New York Times Source Code Stolen Using Exposed GitHub Token

The New York Times has confirmed that its internal source code was leaked on 4chan after being stolen from the company’s GitHub repositories in January 2024. BleepingComputer reports: As first seen by VX-Underground, the internal data was leaked on Thursday by an anonymous user who posted a torrent to a 273GB archive containing the stolen data. “Basically all source code belonging to The New York Times Company, 270GB,” reads the 4chan forum post. “There are around 5 thousand repos (out of them less than 30 are additionally encrypted I think), 3.6 million files total, uncompressed tar.”

While BleepingComputer did not download the archive, the threat actor shared a text file containing a complete list of the 6,223 folders stolen from the company’s GitHub repository. The folder names indicate that a wide variety of information was stolen, including IT documentation, infrastructure tools, and source code, allegedly including the viral Wordle game. A ‘readme’ file in the archive states that the threat actor used an exposed GitHub token to access the company’s repositories and steal the data. The company said that the breach of its GitHub account did not affect its internal corporate systems and had no impact on its operations. The Times said in a statement to BleepingComputer: “The underlying event related to yesterday’s posting occurred in January 2024 when a credential to a cloud-based third-party code platform was inadvertently made available. The issue was quickly identified and we took appropriate measures in response at the time. There is no indication of unauthorized access to Times-owned systems nor impact to our operations related to this event. Our security measures include continuous monitoring for anomalous activity.”

Read more of this story at Slashdot.

Big Copyright Win in Canada: Court Rules Fair Use Beats Digital Locks

Michael Geist
Pig Hogger (Slashdot reader #10,379) reminds us that in Canadian law, “fair use” is called “fair dealing” — and that Canadian digital media users just enjoyed a huge win. Canadian user rights champion Michael Geist writes:

The Federal Court has issued a landmark decision on copyright’s anti-circumvention rules which concludes that digital locks should not trump fair dealing. Rather, the two must co-exist in harmony, leading to an interpretation that users can still rely on fair dealing even in cases involving those digital locks.

The decision could have enormous implications for libraries, education, and users more broadly as it seeks to restore the copyright balance in the digital world. The decision also importantly concludes that merely requiring a password does not meet the standard needed to qualify for copyright rules involving technological protection measures.

Canada’s 2012 “Copyright Modernization Act” protected anti-copying technology from circumvention, Geist writes — and Blacklock’s Reports had then “argued that allowing anyone other than original subscriber to access articles constituted copyright infringement.”

The court found that the Blacklock’s legal language associated with its licensing was confusing and that fair dealing applied here as well…

Blacklock’s position on this issue was straightforward: it argued that its content was protected by a password, that passwords constituted a form of technological protection measure, and that fair dealing does not apply in the context of circumvention. In other words, it argued that the act of circumvention (in this case of a password) was itself infringing and it could not be saved by fair dealing. The Federal Court disagreed on all points…

For years, many have argued for a specific exception to clarify that circumvention was permitted for fair dealing purposes, essentially making the case that users should not lose their fair dealing rights the moment a rights holder places a digital lock on their work. The Federal Court has concluded that the fair dealing rights have remained there all along and that the Copyright Act’s anti-circumvention rules must be interpreted in a manner consistent with those rights.
“The case could still be appealed, but for now the court has restored a critical aspect of the copyright balance after more than a decade of uncertainty and concern.”

Read more of this story at Slashdot.

Virgin Galactic Completes Final ‘Space Tourists and Research’ Flight Before Two-Year Pause

“Virgin Galactic launched six people to suborbital space on Saturday, launching a Turkish astronaut and three space tourists,” reports Space.com, “on what was the final voyage of the VSS Unity space plane.”

Unity, attached to the belly of its carrier plane Eve, took off from runway at Spaceport America in New Mexico at 10:31 a.m. EDT (1431 GMT) and carried to an altitude of 44,562 feet (13,582 meters) over the next hour, where it was dropped and ignited its rocket engine to carry two pilots and four passengers to space and back. The mission, called Galactic 07, reached an altitude of 54.4 miles (87.5 km) and marked the seventh commercial spaceflight by Virgin Galactic on Unity, which is being retired to make way for the company’s new “Delta” class of spacecraft rolling out in 2026.

“I will need much more time to try and process what just happened,” Tuva Atasever, the Turkish Space Agency astronaut on the flight, said in a post-flight press conference, adding that the view of Earth was indescribable. “It’s not something you can describe with adjectives. It’s an experiential thing … you just feel it in your gut.”
One of the space tourists was a principal propulsion engineer at SpaceX, who wore the flags of the U.S. and India on his spacesuit to honor both his home country and that of his parents. The other two were a New York-based real estate developer and a London-based hotel and resort investment strategy advisor.

