases that store sensitive customer data, or "break glass" accounts that grant emergency access to the network. Click Studios says it has 29,000 customers using Passwordstate, including banks, universities, consultants, tech companies, defense contractors and U.S. and Australian government agencies, according to public records seen by TechCrunch.

Facebook shut down accounts belonging to two academic researchers late Tuesday, cutting off their ability to study political ads and misinformation on the world's biggest social network. From a report: The company accused the academics of engaging in "unauthorized scraping" and compromising user privacy on the platform, claims that Facebook's many critics are slamming as a thin pretense for killing the transparency work. The company took action against Laura Edelson and Damon McCoy, two well-known researchers affiliated with NYU's Cybersecurity for Democracy project who have long sparred with the company.

The move cuts off their access to Facebook's Ad Library -- one of the company's only meaningful transparency efforts to date -- and data on popular posts from the social media monitoring service CrowdTangle. Facebook has a history with Edelson and McCoy. The company served the pair cease and desist letters just weeks before the 2020 election, calling on the team to disable an opt-in browser tool called Ad Observer and unpublish their findings. Ad Observer is a browser tool anyone can install that's designed to give researchers a rare glimpse into how Facebook targets the ads that have transformed it into a trillion-dollar company. "Over the last several years, we've used this access to uncover systemic flaws in the Facebook Ad Library, identify misinformation in political ads including many sowing distrust in our election system, and to study Facebook's apparent amplification of partisan misinformation," Edelson said on Twitter. "After years of abusing users' privacy, it's rich for Facebook to use it as an excuse to crack down on researchers exposing its problems. I've asked the FTC to confirm that this excuse is as bogus as it sounds," tweeted Sen. Ron Wyden (D-OR).

At the Black Hat security conference Wednesday, two security researchers have disclosed a security issue impacting hosted DNS service providers that can be abused to hijack the platform's nodes, intercept some of the incoming DNS traffic, and then map customers' internal networks. From a report: Discovered by Shir Tamari and Ami Luttwak from cloud security company Wiz, the vulnerability highlights the amount of sensitive information collected by managed DNS platforms and their attractiveness from a cyber-espionage and intelligence data collection standpoint.

Also known as DNS-as-a-Service providers, these companies effectively rent DNS servers to corporate entities. While it's not hard to run your own DNS name server, the benefit of using a service like AWS Route53 or the Google Cloud Platform is that companies can offload managing DNS server infrastructure to a third-party and take advantage of better uptime and top-notch security. Companies that sign up for a managed DNS provider typically have to onboard their internal domain names with the service provider. This typically means companies have to go to a backend portal and add their company.com and other domains to one of the provider's name servers (i.e., ns-1611.awsdns-09.co.uk). Once this is done, when a company employee wants to connect to an intranet app or an internet website, their computer will query the third-party DNS server for the IP address it needs to connect. What the Wiz team discovered was that several managed DNS providers did not blacklist their own DNS servers inside their backends.

An anonymous reader writes: Russia has put forward a draft convention to the United Nations ostensibly to fight cyber-crime. The proposal, titled "United Nations Convention on Countering the Use of Information and Communications Technologies for Criminal Purposes," calls for member states to develop domestic laws to punish a far broader set of offenses than current international rules recognize. Russia, the ransomware hotbed whose cyber-spies were blamed for attacking US and allied networks, did not join the 2001 Budapest Convention on Cybercrime because it allowed cross-border operations, which it considers a threat to national sovereignty. Russian media outlet Tass also said the 2001 rules are flawed because they only criminalize nine types of cyber offenses. The new draft convention from Russia, submitted last week, defines 23 cybercrimes for discussion.

Russia's proposed rule expansion, for example, calls for domestic laws to criminalize changing digital information without permission -- "the intentional unauthorized interference with digital information by damaging, deleting, altering, blocking, modifying it, or copying of digital information." The draft also directs members states to formulate domestic laws to disallow unsanctioned malware research -- "the intentional creation, including adaptation, use and distribution of malicious software intended for the unauthorized destruction, blocking, modification, copying, dissemination of digital information, or neutralization of its security features, except for lawful research." It would forbid "the creation and use of digital data to mislead the user," such as deep fakes -- "the intentional unlawful creation and use of digital data capable of being mistaken for data already known and trusted by a user that causes substantial harm."

