SoylentNews

AnonTechie writes:

'Bots have now passed human traffic online,' Cloudflare boss laments — says agentic traffic wasn't expected to eclipse real people until next year. Bot (automated) vs. human HTTP requests are split 57.5 vs. 42.5 percent, according to the firm's latest data.

The rapid increase in agentic internet traffic means "bots have now passed human traffic online for the first time in the Internet's history," according to the CEO and co-founder of Cloudflare, Matthew Prince. "Welp, that happened faster than I predicted," Prince awkwardly admitted, making his previous expectations of the crossover happening sometime in 2027 seem way off the mark.

Before going on, it's important to differentiate this new surge in internet traffic from the traditional bots most will be aware of, things like website crawlers, search indexers, and bad stuff like fraud or abuse bots. It is different now, as Cloudflare is charting agents that browse the web much like humans on behalf of humans, and it is already at a massive scale.

[...] We were also interested in looking at Cloudflare's breakdown of human/bot traffic by country. The most bot-ridden traffic comes from the tiny island of Gibraltar (92.1%), followed by Singapore (76.4%), then Iran (76.4%). While some of these places have a lot of data centers and hosting infrastructure compared to population size, Iran's high bot count may rather come from the heavy use of VPNs with automated scraping and bypass tools. Cloudflare has also previously flagged Iran as a hotspot for malicious bot activity.

[Source]: Tom's Hardware

Original Submission

Arthur T Knackerbracket writes:

Lawmakers push DoD to tighten smartphone controls after adversaries exploited commercial tracking data:

Getting the location of troops at war might be as easy as buying the data from a legitimate business. America's foreign adversaries have exploited commercial geolocation data tied to US troops, the Pentagon admits, using it to target or surveil US personnel in the Middle East. Despite that, the Defense Department hasn't exactly moved fast to secure the information, elected officials say.

Senator Ron Wyden (D-OR), Representative Pat Harrigan (R-NC), and a dozen other Congress critters sent a letter to DoD CIO Kirsten Davies on Thursday, demanding a change in smartphone security posture among US military branches. Included in the letter is what lawmakers describe as the first public confirmation that commercial location data has been used to target or surveil American troops in active war zones. The information was shared with Wyden's office in April.

The reason for the delay in publishing the information, Wyden's team told The Register, was due to "markings that restricted public release," which Wyden reportedly pushed back on, leading to Thursday's letter and the attached responses [PDF] from the DoD confirming info purchased from commercial data brokers was used to target troops.

"USCENTCOM [US Central Command] has received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil US personnel in theater," the DoD's responses from April indicate. 

As for how exactly data brokers got access to the data that allowed adversaries to locate troops and their movements, they got it from the same sources as anyone else buying data from a commercial broker: Smartphone advertising profiles. 

According to the DoD responses included in Wyden's letter, not only are US military personnel allowed to use personal devices within operational areas, there's no actual policy that requires servicemembers to turn off geolocation capabilities on their devices when located in active war zones. 

"USCENTCOM's geolocation risk guidance directs personnel to disable geolocation functionality when not needed; periodically review device and application privacy settings; and limit public sharing of information," the DoD said last month, while simultaneously admitting that such guidance doesn't always fully disable geolocation on smartphones. 

In addition to personally-owned devices, the DoD's own issued smartphones don't disable advertising profiles, either. 

[...] It's not like there haven't been plenty of examples of sloppy location data management compromising military operations, either. Data culled from workout tracking app Strava has been used to identify the workout routes of US military personnel jogging on base - and reveal the location of French President Emmanuel Macron thanks to his bodyguards' sloppy security practices - and social media has also been flagged as an OPSEC disaster waiting to happen. 

Despite all those examples and briefings going back a decade, the problem has continued right up to the latest operations in Iran. 

"That foreign adversaries are still able to buy location data collected from the phones of U.S. personnel serving in military hotspots is a direct result of DoD leadership's failure to prioritize this threat and implement commonsense cyber defenses," the letter charges. Whether anything will be done about it remains to be seen.

