whoever57 writes: A blind person with a guide dog was denied rides and harassed because of her guide dog. She sued Uber, which tried to blame its contractors and deny liability. However, an arbitrator has rejected that argument and found the company liable, awarding the blind passenger $1.1 million. The arbitrator found that Uber staffers coached drivers on how to deny rides to disabled passengers without it appearing to be a violation of the law. The staffers also advocated to keep problematic drivers on the platform.

An anonymous reader quotes a report from Ars Technica: More details have emerged about the climate and energy priorities of President Joe Biden's infrastructure plan, and they include support for nuclear power and carbon capture with sequestration (CCS). In a press conference yesterday with reporters, White House climate adviser Gina McCarthy said the administration would seek to implement a clean energy standard that would encourage utilities to use greener power sources. She added that both nuclear and CCS would be included in the administration's desired portfolio. The clean energy standard adds a climate dimension to the Biden administration's recently announced infrastructure plan, seeking to put the US on a path to eliminating carbon pollution.

"We think a CES is appropriate and advisable, and we think the industry itself sees it as one of the most flexible and most effective tools," McCarthy told reporters. "The CES is going to be fairly robust and it is going to be inclusive." McCarthy did not provide details about how far a CES would go in supporting nuclear power. It's possible that the policy may only cover plants that are currently operating, but it may also extend to include new plants. The former is more likely than the latter, though, given the challenges and costs involved in building new nuclear capacity. CCS is another technology mentioned, which involves capturing carbon dioxide from power plant exhaust streams and sequestering it underground. "The technology has been condemned for prolonging reliance on fossil fuels, and no commercial power plant in the US currently uses CCS," notes Ars.

McCarthy added that they aren't ruling out a carbon tax or fee to get to net-zero.

A potential class-action lawsuit will go forward for Apple's fragile 2016 MacBook Pro display cables. Judge Edward Davila ruled that "Apple should have known that they would fail and yet kept selling them anyhow," reports The Verge. It follows a recently-certified class action lawsuit for the MacBook Pro's infamous butterfly keyboards. From the report: "The court finds that the allegations of pre-release testing in combination with the allegations of substantial customer complaints are sufficient to show that Apple had exclusive knowledge of the alleged defect," the judge wrote. [The issue is] sometimes called the "stage light" issue because of how the cable damage would produce those dark spots.

Part of the flexgate controversy is around how Apple addressed the issue when it first got publicity in late 2018 -- first by silently swapping a new, slightly longer cable into newer MacBooks, and only opening up one of its typical free repair programs months after 15,000 users signed a petition and it was called out in the press. The company's been a lot more responsive with issues ever since, such as with this free battery replacement program for a small number of those 2016 and 2017 MacBook Pro laptops that won't charge anymore. Unlike the butterfly keyboard suit, the flexgate one doesn't appear to be a certified class-action lawsuit yet -- but there are now nine different plaintiffs lined up in this single case, and the judge is inviting them to submit a new amended complaint.

iOS 14 has brought several new privacy features, and there are more to come with App Tracking Transparency -- which will let users opt out of being tracked by apps. From a report: As the launch of this new option approaches, Apple has begun to reject apps using third-party SDKs that collect user data without consent. Developers can implement some SDKs that help them track users by a method called "device fingerprinting," which uses multiple attributes such as the device model, IP address, and other data to identify a person across the internet. Apps often use this data for deep analysis about their audience or to sell advertisements.

While tracking the user is not exactly illegal, Apple wants to put an end to apps that do this without explicit consent. As noted by analyst Eric Seufert, the company is now rejecting any apps using the Adjust SDK, which is one of those SDKs that provides device fingerprinting. There would be no problem for these developers if the Adjust SDK complied with Apple's new privacy guidelines, but this doesn't seem to be the case. Seufert detailed to 9to5Mac that the Adjust SDK not only doesn't have an option for users to opt out of being tracked, but has also been suggesting alternatives for developers to continue tracking users once Apple enables App Tracking Transparency. Snap has explored how it can circumvent new privacy rules for iPhones, Financial Times reported Friday.

