Post Syndicated from digiblurDIY original https://www.youtube.com/watch?v=tG6FjROiwBE
Security updates for Tuesday
Post Syndicated from original https://lwn.net/Articles/933246/
Security updates have been issued by Debian (libssh and sssd), Fedora (microcode_ctl and python3.6), Gentoo (cgal, firefox firefox-bin, openimageio, squashfs-tools, thunderbird thunderbird-bin, tiff, tomcat, webkit-gtk, and xorg-server xwayland), SUSE (c-ares and go1.18-openssl), and Ubuntu (Jhead, node-hawk, node-nth-check, and perl).
Brute-Forcing a Fingerprint Reader
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2023/05/brute-forcing-a-fingerprint-reader.html
It’s neither hard nor expensive:
Unlike password authentication, which requires a direct match between what is inputted and what’s stored in a database, fingerprint authentication determines a match using a reference threshold. As a result, a successful fingerprint brute-force attack requires only that an inputted image provides an acceptable approximation of an image in the fingerprint database. BrutePrint manipulates the false acceptance rate (FAR) to increase the threshold so fewer approximate images are accepted.
BrutePrint acts as an adversary in the middle between the fingerprint sensor and the trusted execution environment and exploits vulnerabilities that allow for unlimited guesses.
In a BrutePrint attack, the adversary removes the back cover of the device and attaches the $15 circuit board that has the fingerprint database loaded in the flash storage. The adversary then must convert the database into a fingerprint dictionary that’s formatted to work with the specific sensor used by the targeted phone. The process uses a neural-style transfer when converting the database into the usable dictionary. This process increases the chances of a match.
With the fingerprint dictionary in place, the adversary device is now in a position to input each entry into the targeted phone. Normally, a protection known as attempt limiting effectively locks a phone after a set number of failed login attempts are reached. BrutePrint can fully bypass this limit in the eight tested Android models, meaning the adversary device can try an infinite number of guesses. (On the two iPhones, the attack can expand the number of guesses to 15, three times higher than the five permitted.)
The bypasses result from exploiting what the researchers said are two zero-day vulnerabilities in the smartphone fingerprint authentication framework of virtually all smartphones. The vulnerabilities—one known as CAMF (cancel-after-match fail) and the other MAL (match-after-lock)—result from logic bugs in the authentication framework. CAMF exploits invalidate the checksum of transmitted fingerprint data, and MAL exploits infer matching results through side-channel attacks.
Depending on the model, the attack takes between 40 minutes and 14 hours.
Also:
The ability of BrutePrint to successfully hijack fingerprints stored on Android devices but not iPhones is the result of one simple design difference: iOS encrypts the data, and Android does not.
Hello World #21 out now: Focus on primary computing education
Post Syndicated from Gemma Coleman original https://www.raspberrypi.org/blog/hello-world-21-primary-computing-education/
How do we best prepare young children for a world filled with digital technology? This is the question the writers in our newest issue of Hello World respond to with inspiration and ideas for computing education in primary school.

It is vital that young children gain good digital literacy skills and understanding of computing concepts, which they can then build on as they grow up. Digital technology is here to stay, and as Sethi De Clercq points out in his article, we need to prepare our youngest learners for circumstances and jobs that don’t yet exist.


Primary computing education: Inspiration and ideas
Issue 21 of Hello World covers a big range of topics in the theme of primary computing education, including:
- Cross-curricular project ideas to keep young learners engaged
- Perfecting typing skills in the primary school classroom
- Using picture books to introduce programming concepts to children
- Toolkits for new and experienced computing primary teachers, by Neil Rickus and Catherine Archer
- Explorations of different approaches to improving diversity in computing and instilling a sense of belonging from the very start of a child’s educational journey, by Chris Lovell and Peter Marshman
The issue also has useful news and updates about our work: we share insights from our primary-specialist learning managers, tell you a bit about the research presented at our ongoing primary education seminar series, and include some relevant lesson plans from The Computing Curriculum.