Original Submission

An Anonymous Coward writes:

https://techcrunch.com/2026/05/26/duckduckgo-installs-are-up-30-as-users-reject-being-force-fed-googles-ai-search/:

Last week, after Google announced its huge overhaul to Search, I overheard a woman on the phone saying she was switching to DuckDuckGo because you can "opt out of using AI."

"Google just isn't Google anymore," she said. It seems that others had the same idea.

At I/O, Google's annual developer conference, the company said it would transform its search box into a conversational engine that expands for longer queries, anticipates user intent, and autocompletes searches. Rather than just returning a list of links, it will use AI Overviews to answer questions directly first. Google also unveiled a more seamless AI Mode, allowing users to ask follow-up questions within AI Overviews.

While a Google spokesperson noted that AI Overviews have existed for two years and AI Mode is not the default, the backlash has been sharp.

Some have argued it will kill the open web, while others shared concerns that AI overviews surface inaccurate responses and take away control from users who might not want to use AI. It also overcomplicates simple things. Just try to Google the word "disregard."

In response to Google's changes, many have begun defecting to DuckDuckGo, a privacy-focused alternative that has never been able to break past Google's dominance, accounting for only around 2% of the U.S. search market.

During Google's search antitrust trial in 2023, DuckDuckGo CEO Gabriel Weinberg testified that Google's exclusive default search contracts harmed its ability to pitch itself as the default on other browsers.

"Google is force-feeding AI with no way to opt out," Weinberg said Tuesday in a statement, referring to Google's Search overhaul. "As a result, their results are getting worse, not better. We want to be the place that puts users in charge and allows them to decide how much or how little AI they want."

Now, it seems that DuckDuckGo is beginning to benefit as consumers flee AI.

[...] DuckDuckGo offers its own AI product called Duck.ai. It's free and doesn't require users to make an account, but provides access to models, including Anthropic's Claude 4.5 Haiku, Meta's Llama 4 Scout, Mistral's Small 3 24B, and OpenAI's GPT-5 mini. All chats are private because DuckDuckGo strips the user's IP address before requests reach model providers, deletes conversations within 30 days, and prevents chats from being used for training.

Related: Google Search is Becoming Something Fundamentally Different

Original Submission

Arthur T Knackerbracket writes:

https://www.theregister.com/security/2026/06/01/5k-election-domains-registered-ahead-of-us-midterms/5249764

The biggest threat to America's midterm elections in November likely isn't foreign attackers hacking US voting machines. Phishing and election-official impersonation are the bigger risks, according to Check Point, which documented more than 5,000 election-themed domains registered between April and May.

These domains can be used by attackers for phishing, impersonation, fraud, misinformation, or influence activity, especially when coupled with about 17,000 exposed credentials associated with fundraising orgs, political parties, and government-related services also spotted by the security shop's intelligence arm in May.

"Election-related domains and leaked credentials represent two sides of the same problem: infrastructure and access," Danielle Hess, a cyber threat intelligence analyst at Check Point Software, told The Register.

"A rise in election-themed domains not only creates more potential infrastructure that could be abused for phishing or impersonation, but also reflects a growing election-related ecosystem with more organizations, accounts, and users that can be targeted," Hess said. "When combined with a large pool of exposed credentials, attackers have more opportunities to conduct convincing and scalable election-related operations."

Plus, AI gives phishing, impersonation, election misinformation and other scam operations a massive boost, making them faster, cheaper, and easier to scale.

The uptick in election-related threats follows the Trump administration's efforts to gut America's lead cyber-defense agency and decimate its efforts to combat election-related fraud, while slashing its budget and workforce, and shutting down the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC).

According to a Monday report, Check Point has been monitoring registered domains and documented about 1,300 containing the keyword "election" and 2,957 containing "vote" in January. Three months later, between April 13 and May 14, about 1,140 newly registered domains contained the word "election," while the number containing "vote" had climbed to about 4,010.

Arthur T Knackerbracket writes:

https://arstechnica.com/health/2026/06/moderna-gets-50-million-to-develop-mrna-ebola-vaccine-against-bundibugyo/

The global health organization Coalition for Epidemic Preparedness Innovations (CEPI) announced Monday that it will "urgently accelerate development" of three vaccine candidates against Bundibugyo ebolavirus (BDBV), pledging a little over $60 million in the effort to extinguish an outbreak currently raging out of control in the Democratic Republic of the Congo.