An anonymous reader quotes a report from Ars Technica: Federal prosecutors have indicted a Kansas man for allegedly logging into a computer system at a public water system and tampering with the process for cleaning and disinfecting customers' drinking water. An indictment filed in US District Court for the District of Kansas said Wyatt A. Travnichek, 22, of Ellsworth County, Kansas, was an employee from January 2018 to January 2019 at the Ellsworth County Rural Water District No. 1. Also known as the Post Rock Water District, the facility serves more than 1,500 retail customers and 10 wholesale customers in eight Kansas counties. Part of Wyatt's responsibilities included remotely logging in to the water district's computer system to monitor the plant after hours.

In late March 2019, Wednesday's indictment said, Post Rock experienced a remote intrusion to its computer system that resulted in the shutdown of the facility's processes for ensuring water is safe to drink. "On or about March 27, 2019, in the District of Kansas, the defendant, Wyatt Travnichek, knowingly tampered with a public drinking water system, namely the Ellsworth County Rural Water District No. 1," prosecutors alleged. "To wit: he logged in remotely to Post Rock Rural Water District's computer system and performed activities that shut down processes at the facility which affect the facility's cleaning and disinfecting procedures with the intention of harming the Ellsworth County Rural Water District No. 1." Wednesday's indictment didn't say how Wyatt allegedly gained access to the Post Rock facility. "The indictment charges Wyatt with one count of tampering with a public water system and one count of reckless damage to a protected computer during unauthorized access," adds Ars. "If convicted, he faces a maximum sentence of 25 years in prison and $500,000 in fines."

Amtrak released a proposed map Wednesday of an expanded U.S. rail system that could be built with funding from President Biden's infrastructure plan. Axios reports: The expanded rail system -- funded with the $80 billion Biden's infrastructure plan allocates to rail specifically -- would "create jobs, improve the quality of life, reduce carbon emissions and generate economic growth," Amtrak said in a statement. The envisioned train network would create up to 30+ new routes in 15 more states, connecting 160 more communities and serving 20 million more passengers, according to Amtrak. The company also says the expanded map would lower carbon emissions, claiming that traveling on Amtrak is "up to 83% more energy efficient than driving and up to 73% more energy efficient than flying."

An anonymous reader quotes a report from The New York Times: The Supreme Court unanimously ruled on Thursday that the Federal Communications Commission could relax rules limiting the number of newspapers, radio stations and television stations that a single entity may own in a given market. The decision is likely to prompt further consolidation among broadcast outlets, some of which say they need more freedom to address competition from internet and cable companies. Critics fear that media consolidation will limit the perspectives available to viewers.

The rules at issue in the case, initially adopted between 1964 and 1975, had been meant "to promote competition, localism and viewpoint diversity by ensuring that a small number of entities do not dominate a particular media market," Justice Brett M. Kavanaugh wrote for the court. But the rules, he added, were a relic of a different era -- "an early-cable and pre-internet age when media sources were more limited." "By the 1990s, however, the market for news and entertainment had changed dramatically," Justice Kavanaugh wrote. "Technological advances led to a massive increase in alternative media options, such as cable television and the internet. Those technological advances challenged the traditional dominance of daily print newspapers, local radio stations and local television stations."

The case, Federal Communications Commission v. Prometheus Radio Project, No. 19-1231, concerned three rules. One barred a single entity from owning a radio or television station and a daily print newspaper in the same market, the second limited the number of radio and television stations an entity can own in a single market, and the third restricted the number of local television stations an entity could own in the same market. In 2017, the commission concluded that the three rules no longer served their original purposes of promoting competition and the like. The vote was 3 to 2 along party lines, with the commission's Republican members in the majority.

Google today announced a series of policy updates for apps distributed through the Play Store. The most impactful sees Google limit most developers from seeing which Android apps are installed on your device. From a report: As part of its ongoing work to restrict the use of high risk/sensitive permissions, Google is limiting what apps can use the QUERY_ALL_PACKAGES permission that "gives visibility into the inventory of installed apps on a given device." This applies to apps that target API 30+ on devices running Android 11 and newer. Enforcement was originally meant to occur earlier, but delayed in light of COVID-19.