Google has fired dozens of employees between 2018 and 2020 for abusing their access to the company's tools or data, with some workers potentially facing allegations of accessing Google user or employee data, according to an internal Google document obtained by Motherboard. From a report: The document provides concrete figures on an often delicate part of a tech giant's operations: investigations into how company's own employees leverage their position inside the company to steal, leak, or abuse data they may have access to. Insider abuse is a problem across the tech industry. Motherboard previously uncovered instances at Facebook, Snapchat, and MySpace, with employees in some cases using their access to stalk or otherwise spy on users.

The document says that Google terminated 36 employees in 2020 for security related issues. Eighty-six percent of all security-related allegations against employees included mishandling of confidential information, such as the transfer of internal-only information to outside parties. 10 percent of all allegations in 2020 concerned misuse of systems, which can include accessing user or employee data in violation of Google's own policies, helping others to access that data, or modifying or deleting user or employee data, according to the document. In 2019, that figure was 13 percent of all security allegations.

Microsoft launched its new cloud PC Windows 365 service earlier this week, and the company has already had to pause free trials due to demand. From a report: Windows 365 lets you rent a cloud PC -- with a variety of CPU, RAM, and storage options -- and then stream Windows 10 or Windows 11 via a web browser. The service reached max capacity after only a day of signups. "Following significant demand, we have reached capacity for Windows 365 trials," reads a statement from the Microsoft 365 Twitter account. "We have seen unbelievable response to Windows 365 and need to pause our free trial program while we provision additional capacity," explains Scott Manchester, director of Windows 365 program management.

An electrified highway is theoretically the most efficient way to eliminate truck emissions. But the political obstacles are daunting. From a report: Traton is among the backers of the so-called eHighway south of Frankfurt, a group that also includes Siemens and Autobahn GmbH, the government agency that oversees German highways. There are also short segments of electrified road in the states of Schleswig-Holstein and Baden-Wurttemberg. The technology has been tried in Sweden and, in 2017, on a one-mile stretch near the Port of Los Angeles.

So far the sections of highway equipped with overhead cable in Germany are short -- about three miles long in both directions near Frankfurt. Their purpose is to test how the system performs in everyday use by real trucking companies hauling real goods. By the end of the year more than 20 trucks will be using the systems in Germany. Enter Mr. Schmieder, who learned to drive a truck in the German army, and his employer, a trucking firm called Schanz Spedition in the small town of Ober-Ramstadt, in a hilly, thickly forested region about a 35-mile drive from Frankfurt.

If the eHighway is ever going to be rolled out on a large scale, it has to work for companies like Schanz, a family-owned firm managed by Christine Hemmel and Kerstin Seibert, sisters who are great-granddaughters of the founder. Their father, Hans Adam Schanz, though technically retired, was at the wheel of a forklift maneuvering pallets into the back of a truck recently as Mr. Schmieder climbed into the cab for his second run of the day hauling paint to a distribution center in Frankfurt.

Google Chrome will no longer show whether a site you are visiting is secure and only show when you visit an insecure website. Bleeping Computer reports: To further push web developers into only using HTTPS on their sites, Google introduced the protocol as a ranking factor. Those not hosting a secure site got a potentially minor hit in their Google search results rankings. It has appeared to have worked as according to the 'HTTPS encryption on the web' of Google's Transparency Report, over 90% of all browser connections in Google Chrome currently use an HTTPS connection.

Currently, when you visit a secure site, Google Chrome will display a little locked icon indicating that your communication with the site is encrypted, as shown below. As most website communication is now secure, Google is testing a new feature that removes the lock icon for secure sites. This feature is available to test in Chrome 93 Beta, and Chrome 94 Canary builds by enabling the 'Omnibox Updated connection security indicators' flag. With this feature enabled, Google Chrome will only display security indicators when the site is not secure. For businesses who wish to have continued HTTPS security indicators, Google has added an enterprise policy for Chrome 93 named 'LockIconInAddressBarEnabled' that can be used to enable the lock icon again on the address bar.