Under the plans, CEPI has committed up to $50 million to US-based Moderna for preclinical development and Phase 1 clinical testing of its mRNA-based BDBV vaccine candidate. The funding will simultaneously allow the company to ramp up manufacturing capabilities and ready large-scale Phase 2/3 trials in the event the vaccine makes it through early testing. The vaccine will use Moderna's mRNA vaccine platform that allowed for rapid development of a COVID-19 vaccine during the pandemic.

"[W]e believe our mRNA platform can play an important role in responding rapidly to emerging infectious disease threats," Moderna CEO Stéphane Bancel said in a statement Monday. " We will move with urgency and scientific rigor to support the response and help bring a potential vaccine closer to the communities that need it most."

CEPI will also provide $3.2 million to the International AIDS Vaccine Initiative, which is developing a vaccine that uses the same technology as Merck's approved Ebola vaccine, Ervebo, which targets the more common Zaire ebolavirus strain.

Last, the CEPI is committing $8.6 million to the University of Oxford and Serum Institute of India, which is using its adenovirus-based vaccine platform, as it did for its COVID-19 vaccine during the pandemic.

There are two licensed vaccines against Ebola disease currently, including Ervebo and Zabdeno/Mvabea by Johnson & Johnson. Both vaccines target the Zaire strain, which has caused most of the large outbreaks to date, followed by the Sudan strain. The current outbreak is only the third driven by the Bundibugyo strain. As such, there are currently no licensed therapeutics or vaccines against it.

The lack of medical interventions is one of the challenges facing health officials responding to the outbreak. Detection of the outbreak was delayed, allowing the virus to spread out of control. Disease is also spreading in an area of DRC with armed conflict, large population mobility, and significant need for humanitarian assistance.

As of Friday, the World Health Organization reported 1,041 cases (135 confirmed, 906 suspected) and 241 deaths (18 confirmed, 223 suspected) in the outbreak.

Original Submission

Arthur T Knackerbracket writes:

https://www.theregister.com/ai-and-ml/2026/06/02/github-copilot-users-threaten-exit-as-metered-billing-kicks-in/5249826

Developers seem to hate Microsoft's new usage-based billing policy for GitHub Copilot as they report burning through a month's worth of credits in hours. 

"This is a staggering shift from a 'predictable subscription' to a 'stressful meter-based' service that hinders my productivity rather than helping it," wrote one developer on GitHub's user forum who said they were paying for Microsoft's $39-per-month Copilot Pro+ plan but burned through about 8 percent of their monthly AI Credits allocation in two hours under the new billing system. "At this rate, my 7,000-unit quota will be depleted in less than two days." 

Their outrage is a consistent and growing theme among the business users of AI who suddenly see eye-popping bills after years of experimenting with a nearly free service. One GitHub Copilot developer requested a single change to their project and burned more than $6, they wrote. 

"Not after a day of usage. Not after dozens of prompts. After ONE request," the developer stated on GitHub's user forum. "I understand that large projects require context, but this level of consumption feels completely unreasonable and impossible to predict. How are individual developers supposed to budget for this when a single feature request can consume such a large portion of the monthly allowance?" 

The changes went into effect across the site on Monday. In GitHub's April post announcing the new billing scheme, Microsoft said the change was made from monthly billing to usage-based because GitHub Copilot is "not the same product it was a year ago." 

"It now powers far more complex, agentic workflows that consume far more compute. This change is designed to deliver a more sustainable and reliable product experience by aligning pricing to actual usage and costs," the post to its user community reads. "We believe GitHub Copilot remains the best value and experience for agentic coding. Usage-based billing aligns cost more closely to actual usage and value, while continuing to offer developers the freedom to choose the models and agents that work best for them." 

GitHub Copilot lets developers access a range of AI models from within their development tools. That had allowed some users to make large numbers of requests across multiple models while paying as little as $10 per month for Copilot Pro, or $39 per month for Copilot Pro+.