As always, you’ll find many other articles to support and inspire you in your computing teaching in this new issue. Topics include programming with dyslexia, exploring filter bubbles with your learners to teach them about data science, and using metaphors, similes, and analogies to help your learners understand abstract concepts.
What do you think?
This issue of Hello World focusses on primary computing education because readers like you told us in the annual readers’ survey that they’d like more articles for primary teachers.
We love to hear your ideas about what we can do to continue making Hello World interesting and relevant for you. So please get in touch on Twitter with your thoughts and suggestions.
The post Hello World #21 out now: Focus on primary computing education appeared first on Raspberry Pi Foundation.
24850 young people’s programs ran in space for Astro Pi 2022/23
Post Syndicated from Fergus Kirkpatrick original https://www.raspberrypi.org/blog/young-peoples-computer-programs-space-iss-astro-pi-22-23/
Over 15,000 teams of young people from across Europe had their computer programs run on board the International Space Station (ISS) this month as part of this year’s European Astro Pi Challenge.

Astro Pi is run in collaboration by us and ESA Education, and offers two ways to get involved: Mission Zero and Mission Space Lab.
Mission Zero: Images of Earth’s fauna and flora in space
Mission Zero is the Astro Pi beginners’ activity. To take part, young people spend an hour writing a short Python program for the Astro Pi computers on the International Space Station (ISS). This year we invited them to create an 8×8 pixel image or animation on the theme of fauna and flora, which their program showed on an Astro Pi LED matrix display for 30 seconds.
This year, 23,605 young people’s Mission Zero programs ran on the ISS. We need to check all the programs before we can send them to space and that means we got to see all the images and animations that the young people created. Their creativity was absolutely incredible! Here are some inspiring examples:

Mission Space Lab: Young people’s experiments on the ISS
Mission Space Lab runs over eight months and empowers teams of young people to design real science experiments on the ISS, executed by Python programs they write themselves. Teams choose between two themes: ‘Life in space’ and ‘Life on Earth’.
This year, the Mission Space Lab programs of 1245 young people in 294 teams from 21 countries passed our rigorous judging and testing process. These programs were awarded flight status and sent to the Astro Pis on board the ISS, where they captured data for the teams to analyse back down on Earth.
Mission Space Lab teams this year decided to design experiments such as analysing cloud formations to identify where storms commonly occur, looking at ocean colour as a measure of depth, and analysing freshwater systems and the surrounding areas they supply water to.

Teams will be receiving their experiment data later this week, and will be analysing and interpreting it over the next few weeks. For example, the team analysing freshwater systems want to investigate how these systems may be affected by climate change. What their Mission Space Lab program has recorded while running on the Astro Pis is a unique data set that the team can compare against other scientific data.
The challenges of running programs in space
For the ‘Life on Earth’ category of Mission Space Lab experiments this year, the Astro Pis were positioned in a different place to previous years: in the Window Observational Research Facility (WORF). Therefore the Astro Pis could take photos with a wider view. Combined with the High Quality Camera of the upgraded Astro Pi computers we sent to the ISS in 2021, this means that the teams got amazing-quality photos of the Earth’s surface.

Once the experiments for ‘Life on Earth’ were complete, the astronauts moved the Astro Pis back to the Columbus module and replaced their SD cards, ready for capturing the data for the ‘Life in Space’ experiments.
Running programs in an environment as unique as the ISS, where all hardware and software is put to the test, brings many complexities and challenges. Everything that happens on the ISS has to be scheduled well in advance, and astronauts have a strict itinerary to follow to keep the ISS running smoothly.