The Supreme Court has unanimously decided that Facebook text message alerts don't violate laws against unwanted auto-dialed calls. The court ruled that a lower court defined illegal "robocalls" too broadly and that the term should only apply to systems that generate lists of numbers and call them indiscriminately, not a system that simply stores numbers and automatically calls them. From a report: The lawsuit involves text messages that notify Facebook users of an attempted login. Its plaintiff, Noah Duguid, sued after receiving unwanted, erroneous notifications despite not having a Facebook account. Duguid argued that Facebook was violating the 1991 Telephone Consumer Protection Act (TCPA). An appeals court agreed, but the Supreme Court interpreted the law's definitions differently. Closely parsing the TCPA's grammar, the court concluded that an illegal auto-dialing system "must use a random or sequential number generator," and this definition "excludes equipment like Facebook's login notification system, which does not use such technology."

wiredog shares a ZDNet report: I have literally been covering SCO's legal attempts to prove that IBM illegally copied Unix's source code into Linux for over 17 years. I've written well over 500 stories on this lawsuit and its variants. I really thought it was dead, done, and buried. I was wrong. Xinuos, which bought SCO's Unix products and intellectual property (IP) in 2011, like a bad zombie movie, is now suing IBM and Red Hat [for] "illegally Copying Xinuos' software code for its server operating systems." For those of you who haven't been around for this epic IP lawsuit, you can get the full story with "27 eight-by-ten color glossy photographs and circles and arrows and a paragraph on the back of each one" from Groklaw. If you'd rather not spend a couple of weeks going over the cases, here's my shortened version. Back in 2001, SCO, a Unix company, joined forces with Caldera, a Linux company, to form what should have been a major Red Hat rival. Instead, two years later, SCO sued IBM in an all-out legal attack against Linux.

The fact that most of you don't know either company's name gives you an idea of how well that lawsuit went. SCO's Linux lawsuit made no sense and no one at the time gave it much of a chance of succeeding. Over time it was revealed that Microsoft had been using SCO as a sock puppet against Linux. Unfortunately for Microsoft and SCO, it soon became abundantly clear that SCO didn't have a real case against Linux and its allies. SCO lost battle after battle. The fatal blow came in 2007 when SCO was proven to have never owned the copyrights to Unix. So, by 2011, the only thing of value left in SCO, its Unix operating systems, was sold to UnXis. This acquisition, which puzzled most, actually made some sense. SCO's Unix products, OpenServer and Unixware, still had a small, but real market. At the time, UnXis now under the name, Xinuos, stated it had no interest in SCO's worthless lawsuits. In 2016, CEO Sean Synder said, "We are not SCO. We are investors who bought the products. We did not buy the ability to pursue litigation against IBM, and we have absolutely no interest in that." So, what changed? The company appears to have fallen on hard times. As Synder stated: "systems, like our FreeBSD-based OpenServer 10, have been pushed out of the market." Officially, in his statement, Snyder now says, "While this case is about Xinuos and the theft of our intellectual property, it is also about market manipulation that has harmed consumers, competitors, the open-source community, and innovation itself."

An alleged mafia fugitive hiding from Italian police in the Dominican Republic was arrested after being spotted showing off his cooking skills in instructional videos he posted on YouTube, according to news reports. Ars Technica reports: Marc Feren Claude Biart, an alleged member of the 'Ndrangheta criminal organization based in southern Italy, reportedly hid his face in the cooking videos but failed to hide his tattoos, leading to his identification. The man had been hiding since law enforcement "ordered Biart's arrest in 2014 for criminal drug trafficking on behalf of the 'Ndrangheta's Cacciola clan," according to The Washington Post.

The 53-year-old Biart didn't keep his recipes secret but "was always careful to hide his face in his Italian cooking tutorials, filming the YouTube videos while laying low from police on a sandy beach in the Caribbean," the Post wrote. It's not clear whether the videos are still online, but Biart and his wife "appeared to have uploaded several cooking tutorials for Italian recipes to YouTube, including ones where Biart's tattoos were visible," the Post wrote. The arrest and YouTube aspect of the story were confirmed by Interpol, the International Criminal Police Organization, which helped in the investigation. "Authorities located [Biart] after recognizing his tattoos in a YouTube video," Interpol wrote on Twitter today.