The flight landed 70 minutes later at 11:41 a.m. EDT (1541 GMT), according to the article, “marking only its seventh commercial spaceflight for Virgin Galactic and 12th crewed spaceflight overall.”

In all, Virgin Galactic flew the space plane just 32 times, including non-space test flights… “This vehicle was revolutionary,” Virgin Galactic president Mike Moses said in the post-launch press conference. “We tested it, we flew it, we demonstrated and prove to the world that commercial human spaceflight is possible with private funding for private companies… Seven commercial space flights, a single vehicle flying six times in six months last year, that’s groundbreaking,” Moses said. “The fact that we can take this vehicle back to back to back on a monthly basis is is really revolutionary.”

The new Delta class of spacecraft will be able to fly at least twice a week, about eight times the rate of SpaceShipTwo, with Virgin Galactic planning to build at least two to start its new fleet. “We’re going to field in 2026 two spaceships, our mothership Eve, that’s 750 astronauts a year going to space,” Moses said of the new fleet’s flight capacity. “That’s more than have gotten to space in the 60 year history of spaceflight to date….”

Since 2018, Virgin Galactic has flown payloads as part of NASA’s Flight Opportunities program and most recently was selected to be a contracted flight provider for NASA for the next five years.

Phys.org reports that with the Delta-class rockets, “The future of the company is at stake as it seeks at long last to get into the black. Virgin is burning through cash, losing more than $100 million in each of the past two quarters, with its reserves standing at $867 million at the end of March.”

It also laid off 185 people, or 18 percent of its workforce, late last year. Its shares are currently trading at 85 cents, down from $55 in 2021, the year Branson himself flew, garnering global headlines.

Saturday’s flight also became “a suborbital science lab” for microgravity research, according to a statement from the company.
Phys.org reports that during the flight, astronaut Atasever “wore custom headgear with brain activity monitoring sensors to collect physiological data, a dosimeter, and two commercially available insulin pens to examine the ability to administer accurate insulin doses in microgravity, Virgin said in a statement.” And Virgin Galactic said their flight also carried “rack-mounted” autonomous payloads from both Purdue (“to study propellant slosh in fuel tanks of maneuvering spacecraf”) and U.C. Berkeley (“testing a new type of 3D printing”), as well as “multiple human-tended experiments.”

“Discovery and innovation are central to our mission at Virgin Galactic,” said Michael Colglazier, CEO of Virgin Galactic. “We’re excited to build on our successful record of facilitating scientific experiments in suborbital space, and we look forward to continuing to expand our role in suborbital research going forward.”

Read more of this story at Slashdot.

Birmingham’s $125M ‘Oracle Disaster’ Blamed on Poor IT Project Management

It was “a catastrophic IT failure,” writes Computer Weekly. It was nearly two years ago that Birmingham City Council, the largest local authority in Europe, “declared itself in financial distress” — effectively declaring bankruptcy — after the costs on an Oracle project costs ballooned from $25 million to around $125.5 million.

But Computer Weekly’s investigation finds signs that the program board and its manager wanted to go live in April of 2022 “regardless of the state of the build, the level of testing undertaken and challenges faced by those working on the programme.” One manager’s notes “reveal concerns that the program manager and steering committee could not be swayed, which meant the system went live despite having known flaws.”

Computer Weekly has seen notes from a manager at BCC highlighting a number of discrepancies in the Birmingham City Council report to cabinet published in June 2023, 14 months after the Oracle system went into production. The report stated that some critical elements of the Oracle system were not functioning adequately, impacting day-to-day operations. The manager’s comments reveal that this flaw in the implementation of the Oracle software was known before the system went live in April 2022… An insider at Birmingham City Council who has been closely involved in the project told Computer Weekly it went live “despite all the warnings telling them it wouldn’t work”….

Since going live, the Oracle system effectively scrambled financial data, which meant the council had no clear picture of its overall finances. The insider said that by January 2023, Birmingham City Council could not produce an accurate account of its spending and budget for the next financial year: “There’s no way that we could do our year-end accounts because the system didn’t work.”

A June 2023 report to cabinet “stated that due to issues with the council’s bank reconciliation system, a significant number of transactions had to be manually allocated to accounts rather than automatically via the Oracle system,” according to the article. But Computer Weekly has seen a 2019 presentation slide deck showing the council was already aware that Oracle’s out-of-the-box bank reconciliation system “did not handle mixed debtor/non-debtor bank files. The workaround suggested was either a lot of manual intervention or a platform as a service (PaaS) offering from Evosys, the Oracle implementation partner contracted by BCC to build the new IT system.”

The article ultimately concludes that “project management failures over a number of years contributed to the IT failure.”

Read more of this story at Slashdot.