As usual, this year’s experiments met with their fair share of challenges. One initial challenge the Astro Pis had this year was that the Canadarm, a robotic arm on the outside of the ISS, was in operation during some of the ‘Life on Earth’ experiments. Although it’s fascinating to see part of the ISS in-shot, it also slightly obscured some of the photos.
Another challenge was that window shutters were scheduled to close during some of the experiments, which meant we had to switch around the schedule for Mission Space Lab programs to run so that all of the experiments aiming to capture photos could do so.
What’s next for Astro Pi?
Well done to all the young people who’ve taken part in the European Astro Pi Challenge this year.
- If you’ve mentored young people in Mission Zero, then we will share their unique participation certificates with you very soon.
- If you are taking part in Mission Space Lab, then we wish you the best of luck with your analysis and final reports. We are excited to read about your findings.
If you’d like to hear about upcoming Astro Pi Challenges, sign up to the newsletter at astro-pi.org.
The post 24850 young people’s programs ran in space for Astro Pi 2022/23 appeared first on Raspberry Pi Foundation.
A post on the RustConf keynote fiasco
Post Syndicated from original https://lwn.net/Articles/933198/
The Rust community has experienced some turbulence in response to the
cancellation of a keynote talk at the upcoming RustConf event. The
Rust project leadership has now put out a blog post
apologizing for and explaining its role in the event, describing its
“decision-making and communication processes
” as the primary cause
of the failure.
Organizationally, within leadership chat we will enforce a strict
consensus rule for all decision making, so that there is no longer
ambiguity of whether something is an individual opinion or a group
decision. We are going to launch the new governance council as soon
as possible. We’ll assist the remaining teams to select their
representatives in a timely manner, so that the new governance
council can start and the current leadership chat can disband.
Този юмрук на Радев харесваме ли го?
Post Syndicated from Емилия Милчева original https://www.toest.bg/tozi-yumruk-na-radev-haresvame-li-go/