One of the many promises made in President Biden's $2 trillion infrastructure plan is to deliver "future proof" broadband to every home in American within eight years. It sets aside $100 billion to accomplish this feat. Motherboard reports: While specifics are murky, a new fact sheet on the proposal states the plan won't just involve throwing more subsidies at America's deep-pocketed incumbents, an American pastime studies show historically hasn't delivered on the promise of faster, better broadband. Instead, the Biden administration says it plans to "prioritize support" for broadband networks owned, operated, or run in concert with local governments. Frustrated by limited competition and substandard service, some 750 U.S. communities have built local broadband networks that studies have shown are faster and less expensive than traditional options.

"President Biden's plan will promote price transparency and competition among internet providers, including by lifting barriers that prevent municipally-owned or affiliated providers and rural electric co-ops from competing on an even playing field with private providers, and requiring internet providers to clearly disclose the prices they charge," the plan states. The problem: neither the Biden FCC nor broader administration can do much about such state-level restrictions. Previous efforts by the Obama FCC to eliminate state barriers to community broadband were shot down in court. Still, clear support for such efforts is a course change from the GOP, which has repeatedly tried to ban community broadband entirely.

According to Reuters, India is offering more than $1 billion in cash to each semiconductor company that sets up manufacturing units in the country as it seeks to build on its smartphone assembly industry and strengthen its electronics supply chain. From the report: Prime Minister Narendra Modi's "Make in India" drive has helped to turn India into the world's second-biggest mobile manufacturer after China. New Delhi believes it is time for chip companies to set up in the country. "The government will give cash incentives of more than $1 billion to each company which will set up chip fabrication units," a senior government official told Reuters, declining to be named as he was not authorised to speak with media. "We're assuring them that the government will be a buyer and there will also be mandates in the private market (for companies to buy locally made chips)."

How to disburse the cash incentives has yet to be decided and the government has asked the industry for feedback. India also wants to establish reliable suppliers for its electronics and telecom industry to cut dependence on China following border skirmishes last year. Chips made locally will be designated as "trusted sources" and can be used in products ranging from CCTV cameras to 5G equipment.

An anonymous reader quotes a report from The Record by Recorded Future: Academic research published last week looked at the telemetry traffic sent by modern iOS and Android devices back to Apple and Google servers and found that Google collects around 20 times more telemetry data from Android devices than Apple from iOS. The research, conducted by Professor Douglas J. Leith from Trinity College at the University of Dublin, analyzed traffic originating from iOS and Android devices heading to Apple and Google servers at various stages of a phone's operation... [...] The study unearthed some uncomfortable results. For starters, Prof. Leith said that "both iOS and Google Android transmit telemetry, despite the user explicitly opting out of this [option]." Furthermore, "this data is sent even when a user is not logged in (indeed even if they have never logged in)," the researcher said.

But while the Irish researcher found that Apple tends to collect more information data types from an iOS device, it was Google that collected "a notably larger volume of handset data. During the first 10 minutes of startup the Pixel handset sends around 1MB of data is sent to Google compared with the iPhone sending around 42KB of data to Apple," Prof. Leith said. "When the handsets are sitting idle the Pixel sends roughly 1MB of data to Google every 12 hours compared with the iPhone sending 52KB to Apple i.e., Google collects around 20 times more handset data than Apple." In response to the findings, a Google spokesperson said: "This research outlines how smartphones work. Modern cars regularly send basic data about vehicle components, their safety status and service schedules to car manufacturers, and mobile phones work in very similar ways. This report details those communications, which help ensure that iOS or Android software is up to date, services are working as intended, and that the phone is secure and running efficiently." The Android maker also disputed the paper's methodology, which they claim under-counted iOS' telemetry volume by excluding certain types of traffic, which Google believes resulted in skewed results that found Android devices collecting 20 times more data than iOS.

Apple echoed its rival's response. "The report conflates a number of items in relation to different services and misunderstands how personal location data is protected," an Apple spokesperson told The Record. "Apple is not collecting data that can be associated with individuals without a user's knowledge or consent."

