‘Advent of Code’ Has Begun – and Other Geeky Daily Programming Challenges

I Programmer writes:
December 1st is much anticipated among those who like programming puzzles. It is time to start collecting stars by solving small puzzles on the Advent of Code website with the goal of amassing 50 stars by Christmas Day, December 25th. Raku has also opened its advent calendar and there’s a brand new Bekk Christmas blog with informational content on multiple topics… At the time of writing we are only 10.5 hours into Advent of Code’s Day 1, almost 50,000 users have completed both puzzles and another 8,484 have completed the first. [Some programmers are even livestreaming their progress on Twitch, or sharing their thoughts (and some particuarly creative solutions) in the Advent of Code subreddit.]

We can credit Perl with pioneering the idea of a programming advent calendar with daily articles with a festive theme and the Raku Advent Calendar now continues the tradition. Now in its 13th year, but only the third with its new name this year’s first advent post solves a problem faced by Santa of creating thumbnails of approaching 2 billion images…

Smashing magazine has pulled together its own exhaustive list of additional geek-themed advent calendars. Some of the other highlights:

The beloved site “24 Pull Requests” has relaunched for 2021, daring participants to make 24 pull requests before December 24th. (The site’s tagline is “giving back to open source for the holidays.”) Over the years 26,465 contributors (as well as 25,738 organizations) have already participated through the site.
The Advent of JavaScript and Advent of CSS sites promise 24 puzzles delivered by email (though you’ll have to pay if you also want them to email you the solutions!)

This year also saw daily challenges from the sixth annual Code Security advent calendar being announced on Twitter, while TryHackMe.com has its own set of cybersecurity puzzles (and even a few prizes).

Read more of this story at Slashdot.

World’s Oldest Person Dies at Age 124

Slashdot reader ellithligraw brings the news that the oldest person on earth has died in the Philippines this week at age 124.

CNN Philippines reports:

Susano was born on Sept. 11, 1897, which was before the country became independent from Spanish rule. As of September this year, Guinness World Records was still verifying the documents needed for her to be officially declared as the world’s oldest living person.

NextShark calls Susano "the last surviving person born in the 19th century." And they add that, according to Manila Bulletin, "Susano has 14 children. One of them is considered a centenarian at the age of 101."

Former Ubiquiti Dev Charged For Trying To Extort His Employer

Long-time Slashdot reader tinskip shares a report from BleepingComputer: Nickolas Sharp, a former employee of networking device maker Ubiquiti, was arrested and charged today with data theft and attempting to extort his employer while posing as a whistleblower and an anonymous hacker. “As alleged, Nickolas Sharp exploited his access as a trusted insider to steal gigabytes of confidential data from his employer, then, posing as an anonymous hacker, sent the company a nearly $2 million ransom demand,” U.S. Attorney Damian Williams said today. “As further alleged, after the FBI searched his home in connection with the theft, Sharp, now posing as an anonymous company whistleblower, planted damaging news stories falsely claiming the theft had been by a hacker enabled by a vulnerability in the company’s computer systems.”

According to the indictment (PDF), Sharp stole gigabytes of confidential data from Ubiquiti’s AWS (on December 10, 2020) and GitHub (on December 21 and 22, 2020) infrastructure using his cloud administrator credentials, cloning hundreds of GitHub repositories over SSH. Throughout this process, the defendant tried hiding his home IP address using Surfshark’s VPN services. However, his actual location was exposed after a temporary Internet outage. To hide his malicious activity, Sharp also altered log retention policies and other files that would have exposed his identity during the subsequent incident investigation. “Among other things, SHARP applied one-day lifecycle retention policies to certain logs on AWS which would have the effect of deleting certain evidence of the intruder’s activity within one day,” the court documents read.

After Ubiquiti disclosed a security incident in January following Sharp’s data theft, while working to assess the scope and remediate the security breach effects he also tried extorting the company (posing as an anonymous hacker). His ransom note demanded almost $2 million in exchange for returning the stolen files and the identification of a remaining vulnerability. The company refused to pay the ransom and, instead, found and removed a second backdoor from its systems, changed all employee credentials, and issued the January 11 security breach notification. After his extortion attempts failed, Sharp shared information with the media while pretending to be a whistleblower and accusing the company of downplaying the incident. This caused Ubiquiti’s stock price to fall by roughly 20%, from $349 on March 30 to $290 on April 1, amounting to losses of over $4 billion in market capitalization.