Преди три години юмрукът на президента събра, като пръчките на Кубрат, разединени по идеологически причини политици, активисти и обикновени протестиращи. Днес същите хора се обявяват срещу същия този юмрук. Преди три години протестиращи легитимираха президента като борец и символ на битка – срещу мафията, срещу модела ГЕРБ–ДПС. Каква по-подходяща роля за генерал от тази да е пълководец? Днес никой не назовава къде е мафията, макар всички да говорят за мафиотизирана държава, но няма съмнение, че Румен Радев вече е Борисов и половина с институционалните си владения.
Дори не се ръкуваха
Връчвайки втория мандат на ПП–ДБ и на кандидата на коалицията за премиер Николай Денков, Радев им показа нескрито омерзение и дори се опита да ги унижи с изявлението си, че мандатът е дискредитиран, но от немай-къде ще го връчи – защото Конституцията го задължава. Държавният глава отиде далеч извън правомощията си с думите, че не е целесъобразно да връчи мандата предвид изтеклите записи:
Заради торпилирането на българския суверенитет, наклеветяването и планираната чистка в службите и държавната администрация, заявката за вмешателство в изборите чрез овладяването на МВР и дискредитирането на лидери на европейските институции и името на България.
Балканските нрави проличаха – президент и политически лидери не размениха дори протоколните ръкостискания и побързаха да се разделят след връчването на папката. И това от президент, който в последните месеци при всеки удобен случай критикува партиите, че отказват да поемат отговорност и да съставят правителство.
Причината за напрежението – потвърденият като автентичен запис от заседание на Националния съвет на „Продължаваме промяната“. Той беше разпространен от доскорошния депутат от ПП–ДБ Радостин Василев, а президентът и неговите властови амбиции са важна сюжетна линия в тези над 4-часови дискусии. Лидерите на ПП ги обсъждат в две направления – специални служби и изобщо сектор сигурност и местна власт.
Описаната схема как президентът използва главния прокурор Иван Гешев и съветника си по вътрешна политика Николай Копринков като тоягата и моркова, за да „купува“ кметове на ГЕРБ, разкрива неподозирани от обществото амбиции на Радев.
В записа Асен Василев казва:
Румен Радев си е хванал под едната ръка Гешев, под другата ръка – Копринков. И с едната ръка ги подкупва, с другата ръка ги заплашва (кметовете, б.а.). Това нещо в момента се случва на абсолютно всички герберски кметове. Това, което ще се случи, е, че вместо да имаме ГЕРБ 25%, ще имаме ГЕРБ 15% и 10% прокремълска партия на Радев с местните кметове… Бойко (Бойко Борисов, б.а.) не иска Радев да прави местни избори.
„Властта е сладко коренче!“
За първи път България има държавен глава с толкова нескрити апетити за власт извън отредените му по конституция правомощия. Политическата нестабилност от последните две години и упадъкът на парламентарната република даде в ръцете му огромно влияние и възможност да формира както вътрешната политика, така и външнополитическия курс на България, измествайки я към този на Унгария и по-близо до Русия.
През последните три години Румен Радев се оказва все от рейтинговата страна. През 2020 г. спечели от включването си в протестите срещу ГЕРБ, като едновременно беше виктимизиран (заради изпратените на „Дондуков“ 2 прокурори) и удостоен с почести. През 2021 г. получи бонификация заради служебния кабинет и лансирането на енергичните Кирил Петков и Асен Василев, позиционирали се като антикорупционери, тъй като осветиха някои схеми на ГЕРБ. (Не е публично известно кой е препоръчал тандема на Румен Радев.)
През 2022 г. президентът извади дивиденти… от конституционните си правомощия, предвиждащи служебно управление, ако парламентът е нефелен да произведе редовно. Към това се прибавят и получаването на първия транш по Плана за възстановяване и устойчивост, както и пускането в експлоатация на газовата връзка с Гърция.
Армия и спецслужби – при президента
Главнокомандващ по конституция, президентът вече контролира службите, което означава, че целият сектор сигурност е плод на кадровата политика на един-единствен човек. Шефовете на разузнаването, контраразузнаването, Служба „Военна информация“, Национална служба „Охрана“, Държавна агенция „Технически операции“ (ДАТО) – службата за проследяване и подслушване, бяха сменени от служебната власт на Радев. Някои от тях – директорите на ДАНС и ДАТО, вече са преназначени за следващите няколко години, съвпадащи с края на втория и последен мандат на Радев.
Съветници на президента се сдобиха със славата на първи кадровици – Пламен Узунов в МВР, а назованият в записите Копринков – за икономическите министерства.
В разпространения запис Петков и Василев коментират, че службите трябва да бъдат прочистени от „руски актив“, а имената на някои от бъдещите шефове са съгласувани с посолства (партньорските служби). Това отприщи яростта на президента, както и удари от подкрепящите руския актив.
ВМРО и „Възраждане“ внесоха сигнали в прокуратурата за „престъпления против Републиката“ от Асен Василев и Кирил Петков. Слави Трифонов – лидерът на „Има такъв народ“ – партията, организирала неуспешна подписка за референдум за президентска република, изригна, че двамата трябва да бъдат съдени за държавна измяна. БСП също се включи с карикатури, на които Василев и Петков са в краката на „Чичо Сам“, а българският лъв е изобразен като послушно куче. Всички тези действия до едно са в унисон с опорките на руската пропаганда, която внушава как България се „управлява отвън“, а политиците са „американски/брюкселски лакеи“.
От своя страна президентът налива вода в същата мелница с изявления, че службите не са на президента, реформирани са, награждавани, а сега „тези хора искат да обезглавят това ръководство (на ДАНС, б.а.), базирайки се на някакви посолства. Това са абсолютни глупости“.
На малка България и́ върви на президент и главен прокурор с амбиции на самодръжци. Ако над главния прокурор доскоро беше само Господ, но вече и механизъм за разследване, за президента и Конституцията не му е таван.
„Мутри вън!“ беше хубав лозунг.
Не е ли време за „Радев вън!“?
Comic for 2023.05.30 – Stranger
Post Syndicated from Explosm.net original https://explosm.net/comics/stranger
New Cyanide and Happiness Comic
AWS Week in Review – AWS Wickr, Amazon Redshift, Generative AI, and More – May 29, 2023
Post Syndicated from Donnie Prakoso original https://aws.amazon.com/blogs/aws/aws-week-in-review-aws-wickr-amazon-redshift-generative-ai-and-more-may-29-2023/
This edition of Week in Review marks the end of the month of May. In addition, we just finished all of the in-person AWS Summits in Asia-Pacific and Japan starting from AWS Summit Sydney and AWS Summit Tokyo in April to AWS Summit ASEAN, AWS Summit Seoul, and AWS Summit Mumbai in May.