Additional information about the findings can be found here (PDF).

An anonymous reader quotes a report from TorrentFreak: The popular and entirely legal Steam Database has found itself in a precarious position following two erroneous DMCA notices from SEGA. Steam Database's host is being asked to suspend the platform due to a claimed lack of response to the first notice. This prompted the site to take down entirely legal content in an effort to address the problem. [...]

TorrentFreak was able to review the notice sent by SEGA to SteamDB's host and it pulls no punches. SEGA doubles down by stating that SteamDB is illegally distributing the game Yakuza: Like a Dragon, noting that it has tried to inform SteamDB but was "not able" to resolve the issue. Worryingly, it then implies that legal action might be taken against SteamDB for non-compliance, adding that the host should "immediately suspend" SteamDB due to the alleged ongoing infringement. Which, of course, is not taking place.

This puts SteamDB's host in a tough position. Failure to act against an allegedly infringing customer can put the host at risk in terms of liability but disabling a customer's website can cause a whole new set of problems, especially when that customer has not infringed anyone's rights. In an effort to sort the problem out, SteamDB's host asked for additional input from the operators of SteamDB but nevertheless warned that if that information was not received, it may still block the SteamDB server within 24 hours, as demanded in the SEGA takedown notice. In order to defuse the situation, SteamDB took down the allegedly-infringing page which as far as SEGA goes (and at least in theory) should solve the disconnection threat problem. However, the entire situation has proven counterproductive for SEGA too.

An anonymous reader shares a report from Decrypt about BitClout, an ambitious decentralized social network that tokenizes Twitter personalities. Here's an excerpt from the report: At first glance, BitClout looks and feels like primitive mashup of Twitter and Robinhood, including a stream of messages and buttons to like or share what other people post. Anyone can create a profile and begin participating in the network by providing a phone number. But BitClout has already created 15,000 profiles based on popular Twitter personalities, including ones for Elon Musk and influencers in the cryptocurrency world -- all without asking anyone's permission. Diamondhands [the man behind BitClout who asked for anonymity even though his real identity is well known] says BitClout created the profiles to prevent impostors from creating fake accounts and squatting on them.

Every BitClout account is also tied to a "coin" that rises and falls in value depending on how many people use it. Anyone can follow a given account -- as they would on Twitter or Instagram -- but the coin means they can also own an asset that is hypothetically tied to the person's public reputation. "What you get to do is monetize yourself," says Diamondhands. "All the positive things you put out in the world will cause people to like you and buy your coin. You can monetize pent up enthusiasm for you, and let fans ride the rocket ship with you." BitClout users who feel inclined to being bought and sold in this way can create a profile to earn a portion of the coins associated with their image. In the case of those Twitter personalities whom BitClout already added to the platform, they can claim their profile (and a portion of the coins associated with it) by tweeting that they have joined the network -- a requirement that conveniently provides free marketing for BitClout. [...] A tracking site called BitClout Pulse has already sprung up to track the value of more popular coins.

BitClout's unusual twist on social networking extends beyond adding people without their permission. The project also stands out for its technical operations, which rely on dozens of autonomous blockchain-based nodes scattered around the world -- a very different architecture than Facebook or Twitter, which rely on centralized servers to keep their networks running. Every message or transaction is recorded to BitClout's blockchain, which Diamondhands describes vaguely as custom-built software similar to Bitcoin's, but with greater capacity for social networking functions. He says BitClout's code is open source and the team will soon publish it. All of this, says Diamondhands, will eventually lead to brand-name organizations hosting BitClout nodes that will display feeds tailored to various interests. For instance, he says, ESPN could run a node that displays a feed heavily populated with sports figures, while Politico might do the same with a focus on political leaders. But Bitclout's node structure also means it will lack centralized moderation policies like those found on platforms like Twitter or Facebook. Yes, we're on BitClout: bitclout.com/u/slashdotorg