Read more of this story at Slashdot.

Trump’s Social Media Site Quietly Admits It’s Based On Mastodon

mrflash818 shares a report from PCMag: To avoid a lawsuit, Donald Trump’s social media site is quietly acknowledging the computer code powering the platform comes from Mastodon. Trump’s “Truth Social” site now features a dedicated section labeled “open source,” which contains a Zip archive to Mastodon’s source code. “Our goal is to support the open source community no matter what your political beliefs are. That’s why the first place we go to find amazing software is the community and not ‘Big Tech,'” the site adds. Truth Social created the section on Nov. 12, two weeks after social networking provider Mastodon threatened to sue Trump’s platform for violating its open-source license.

Since Mastodon is an open-source software project, anyone can use it for free. But if you do, the software license demands the code and any ensuing modifications to your Mastodon-powered platform be made publicly available, allowing the entire Mastodon community to benefit. (This doesn’t include publishing any user data or disclosing admin access, though.) […] However, it appears the uploaded Zip archive is simply a barebones version of the existing Mastodon source code you can already find on GitHub. The archive itself is only a mere 30MB in size. Nevertheless, Rochko said the Zip archive might “become more interesting” once Truth Social finally launches.

Read more of this story at Slashdot.

Google Readies ‘Pixel Watch’ For 2022 Launch

According to Insider, Google is planning to launch its own in-house smartwatch in 2022. “Two employees said a spring launch was possible if the latest testing round is a success, however all sources stressed that details and timelines were subject to change depending on feedback from employees testing the device,” reports Insider. From the report: The device, which is internally codenamed “Rohan,” will showcase the latest version of Google’s smartwatch software to customers and partners […]. To date, Google has opted to create software for smartwatches built by partners such as Samsung, but has not made a device of its own. […] Unlike the Apple Watch, Google’s smartwatch is round and has no physical bezel, according to artistic renders viewed by Insider and employees who have seen it. Like Apple’s device, it will capture health and fitness metrics.

The watch has sometimes been referred to internally as the “Pixel watch” or “Android watch,” but executives have used a variety of names to refer to the project and it is unclear what branding Google will land on if and when it launches the device. […] The Rohan watch has a heart-rate monitor and offers basic health-tracking features such as step counting. In its current form the watch will require daily charging, according to a feedback document seen by Insider. One employee testing the watch lamented the charging was slow. Like the Apple Watch, Google’s wearable will also use proprietary watchbands. […]

Read more of this story at Slashdot.

Apple Loses Key Autos Engineer To Electric Aviation Startup Archer

Michael Schwekutsch, a director of engineering in the Apple Special Projects Group that’s reportedly working on self-driving cars, has left to join electric air taxi start-up Archer as its senior VP of engineering. Schwekutsch noted the change on his LinkedIn page on Wednesday. CNBC reports: The move is the latest example of staff turnover in Apple’s secretive car project. Former VP of special projects Doug Field left in September to lead Ford’s emerging technology efforts, a priority for the legacy automaker under its new Ford+ turnaround plan. The move also indicates that tech start-ups attacking climate issues can attract the most qualified engineers. A former VP of engineering at Tesla, Schwekutsch holds more than 100 patents related to vehicle design, worked on prototypes for the Tesla Plaid systems, and led production of electric drive systems for several vehicle models from Tesla, Porsche, BMW and others, according to his online resume.

Archer is working on electric-powered air taxis that take off and land vertically. Like competitors Lilium and Joby Aviation, Archer aims to transport passengers on short trips, avoiding traffic on the ground and the noise and emissions generated by traditional fuel-burning aircraft and cars. It’s already developed a model known as the Maker that can carry one passenger and a pilot, and is working on a four-passenger model. The company aims to operate urban air mobility services starting in Los Angeles once its aircraft are cleared by the Federal Aviation Administration for commercial use. Founded in 2018 and based in Palo Alto, Calif., Archer went public in September after merging with a special purpose acquisition company (SPAC), Atlas Crest Investment Corp.