MojoKid writes: AMD is taking the wraps off of its latest integrated processors known as Ryzen 7 5700G and the Ryzen 5 5600G. As their branding suggests, these new products are based on the same excellent AMD Zen 3 core architecture, but with integrated graphics capabilities on board as well, hence the "G" designation. AMD is targeting more mainstream applications with these chips. The Ryzen 7 5700G is an 8-core/16-thread CPU with 4MB of L2 cache and 16MB of L3. Those CPU cores are mated to an 8 CU (Compute Unit) Radeon Vega graphics engine, and it has 24 lanes of PCIe Gen 3 connectivity. The 5700G's base CPU clock is 3.8GHz, with a maximum boost clock of 4.6GHz. The on-chip GPU can boost up to 2GHz, which is a massive uptick from the 1.4GHz of previous-gen 3000-series APUs.

The Ryzen 5 5600G takes things down a notch with 6 CPU cores (12 threads) and a smaller 3MB L2 cache while L3 cache size remains unchanged. The 5600G's iGPU is scaled down slightly as well with only 7 CUs. At 3.9GHz, the 5600G's base CPU clock is 100MHz higher than the 5700G's, but its max boost lands at 4.4GHz with a slightly lower GPU boost clock of 1.9GHz. In the benchmarks, the Ryzen 5 5600G and Ryzen 7 5700G both offer enough multi-threaded muscle for the vast majority of users, often besting similar Intel 11th Gen Core series chips, with highly competitive single-thread performance as well.

Mayor Bill de Blasio announced today that New York City will become the first major U.S. city to require proof of vaccination to enter all restaurants, fitness centers and indoor entertainment venues. "If you're unvaccinated, unfortunately, you will not be able to participate in many things," de Blasio said. "If you want to participate in our society fully, you've got to get vaccinated." As The Verge reports, "New Yorkers can meet those requirements by carrying their vaccination card or scanning and storing it in one of two authorized mobile apps." From the report: The spread of the highly contagious Delta variant is being cited as a reason to increase restrictions without returning to a full lockdown or other measures. The program is scheduled to launch on August 13th, with enforcement slated to start on September 13th. It doesn't introduce any new documentation; the name is a reference to it serving as a "key" to the city's recovery.

Workers and patrons can confirm their vaccination status (at least one dose administered) in one of three ways: Vaccination card; NYC COVID Safe exposure notification app (iOS, Android); or NYS Excelsior Pass app.

An anonymous reader quotes a report from Ars Technica: Google has started emailing users of very old Android devices to tell them it's time to say goodbye. Starting September 27, devices running Android 2.3.7 and lower will no longer be able to log in to Google services, effectively killing a big portion of the on-rails Android experience. As Google puts it in an official community post, "If you sign in to your device after September 27, you may get username or password errors when you try to use Google products and services like Gmail, YouTube, and Maps." Android is one of the most cloud-based operating systems ever. Especially in older versions, many included apps and services were tied to your Google login, and if that stops working, a large chunk of your phone is bricked. While Android can update many core components without shipping a full system update today, Android 2.3.7 Gingerbread, released around 10 years ago, was not so modular.

The individual Google apps started to be updatable through the Android Market/Play Store, but signing in to Google was still a system-level service and is frozen in time. Any Google services wanting to allow sign-ins from those versions would have to conform to 2011-era security standards, which means turning off two-factor authentication and enabling a special "allow less-secure access" setting in your Google account. Really, these old Android versions have to die eventually because they're just too insecure. Google shows active user base breakdowns for Android versions in Android Studio, and Gingerbread has such a low device count that it doesn't even make the list. It's less than 0.2 percent of active devices, behind 14 other versions of Android. Users of these old devices could still sideload a third-party app store and find replacements for all the Google apps, but if you're a technical user and can't get a new device, there's a good chance you could load a whole new operating system with an aftermarket Android ROM. After September 27, the oldest version of Android you'll be able to sign in to is Android 3.0 Honeycomb, which is only for tablets.