The National Labor Relations Board on Monday rejected Amazon's request to install a video camera to keep an eye on boxes containing thousands of ballots key to a high-stakes union election in Alabama. From a report: The closely-watched union election in Bessemer, Alabama, concluded on Monday. Approximately 5,800 workers at the facility in Bessemer were eligible to vote to join the Retail, Wholesale and Department Store Union (RWDSU). Vote counting begins at 11 a.m. ET on Tuesday, but the final tally may be days or weeks away, as Amazon and the RWDSU can contest ballots. Amazon had sought to place a video camera in the NLRB's Birmingham office, where votes will be tabulated, to keep an eye on the ballot boxes in the off hours between counting, according to an NLRB order denying Amazon's request. The camera feed would have been accessible by both Amazon and the RWDSU. "Though the mail ballot election in this matter is large, it is not, as the Employer asserts, of a 'special nature,'" Lisa Henderson, acting regional director for the NLRB, said in the ruling. "The Region will conduct the ballot count within view of observers participating via virtual platform as well as in-person observers, and in accordance with Agency procedures and protocols, including those for securing ballot boxes."

dotancohen writes: Late Sunday night, on March 28, 2021, Nikita Popov, a core PHP committer, released a statement indicating that two malicious commits had been pushed to the php-src Git repository. These commits were pushed to create a backdoor that would have effectively allowed attackers to achieve remote code execution through PHP and an HTTP header. "The incident is alarming considering PHP remains the server-side programming language to power over 79% of the websites on the Internet," adds BleepingComputer.

"In the malicious commits [1, 2] the attackers published a mysterious change upstream, 'fix typo' under the pretense this was a minor typographical correction. However, taking a look at the added line 370 where zend_eval_string function is called, the code actually plants a backdoor for obtaining easy Remote Code Execution (RCE) on a website running this hijacked version of PHP."

According to Popov, the first commit was detected a couple hours after it was made, and the changes were reverted right away. "Although a complete investigation of the incident is ongoing, according to PHP maintainers, this malicious activity stemmed from the compromised git.php.net server, rather than compromise of an individual's Git account," reports BleepingComputer. "As a precaution following this incident, PHP maintainers have decided to migrate the official PHP source code repository to GitHub."

An anonymous reader writes: The New Zealand Ministry of Health has launched a "sweeping review" of the nation's COVID vaccine-booking system, after a data breach led to exposure of personal information for more than 700 patients. A whistleblower reported over the weekend that they could access information about other patients, which was "readily accessible within the public-facing code of the website" -- apparently hard coded.

As a response, the Ministry of Health has ordered a review of all systems made by the developer, Valentia Technologies, which also makes software used by the Ambulance service, many GP practices, and the managed isolation and quarantine system. "It is not a coding error. It is incompetence. The developer who developed this is incompetent ... This is basic stuff," said the man who spotted the booking system problem.

"The source code of the website, flagged a few concerning features, including someone's name, and an NHI number hard coded into the website, for what reason? I don't know," he said. "We could see everyone's details. We skimmed through, we didn't look at names, but their names, dates of birth, NHI numbers for those who entered them, contact details, where they were getting their vaccinations, what time they were vaccinated."

He said it appeared that Canterbury DHB had used a modified internal system to create the booking system. "You can tell by the source code, this was never meant to be a public facing website. This was only for people to use on like iPads, in doctors' surgeries, it was not supposed to be for this."

"One more thing," Steve Jobs would say at the end of many an Apple keynote, giving his cue for announcing a surprise new product. But Apple can't keep its founder's turn of phrase for itself, a London judge ruled Monday as he sided with Swiss watchmaker Swatch Group AG in a long-running dispute over trademarks. From a report: Swatch's attempt to register the phrase might have been an attempt to "annoy" Apple, Judge Iain Purvis said in his ruling, but Apple can't block it from doing so. Purvis said in his ruling that the phrase probably originated with the fictional TV detective Columbo. A previous court officer was wrong to say that "Swatch's intentions had stepped over the line between the appropriate and inappropriate use of a trade mark," Purvis added. The dispute is part of a broader battle between the Cupertino, California-based company and Swatch over the naming of watches that goes back to the launch of Apple's own product in 2015 when Apple was prevented from calling its version the 'iWatch'. The dispute with Swatch extended to other trademarks including the watchmaker's move to register 'Tick Different' evoking Apple's own slogan of 'Think Different.'