Thank you to everyone who attended our AWS Summits in APJ, especially the AWS Heroes, AWS Community Builders, and AWS User Group leaders, for your collaboration in supporting activities at AWS Summit events.
Last Week’s Launches
Here are some launches that caught my attention last week:
AWS Wickr is now HIPAA eligible — AWS Wickr is an end-to-end encrypted enterprise messaging and collaboration tool that enables one-to-one and group messaging, voice and video calling, file sharing, screen sharing, and location sharing, without increasing organizational risk. With this announcement, you can now use AWS Wickr for workloads that are within the scope of HIPAA. Visit AWS Wickr to get started.

Amazon Redshift announces support for auto-commit statements in stored procedure — If you’re using stored procedures in Amazon Redshift, you now have enhanced transaction controls that enable you to automatically commit the statements inside the procedure. This new NONATOMIC mode can be used to handle exceptions inside a stored procedure. You can also use the new PL/pgSQL statement RAISE to programmatically raise the exception, which helps prevent disruptions in applications due to an error inside a stored procedure. For more information on using this feature, refer to Managing transactions.
AWS Chatbot supports access to Amazon CloudWatch dashboards and logs insights in chat channels — With this launch, you now can receive Amazon CloudWatch alarm notifications for an incident directly in your chat channel, analyze the diagnostic data from the dashboards, and remediate directly from the chat channel without switching context. Visit the AWS Chatbot page to learn more.
For a full list of AWS announcements, be sure to keep an eye on the What’s New at AWS page.
AWS Open Source Updates
As always, my colleague Ricardo has curated the latest updates for open source news at AWS. Here are some of the highlights:
OpenEMR on AWS Fargate — OpenEMR is a popular Electronic Health and Medical Practice management solution. If you’re looking to deploy OpenEMR on AWS, then this repo will help you to get your OpenEMR up and running on AWS Fargate using Amazon ECS.

Cloud-Radar — If you’re working with AWS Cloudformation and looking for performing unit tests, then you might want to try Cloud-Radar. You can also perform functional testing with Cloud-Radar as this tool also acts a wrapper around Taskcat.
Amazon and Generative AI
Using generative AI to improve extreme multilabel classification — In their research on extreme multilabel classification (XMC), Amazon scientists explored a generative approach, in which a model generates a sequence of labels for input sequences of words. The generative models with clustering consistently outperformed them. This demonstrates the effectiveness of incorporating hierarchical clustering in improving XMC performance.