An Anonymous Coward writes:

Welcome to this year's 22nd issue of DistroWatch Weekly! This week we are thrilled to present you with a special milestone edition of DistroWatch Weekly. As I write this, DistroWatch is celebrating its 25th anniversary! Not many websites get to survive for a quarter of a century and we're thrilled our readers continue to come along for the experience. Later in this Weekly we share some thoughts on our publication turning 25 years old and provide some statistics about our little corner of the Internet.

DistroWatch is a website that provides news, distribution pages hit rankings, and other general information about various Linux distributions as well as other free software/open source Unix-like operating systems. It now contains information on several hundred distributions and a few hundred distributions labeled as active.

How many of our community use Distrowatch? Do you view it regularly, daily, occassionally, or ask "Is Distrowatch still going...?".

Original Submission

Arthur T Knackerbracket writes:

https://arstechnica.com/ai/2026/06/openais-math-breakthrough-played-to-ais-strengths/

In mid-May, OpenAI announced that an internal AI model had disproved the Erdős unit distance conjecture, a famous problem in discrete geometry that had stumped human mathematicians for the last 80 years.

OpenAI gave several mathematicians early access to the result and published their reactions. Tim Gowers—who won the Fields Medal, the most prestigious prize in mathematics—wrote that "there is no doubt that the solution to the unit-distance problem is a milestone in AI mathematics."

University of Toronto professor Daniel Litt wrote that "this is the first example of a result produced autonomously by an AI that I find exciting in itself, as opposed to as a leading indicator."

It's arguably the first time that an AI system has found a proof resolving a major open conjecture. That's impressive, but I don't view it as a radical break from the previous trajectory of AI progress in mathematics.

Three years ago, LLMs struggled to solve arithmetic problems. It was only last year that LLMs started acing high school mathematics competitions.

When I attended the Joint Mathematics Meetings—the largest annual mathematics conference in the world—in January, I learned that AI systems were starting to contribute to mathematical research, but only in constrained settings. It took significant human interpretation to turn an AI output into a publishable theorem.

OpenAI's new result is the next step in this progression. The AI model cleverly applied existing ideas drawn from several subfields of mathematics to create a full proof. But it didn't pioneer any genuinely new techniques. The result has since been cleaned up and extended by human mathematicians.

This points to a medium-term future where human mathematicians and AI models complement each other: AIs have a broader knowledge of past work than any human alive and much more willingness to grind through tedious proof strategies that aren't likely to work. But humans can still think more deeply about any one problem and ask more interesting questions.

That might not last. AI systems have been improving at math so rapidly that it's unclear what role, if any, human mathematicians will play a decade from now.

Arthur T Knackerbracket writes:

https://www.slashgear.com/2184557/uss-supercarrier-gerald-r-ford-nuclear-power-plant/

The USS Gerald R. Ford, first deployed in late 2022, is a truly remarkable ship. It already earned the distinction of being the world's largest aircraft carrier and, as of May 2026, is on track to earn another impressive distinction. The over 1,100-foot-long supercarrier is being fitted to serve as a floating nuclear power plant for an on-land naval installation. The test is slated to take place at Naval Station Norfolk, located in Norfolk, Virginia, sometime in summer 2026.

The carrier and its twin A1B nuclear reactors — which were developed specifically for the Gerald R. Ford — will power the entire base. While the United States military has kept many specifics of the A1B under wraps, estimates suggest that a single A1B produces about 700 MWt; two of them, then, would generate 1,400 MWt. This is approximately 25% more power than the A4W reactors that powered Nimitz-class vessels. Of course, it's not just a matter of plugging it into the grid, and the U.S. Navy will conduct extensive research and testing to safely and effectively move power from the ship to land.

While this is a fascinating feat on paper, what exactly is the point of running a naval base off of a supercarrier's nuclear reactors? According to those involved with the effort, this project is all about preparedness.

Naturally, there is a point behind a test of this magnitude. The idea behind running a naval base off the USS Gerald R. Ford's nuclear reactors is to enhance the U.S. military's disaster response capabilities. Should a natural disaster or an enemy attack take out a region's power grid, these carriers could act as floating generators until the affected areas get back on their feet. As more Ford-class carriers — like the USS John F. Kennedy, set for arrival in 2027 – come online, the Navy could have a fleet of floating power stations ready to respond to multiple worst-case scenarios across the country.

