Agregátor RSS

Podzimní vydání GNOME s kódovým označením „A Coruña“ přináší plynulejší vykreslování a na zařízeních s gyroskopem umí rotaci displeje. Mapy dokážou stahovat dlaždice pro offline použití a Papers umí vizuální podpisy.

Programy, ve kterých je využita 3D grafika, nejsou omezeny na hry ani na desktopové aplikace. Podpora 3D grafiky je integrována i do webových prohlížečů díky technologii WebGL nabízející mj. i programovatelnou pipeline.

Co kdyby yellowstonský supervulkán skutečně vybuchl se vší parádou? Dvojice expertů sestavila časovou osu, od prvních varovných otřesů přes kolaps infrastruktury a globální ochlazení až po svět milion let po katastrofě. Následující scénář je myšlenkovým experimentem založeným na datech o sopkách, katastrofách.

…aneb Další „novinka“, kterou známe už několik desetiletí

Výzkum myších embryí zpochybňuje dosavadní představy o vývoji mozku. Zřejmě máme dvě populace zárodečných buněk, které vyrobí dvě části mozku, a přitom se spolu nemísí, přičemž to platí přinejmenším od primátů k polostrunatcům. Jako bonus se vědcům povedlo z kmenových buněk vypěstovat neurony zadního mozku, což je samo o sobě naprostá pecka!

V databázi testu GeekBench 7 se objevil záznam z dosud nevydaného CPU Apple M6 Pro. Ten podle uvedených čísel výrazně překonává na jaře vydaný Apple M5 Max v 18jádrové konfiguraci. Má to však háček…

Ecommerce platform BigCommerce has alerted multiple merchants to data breaches after attackers compromised credentials for third-party Ribon applications and used them to inject malicious scripts into online stores. [...]

Hister je osobní soukromý vyhledávač, který lze provozovat na vlastním stroji. Umí prohledávat lokální soubory, importovat historii a záložky z webových prohlížečů, procházet vybrané weby a pomocí rozšíření pro Firefox a Chrome indexovat obsah právě navštívených stránek. Nad vytvořeným indexem pak nabízí vyhledávání prostřednictvím webového rozhraní, příkazové řádky a díky podpoře MCP i nástrojům umělé inteligence. Tento svobodný software je napsaný převážně v jazyce Go, zdrojový kód je dostupný pod licencí AGPL-3.0 na GitHubu. Na stránkách projektu je k dispozici interaktivní ukázka.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnerabilities, one of them rated critical. [...]

Meta made much of the security of its AI assistant app Muse at launch earlier this month, calling out the app's reliance on Muse Secure VM. "Each person stays in control of their Muse and decides how much access it gets," the ad biz declared, echoing prior expansive claims about the privacy of its data gathering business. But Meta's musing about Muse appears to be a bit overstated: an attacker capable of executing local code may be able to gain more access than a Muse user might expect. Security researcher Patrick Wardle, co-founder of nonprofit Objective-See, has devised a proof-of-concept called not-a-mused for what he describes as a local zero-day in the Muse macOS app that allows an unprivileged local process to redirect Muse's dictation traffic and potentially abuse access granted to the app. Muse, he explains in the project repo, has an undocumented setting called endo_voyager_dictation_endpoint that an attacker running code locally can modify without special privileges to redirect dictation traffic to an attacker-controlled endpoint, potentially exposing dictated audio and prompts sent to the backend AI model. The flaw could enable prompt injection, the theft of authentication material, and abuse of whatever access the user has granted to Muse. The vulnerability is not an issue for a remote attacker. It requires the ability to run local code. So the main concern, says Wardle, is that the vulnerability gives local malware far broader access than it would have otherwise. Essentially, it's a privilege escalation vulnerability. In a phone interview with The Register, Wardle likened the situation to living in an apartment building. "Just because a bad neighbor moves in doesn't mean that that neighbor automatically has access to all the apartments," he said. Apple, said Wardle, has done a really good job with its Transparency, Consent, and Control (TCC) framework, which manages access to sensitive data on macOS, and with privilege separation. But his concern is that AI apps undo these barriers because they request or require so much access to data and tools. Of AI apps, he said, "they're super convenient and super empowering. But they have so much access if you configure them to be useful. They basically could do anything on your computer." As such, he said, they become potentially a single point of failure that breaks operating system security controls. "You know these AI companies have really great AI models for finding bugs," said Wardle. "Are they not running them against [their own apps]? Is the priority not the security of their own apps?" Wardle said that endpoint detection and response (EDR) software has gotten better on macOS largely because everything is code signed, so it's easy to identify processes that are not notarized and should not be allowed to run. But with AI agents given broad permissions and access, the EDR product can't tell whether commands are coming from the user, an agent, or an attacker. These agents need access, said Wardle, in order to be useful to people. What's missing from the makers of AI apps, he said, is a sense of responsibility for the level of access their apps seek. Wardle added that Apple provides on-device local dictation and if Meta chose to use that API, this vulnerability would not exist. Instead, he suggested, Meta chose not to use Apple's service, presumably because it wants access to that data. "I think some of their greediness for user data kind of opens the door, makes a bigger attack surface," he said. "But at the end of the day, these AI companies, they're racing for what's next. User privacy and security, those aren't priorities." Meta did not immediately respond to a request for comment.® Updated at 12.56 UTC on September 22, to add: After this story was filed, David Singleton of Meta Superintelligence Labs, said the Muse app has been revised to address the vulnerability. “This was a local privilege escalation attack, not a remote exploit. Using it to do harm therefore requires malicious code already running on the user’s machine under their user account and the practical risk to users of the Muse Mac app was therefore quite low,” said Singleton in a lengthy social media post. “Nonetheless, we have issued a hotfix to the app to address the issue.”