Upcoming AWS Events
Don’t miss upcoming AWS-led events happening soon:
- AWS Silicon Innovation Day (June 21)
- AWS Summit London (June 7)
- AWS Summit in Washington, DC (June 7 & 8)
- AWS Summit Toronto (June 14)
Also, let’s learn from our fellow builders and give them support by attending AWS Community Days:
- AWS Community Day Warsaw in Poland (June 1),
- AWS Community Day Midwest in Chicago, USA (June 15),
- AWS Community Day Security Edition in Chile (July 1),
- AWS Community Day Philippines (July 29-30).
That’s all for this week. Check back next Monday for another Week in Review!
Happy building
— Donnie
Videos from LSFMM+BPF 2023
Post Syndicated from original https://lwn.net/Articles/933192/
Thanks to an LWN comment from “engla”, we have discovered that the videos from the recently completed 2023 Linux Storage, Filesystem,
Memory-Management and BPF Summit are now available on YouTube. LWN sat in on many of the talks, of course, and we are still chugging along on our coverage of the conference.
Be in control of your own narrative #shorts
Post Syndicated from Talks at Google original https://www.youtube.com/watch?v=qN3ns1zmn9w
[$] Julia 1.9 brings more speed and convenience
Post Syndicated from original https://lwn.net/Articles/933019/
Version 1.9 of Julia, which is an
open-source
programming language popular in scientific computing, was released
in early May. There are a number of interesting new features this time
around, including more work addressing the
startup-time complaints and a number of improvements to the package system.
Beyond
that, there are a few interesting features from the Julia 1.8 release
to catch up on.
Sessions from the 2023 Python Language Summit
Post Syndicated from original https://lwn.net/Articles/933183/
A
series of blog posts from the 2023 Python Language Summit has been
posted; topics covered include the C API, the global interpreter lock,
the standard library, and a talk on burnout from Guido van Rossum:
The first known case of burnout in the field of open-source
software, van Rossum speculated, may have been Charles Babbage, who
gave up the post of Lucasian Professor of Mathematics (the “Chair
of Newton”) at Cambridge University in 1839.
June 2023 Top500 Grasping with Relevance at ISC 2023
Post Syndicated from Patrick Kennedy original https://www.servethehome.com/june-2023-top500-grasping-with-relevance-at-isc-2023-lenovo-intel-amd-nvidia-arm/
The June 2023 Top500 list was released grasping for relevance as companies de-prioritize submissions and one vendor resorts to extremes
The post June 2023 Top500 Grasping with Relevance at ISC 2023 appeared first on ServeTheHome.
След статия на Биволъ, апелативната прокуратура възобнови разследването по Чекмеджегейт
Post Syndicated from Николай Марченко original https://bivol.bg/apelativna-chekmdzhe.html

След като “Биволъ” оповести в събота, че Софийска градска прокуратура (СГП) тихомълком е “изпрала” бившия премиер и лидер на ГЕРБ Бойко Борисов по скандалното дело за кюлчетата и пачките, в…
[$] Improving page-fault scalability
Post Syndicated from original https://lwn.net/Articles/932298/
Certain topics return predictably to development conferences every year,
usually because developers are still struggling to find a viable solution
to a specific problem. One such topic is the lack of scalability in the
kernel’s page-fault-handling code, so it was no surprise to see this
problem on the agenda for the 2023 Linux
Storage, Filesystem, Memory-Management and BPF Summit. Matthew Wilcox
led a session in the memory-management track to discuss the state of
page-fault handling and what can be done to improve it further.
Security updates for Monday
Post Syndicated from original https://lwn.net/Articles/933165/
Security updates have been issued by Debian (docker-registry, gpac, libraw, libreoffice, rainloop, and sysstat), Fedora (bottles, c-ares, edk2, libssh, microcode_ctl, python-vkbasalt-cli, rust-buffered-reader, rust-nettle, rust-nettle-sys, rust-rpm-sequoia, rust-sequoia-keyring-linter, rust-sequoia-octopus-librnp, rust-sequoia-openpgp, rust-sequoia-policy-config, rust-sequoia-sop, rust-sequoia-sq, rust-sequoia-sqv, rust-sequoia-wot, and xen), SUSE (opera), and Ubuntu (Jhead, linuxptp, and sudo).
THG Best of: Memorial Day
Post Syndicated from The History Guy: History Deserves to Be Remembered original https://www.youtube.com/watch?v=e8OdN3Mrq00
NVIDIA Computex 2023 Keynote with NVIDIA DGX GH200 MGX and Spectrum 4
Post Syndicated from Patrick Kennedy original https://www.servethehome.com/nvidia-computex-2023-keynote-nvidia-dgx-gh200-mgx-and-spectrum-x-specturm-4-arm/
We are covering the NVIDIA Computex 2023 keynote and the NVIDIA DGX GH200 Grace-Hopper launch, MGX, Spectrum-X, Spectrum-4, and more
The post NVIDIA Computex 2023 Keynote with NVIDIA DGX GH200 MGX and Spectrum 4 appeared first on ServeTheHome.
Wikipedia Article Titles
Post Syndicated from original https://xkcd.com/2782/