The Navy is confident that this capability can help in military and civilian capacities alike. During a May 2026 House Armed Services Committee hearing, Acting Secretary of the Navy Hung Cao suggested that these vessels could also help provide electricity to repair military bases and supply fresh water to drought-stricken areas (via Nuclear Newswire). Of course, whether the USS Gerald R. Ford can actually do any of this depends on the results of this test.

The USS Gerald R. Ford might not be the most decorated U.S. Navy aircraft carrier in history, but there's no denying its place in the history books. In addition to being notably enormous, it could very well be the saving grace for disaster-stricken areas in need of electricity.

Original Submission

Arthur T Knackerbracket writes:

https://www.cnet.com/tech/services-and-software/perplexity-ai-cnn-copyright-suit/

The AI search company Perplexity is being sued by CNN and other media companies for copyright infringement.

AI products regularly scrape news publications and websites to answer user questions with real-time data, accelerating the collapse in traffic and revenue to original sources.

In response to the lawsuit, Jesse Dwyer, Perplexity's chief communications officer, told Stetler and other media outlets in a statement: "You can't copyright facts." The US government's Copyright Office states: "Copyright does not protect facts, ideas, systems, or methods of operation, although it may protect the way these things are expressed."

CNN said in its own statement that a company valued at tens of billions of dollars shouldn't "steal from entities that create the original content Perplexity exploits" and that "commercial operators can and must pay to make use of it." 

A Perplexity representative didn't immediately respond to a request for comment.

Perplexity is one of several companies, including OpenAI and Anthropic, that have been battling news publishers and media giants over copyright claims. 

(Disclosure: Ziff Davis, CNET's parent company, in 2025 filed a lawsuit against OpenAI, alleging it infringed Ziff Davis copyrights in training and operating its AI systems.)  

More than 100 such lawsuits have been filed. But different conclusions have been reached as to whether training AI models on copyrighted data counts as fair use, said Michael Goodyear, an associate professor at New York Law School. Considerations include how the training occurs, what AI outputs contain and whether there's any competitive harm to copyright holders. 

"No appellate courts have yet weighed in on the viability of these copyright infringement claims against AI companies," Goodyear said. 

In the CNN case, he said that Perplexity is correct that facts aren't protected by copyright, but the way CNN presents facts could be.

"Even short news articles would typically qualify for copyright protection under the low bar of required originality," Goodyear said. "The question becomes whether the thousands of cases of infringement CNN describes are copying whole paragraphs verbatim, or whether they are paraphrasing or merely copying unprotectable facts."

As plunging website traffic has drained billions in publisher revenue and triggered widespread media layoffs, AI firms are aggravating the crisis. According to a new report from the think tank Open Markets Institute, over the past six months, the rate of AI crawlers bypassing paywalls and blocks has nearly quadrupled, spiking from 3.3% to 12.9%. 

That's partly why a number of publishers signed AI content licensing deals with tech companies to monetize content used to train AI systems. One way out for Perplexity may be to renegotiate a licensing deal with CNN. Even if Perplexity has valid legal arguments, a licensing agreement could shift from unauthorized scraping toward a formalized content partnership. 

However, the Open Markets Institute report says that when it comes to AI content licensing, news and content creators are trapped in a double bind. The same tech giants whose AI tools are starving websites of human traffic are now the ones gatekeeping the licensing deals meant to replace that lost ad revenue. 

Original Submission

Arthur T Knackerbracket writes:

https://arstechnica.com/tech-policy/2026/05/musk-says-us-military-suicide-drones-used-starlink-in-violation-of-spacex-rules/

SpaceX and the Pentagon have been bickering about the price of using Starshield satellite service during the Iran war, according to a Reuters report published today. It appears that SpaceX asked the military for more money after it started using satellite terminals on "kamikaze" attack drones in Iran.

SpaceX CEO Elon Musk claimed the Reuters report is wrong. But Musk also said the military drones initially used the commercial Starlink service instead of the government-specific network, in violation of Starlink's terms of service. Musk blamed the violation on the contractor that built the drones for the government.

The Reuters report, based on Pentagon documents and interviews with sources familiar with the pricing talks, said that SpaceX recently asked the military to pay $25,000 for Starshield access on each kamikaze drone. The Pentagon, which previously paid $5,000 for each connection, objected to the price hike but ultimately agreed to pay it, according to Reuters.