On Sunday, a bipartisan group of Senators published draft text of a massive new bipartisan infrastructure bill, proposing more than a trillion dollars in spending and a vast array of far-reaching provisions. But a little-noticed section in the bill could have significant implications in the fight against drunk driving, eventually mandating a new in-car safety technology to actively prevent Americans from driving while impaired. The Verge reports: Introduced under the heading "Advanced Impaired Driving Technology," the provision would require the Department of Transportation to set a new standard for detecting and preventing impaired driving. The bill calls on the secretary of transportation to release a standard within three years, with the requirement taking effect for new cars three years after that. The specific provisions of the standard are vague, but it would require cars to "passively monitor the performance of a driver of a motor vehicle to accurately identify whether that driver may be impaired" and "prevent or limit motor vehicle operation" if impairment is detected.

The specific means of creating that system are still undetermined, but advocates say much of the technology is already available. Driver monitoring systems, which track a driver's face or eyelids to ensure they are alert and actively piloting the vehicle, are already offered in some models by Lexus, BMW, and Mercedes Benz. Systems like lane detection could also be used to detect impairment, creating an alert if the driver is consistently veering outside their lane. "Twenty years ago, this technology didn't exist," says Jason Levine of the Center for Auto Safety. "[But] we have the technology available now. We can install tech in vehicles that helps to monitor whether someone is impaired and stops that person from hurting themselves or others."

Crucially, the new standard wouldn't be limited to drunk drivers. Because the systems measure impairment directly, they would be just as effective at detecting impairment from prescription drugs, emotional distress, or simple distraction. A longer-term effort would also seek to mandate passive alcohol monitoring systems, like those currently being developed by Volvo. While the provisions are aimed at creating a new mandatory requirement for automakers, such a requirement is still a long way off. Negotiations around the infrastructure bill are still in flux, and the provision could still be removed or altered by lawmakers. Even if it passes into law, the Department of Transportation will have wide leeway in how and when to implement the requirement and could easily delay it beyond the schedule set by Congress.

Three-and-half months after launching the Magic Keyboard with Touch ID, Apple is finally breaking it out from its iMac bundle. The accessory is now available as a standalone through Apple Stores and the company's site. From a report: There are two versions: the standard and a longer model with a numeric keypad (pretty much what the company offers with all of its Magic Keyboards), running $149 and $179, respectively. There's also a $99 version that keeps the new rounded, compact design, but drops the Touch ID in favor of a key that locks the system. But where's the fun in that? All of the models have keys devoted to Spotlight, Dictation, Do Not Disturb and Emoji.

Five social media giants failed to remove 84% of antisemitic posts in May and June -- and Facebook performed the worst despite announcing new rules to tackle the problem, a new report finds. Axios: The Center for Countering Digital Hatred (CCDH) notes in its study that it reported 714 posts containing "anti-Jewish hatred" to Facebook, Twitter, Instagram, Youtube and TikTok -- which were collectively viewed 7.3 million times. These "clearly violated" company policies, according to the CCDH. "As a result of their failure to enforce their own rules, social media platforms like Facebook have become safe places to spread racism and propaganda against Jews," states the report, titled "Failure to Act."

Facebook removed 14 out of 129 posts reported to it (10.9%); Twitter removed 15 of 137 reports (11%); TikTok took down 22 of 119 posts reported (18.5%); Instagram acted in 52 of 277 of cases (18.8%) and YouTube pulled 11 of the 52 posts it was alerted to (21.2%). "Extremist anti-Jewish hate is not acted on: platforms failed to act on 80% of posts containing Holocaust denial, 74% of posts alleging the blood libel, 70% of racist caricatures of Jewish people and 70% of neo-Nazi posts," per a statement from the CCDH, a nongovernmental organization based in the U.S. and United Kingdom.