Read more of this story at Slashdot.

Apple Renews Bid To Halt Court-Ordered App Store Change

Apple’s AR Headset Coming Next Year With ‘Mac-level’ Power, Report Says

Apple’s first AR headset will be released in the fourth quarter of 2022, according to a research note from analyst Ming-chi Kuo. The Verge: Kuo predicted back in March that the headset would be released sometime next year, and is now also providing more technical information on the device. The headset will have two processors, according to Kuo, one with “the same level of computing power as M1” and one lower-end chip to handle input from the various sensors. For example, Kuo says that the headset has “at least 6-8 optical modules to simultaneously provide continuous video see-through AR services.” The headset is also said to have two 4K OLED microdisplays from Sony. Kuo cites the headset’s “Mac-level (PC-level) computing power,” its ability to be operated untethered, and its wide range of applications as factors that will differentiate it from competitors. Various reports on the device have disagreed as to whether it will be wholly independent or rely on an iPhone or a separate processor box to stream content.

Read more of this story at Slashdot.

Over 300,000 Android Users Have Downloaded These Banking Trojan Malware Apps, Say Security Researchers

Over 300,000 Android smartphone users have downloaded what turned out to be banking trojans after falling victim to malware that has bypassed detection by the Google Play app store. ZDNet reports: Detailed by cybersecurity researchers at ThreatFabric, the four different forms of malware are delivered to victims via malicious versions of commonly downloaded applications, including document scanners, QR code readers, fitness monitors and cryptocurrency apps. The apps often come with the functions that are advertised in order to avoid users getting suspicious. In each case, the malicious intent of the app is hidden and the process of delivering the malware only begins once the app has been installed, enabling them to bypass Play Store detections.

The most prolific of the four malware families is Anatsa, which has been installed by over 200,000 Android users — researchers describe it as an “advanced” banking trojan that can steal usernames and passwords, and uses accessibility logging to capture everything shown on the user’s screen, while a keylogger allows attackers to record all information entered into the phone. […] The second most prolific of the malware families detailed by researchers at ThreatFabric is Alien, an Android banking trojan that can also steal two-factor authentication capabilities and which has been active for over a year. The malware has received 95,000 installations via malicious apps in the Play Store. […] The other two forms of malware that have been dropped using similar methods in recent months are Hydra and Ermac, which have a combined total of at least 15,000 downloads. ThreatFabric has linked Hydra and Ermac to Brunhilda, a cyber-criminal group known to target Android devices with banking malware. Both Hydra and Ermac provide attackers with access to the device required to steal banking information. ThreatFabric has reported all of the malicious apps to Google and they’ve either already been removed or are under review.

Read more of this story at Slashdot.

Browser Extension Shows How Many Brands On Amazon Are Actually Just Amazon

A new browser extension promises to show you which products in your Amazon search results are sold by brands that are either owned by or are exclusive to Amazon, giving you a better idea of who’s selling what you’re buying. The Verge reports: It’s called Amazon Brand Detector, and it uses a list of Amazon brands created by The Markup, along with filters and other techniques (detailed here) to detect and highlight products that are a part of Amazon’s Our Brands program. The Markup created this extension after its investigation into how Amazon ranks its in-house brands in search results and says the tool (available for Chrome-like browsers and Firefox) is designed to make searches more transparent. When we tested it, it obviously highlighted Amazon Basics and Essentials products, but it also drew attention to results that were otherwise indistinguishable from ones not affiliated with Amazon: a dog leash labeled as being made by Panykoo, socks by Teebulen, a sweater by Ofeefan.

While Amazon marked some of those results as “featured from our brands,” that wasn’t the case for all of them. That advisory text is also small and grey, making it easy to miss if you’re casually browsing (especially since there may not be any notice of the affiliation on the actual product page), and it didn’t show up on every result the tool highlighted. Amazon isn’t necessarily shadowy about these brands: it has a page that lists its “private and select exclusive brands,” many of which have legit-sounding names: Happy Belly, Wag, Nature’s Wonder. Some are private labels owned by Amazon, where some are “curated selections” sold exclusively on Amazon but not necessarily operated by the company. According to The Markup, the extension “does not collect any data” and should be compatible with other extensions.

Read more of this story at Slashdot.