While the $25,000 charge is a monthly fee for the satellite connection provided to a satellite terminal, the terminals are being used with drones that only make one-way trips before hitting targets and detonating on impact.

Starshield is a network for government entities and is based on Starlink technology. Musk wrote in an X post today that the "Reuters article is false." But in the very same post, he seemed to confirm a dispute over how the military used SpaceX satellite technology.

"They made improper use of the Starlink civilian system for military purposes. Direct violation of terms of service," Musk wrote today, seeming to indicate that the military used the commercial Starlink system when it should have been using Starshield.

Musk said later that the drones were configured incorrectly by a military contractor. "There is a US government arm of SpaceX called Starshield, which has a different set of satellites than Starlink, which is for civilian use. The company that makes the suicide drones incorrectly used the civilian system, instead of the Starshield," Musk wrote.

The Pentagon "denied any violation of its agreement with SpaceX," according to Reuters. Starshield terminals sold by SpaceX to the military can connect both to the commercial Starlink satellite constellation and Starshield, the Reuters article said.

The drones in question are part of the Low-cost Uncrewed Combat Attack System (LUCAS), which was made by defense contractor Spektreworks. We contacted Spektreworks today and will update this article if it responds.

Musk previously addressed the military use of SpaceX satellite terminals on drones on March 1, one day after the Iran war began, in response to an X post in which a user posted a picture of one of the drones that appeared to have an integrated satellite terminal.

"It is a violation of commercial Starlink terms of service to use the terminal for weapon systems. This applies to all users and is shut down when discovered," Musk wrote at the time. "There is a separate network called Starshield, which is operated by the US government. This is not under SpaceX control."

Within weeks of the US launching strikes in Iran, "SpaceX executives met Pentagon officials and argued the military was underpaying for the service," the Reuters article said.

"SpaceX argued the LUCAS drones were operating under conditions that aligned more closely with its aviation tier subscription rather than a lower priced land or mobility service. Pentagon officials argued that the $25,000 price tag—a monthly fee—was designed for aircraft, not kamikaze drones that used [a] Starlink connection for a matter of minutes or hours, according to one of the sources," Reuters reported.

JoeMerchant writes:

https://viterbischool.usc.edu/news/2026/05/a-robot-hand-that-taught-itself-to-play-piano-could-change-the-future-of-machines/

USC researchers built the "Musician Hand," a four-fingered tendon-driven robot that learns to play piano by ear after just two minutes of random "motor babbling" on the keys. Hearing a ~30-note melody once, it converts the audio to a spectrogram, maps sounds to the motor commands needed to reproduce them, and plays the tune back in one attempt — well enough that blind judges sometimes couldn't tell it from trained human pianists.

The work, led by Hesam Azadjou under Francisco Valero-Cuevas at USC Viterbi (published in Royal Society Interface), challenges the traditional robotics assumption that good performance requires massive data, heavy computation, and tightly controlled environments. Instead, it mimics how animals learn: perceive, guess, adapt — using minimal energy and experience.

The researchers see the same "perceptual robotics" approach enabling cheaper, faster-deployed machines that work in unpredictable real-world settings — e.g., exoskeletons that learn an individual's gait early in Parkinson's and later help restore it, or home physical-therapy robots that adapt to each patient in real time.

Original Submission

Arthur T Knackerbracket writes:

The technique correctly identified visited websites with roughly 89% accuracy and running applications with roughly 96% accuracy on a test Mac:

Security researchers at Graz University of Technology in Austria have published a paper describing a side-channel attack that lets a malicious website identify what other sites and apps a visitor has open by measuring SSD access latency through JavaScript inside a standard browser sandbox. The technique, called FROST (Fingerprinting Remotely using OPFS-based SSD Timing), correctly identified visited websites with roughly 89% accuracy and running applications with roughly 96% accuracy on a test Mac, requires nothing from the victim beyond visiting the attacker's page, and works across different browsers.