The US appears to be inching ever so slowly toward holding AI executives legally liable for their models’ criminal activities. Treasury Secretary Scott Bessent told CNBC on Monday: “It is the humans who are responsible, not the AI,” for the bots’ bad behavior. “The Hugging Face incident is the responsibility of the OpenAI management, not a bunch of agents." He also referenced current and former OpenAI and Anthropic employees’ dire warnings about AI eradicating humanity by the end of the decade. Meanwhile, the model makers' proposed framework to slow AI development omits strict legal liability for damages caused by rogue systems. “A sitting employee came out, said there's a 10 percent chance of an extinction-level event,” Bessent said. “But then the labs also said, take the liability off of our hands, and we will not do that.” Bessent’s remarks come as four of America’s leading AI developers have now admitted that their agents escaped testing environments and hacked outside organizations and individuals: OpenAI, Anthropic, Meta, and, as of Friday, Google. When asked how the government will hold humans accountable for the AI agents’ criminal activities, Bessent said: “If these were humans doing it, we would expect to see ramifications and legal actions to follow." "That's exactly what I think we need to do,” he said. “When President Trump talked about appointing an AI czar, I think it is to put context, shape, and contours around these questions, and they're very important." Trump, over the weekend, announced he is “forming the AI Force, much like I did Space Force” – a reference to the new branch of the US military the president created in his first term. "To that end, I will be announcing, in the near future, the AI 'Czar,'" Trump added. Just days earlier, however, Trump shrugged off warnings about AI destroying humanity as a “hoax” and said on Truth Social: “We already have tremendous CRIMINAL and REGULATORY power over these companies!” The Trump administration has yet to exercise any of these criminal or regulatory powers, except to illegally retaliate against Anthropic. The president branded the company "radical left, woke" during an earlier dispute with the Pentagon over Anthropic's refusal to relax model safeguards for use in domestic surveillance and fully autonomous weapons. ®

Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component. [...]

Microsoft will retire the Calendar, People, and Files Microsoft 365 companion apps on December 16 and has asked admins to remove them from managed devices. [...]

Výrobci smartphonů pilně připravují aktualizace na další verzi Androidu • Někteří to zvládnou velmi rychle, jiní nechají své uživatele čekat velmi dlouho • V tomto článku sledujeme, jak na tom jsou jednotlivé značky.

A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17. Microsoft's own hardware-compatibility program signs the driver, scored zero detections on VirusTotal when researchers

A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17. Microsoft's own hardware-compatibility program signs the driver, scored zero detections on VirusTotal when researchers Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more than 100 countries and siphoned funds or account credentials from over 7,000 cryptocurrency wallets, according to a new joint cybersecurity advisory. The primary targets of the campaign are individual web designers, engineers, and specialists in cryptocurrency,

The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more than 100 countries and siphoned funds or account credentials from over 7,000 cryptocurrency wallets, according to a new joint cybersecurity advisory. The primary targets of the campaign are individual web designers, engineers, and specialists in cryptocurrency, Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Google has been fined €403 million for breaking the EU's data protection law, the GDPR, in the way three of its features handled people's location data from May 2018 to February 2020. Ireland's Data Protection Commission (DPC), Google's lead regulator in the EU, also ordered the company to make its processing comply with the law within 6 months. The DPC has not said publicly which

Google has been fined €403 million for breaking the EU's data protection law, the GDPR, in the way three of its features handled people's location data from May 2018 to February 2020. Ireland's Data Protection Commission (DPC), Google's lead regulator in the EU, also ordered the company to make its processing comply with the law within 6 months. The DPC has not said publicly which Swati Khandelwalhttp://www.blogger.com/profile/[email protected]