FROST exploits the Origin Private File System (OPFS), a browser API that lets websites create and store files on a user's local disk without prompting for permission. Previous SSD side-channel attacks that we’ve seen require native code running through privileged kernel interfaces, but FROST eliminates that requirement.

The team disclosed their findings to Google, Apple, and Mozilla: Google said it doesn't consider fingerprinting a security vulnerability, Apple called the attack "currently out of scope," and Mozilla acknowledged the findings without implementing fixes.

The attack creates a large OPFS file on the victim's SSD, with both Chrome and Safari allowing a website to claim up to 60% of total disk space through OPFS, which on a 256GB drive is over 150GB. The file must exceed the system's available RAM so that every random 4 KB read hits the SSD rather than the OS’s page cache. When other activity generates its own disk I/O, it creates measurable latency spikes in the attacker's reads, and those timing patterns are fed into a convolutional neural network trained to recognize specific websites and applications by their I/O signatures.

Arthur T Knackerbracket writes:

Now that doesn't mean Linux stable kernel maintainer Greg Kroah-Hartman thinks Rust is magic:

At the Rust Week conference, the world's biggest Rust language conference, in Utrecht, Netherlands, Linux stable kernel maintainer Greg Kroah-Hartman opened by saying: "I'm here to talk about untrusted data and Linux, and how Rust is going to save us." After "a long month or two on the kernel security list," he pushed that point even further: "I'm going to make even a bolder statement and say, 'You are going to save Linux.' Sorry, it's all on you."

What he was talking about was the sudden flood of serious Linux security holes being discovered, such as Dirty Frag, Copy Fail, and Fragnesia, that have come to light thanks to the latest AI bug-detection programs.

As a result, Kroah-Hartman, who has "seen every single kernel security bug ever" since 2005, said the kernel team is now issuing "13 CVEs [Common Vulnerabilities and Exposures] a day, or something, something crazy." He thinks Rust is one of the few realistic ways to slash the class of bugs that come from C's traditional error-handling and resource-management pitfalls.

Kroah-Hartman illustrated those pitfalls with real C bugs in the kernel, including a 15-year-old Bluetooth bug that dereferenced a pointer without checking it and a Xen bug where "we forgot to unlock" in an error path. "The majority of the bugs in the kernel are this tiny, minor stuff," he explained. "Error conditions aren't checked, locks aren't forgotten, unreleased memories leak, and vulnerabilities add up over time. They crash the kernel. This is what we live with in C. This is why we don't like it."

Kroah-Hartman argued that the "best beauty of Rust" is catching those mistakes at build time rather than in review. For example, when it comes to locking, he highlighted Rust's locking abstractions in the kernel: "The only way you can get access to inner pointers of structures is by grabbing that lock, and releasing the lock automatically. The compiler does it, it's guarded, the lock happens, everything's happy. You just can't write code to access these values...without grabbing the lock. The compiler will not let you."

Arthur T Knackerbracket writes:

The feds are raising the alarm about a new category of threat:

In the wake of attacks on CEOs, a nationwide protest movement targeting data centers, and increasing concerns about AI job replacement, federal intelligence agencies and domestic law enforcement are circulating reports with a new domestic target in mind: anti-technology extremists.

More than 1,000 pages of unpublished reports from the Department of Homeland Security, FBI, and fusion centers obtained by WIRED show a national shift taking place to surveil this new and worryingly broad category of people and activities deemed an emerging threat.

This new effort follows President Donald Trump's National Security Presidential Memo 7, which instructs the Department of Justice to target anyone holding "anti-American," "anti-Christian," and "anti-capitalism" beliefs. Earlier this month, Trump's counterterrorism czar, Sebastian Gorka, released a public counterterrorism strategy claiming that left-wing extremists are one of the three top counterterrorism priorities facing the United States.

Taken together, these Trump administration directives have commandeered the domestic surveillance apparatus to surveil and criminalize speech and assembly that challenges the ideology of the White House. A new focus on anti-technology extremism adds an unreported category to already public designations under a presidency that has heavily invested political and material capital in AI and data center proliferation.

Among the documents in the tranche obtained by WIRED is a New York Intelligence and Counterterrorism Bureau report that warns of widespread upheaval in response to AI adoption. Of particular note is a novel term for what the bureau purports to be an emerging extremism threat.