An anonymous reader shares a report: Chat & Ask AI, one of the most popular AI apps on the Google Play and Apple App stores that claims more than 50 million users, left hundreds of millions of those users' private messages with the app's chatbot exposed, according to an independent security researcher and emails viewed by 404 Media. The exposed chats showed users asked the app "How do I painlessly kill myself," to write suicide notes, "how to make meth," and how to hack various apps.
The exposed data was discovered by an independent security researcher who goes by Harry. The issue is a misconfiguration in the app's usage of the mobile app development platform Google Firebase, which by default makes it easy for anyone to make themselves an "authenticated" user who can access the app's backend storage where in many instances user data is stored.
Harry said that he had access to 300 million messages from more than 25 million users in the exposed database, and that he extracted and analyzed a sample of 60,000 users and a million messages. The database contained user files with a complete history of their chats with the AI, timestamps of those chats, the name they gave the app's chatbot, how they configured the model, and which specific model they used. Chat & Ask AI is a "wrapper" that plugs into various large language models from bigger companies users can choose from, Including OpenAI's ChatGPT, Anthropic's Claude, and Google's Gemini.
Read more of this story at Slashdot.
Security updates have been issued by AlmaLinux (java-25-openjdk, openssl, and python3.9), Debian (gimp, libmatio, pyasn1, and python-django), Fedora (perl-HarfBuzz-Shaper, python-tinycss2, and weasyprint), Mageia (glib2.0), Oracle (curl, fence-agents, gcc-toolset-15-binutils, glibc, grafana, java-1.8.0-openjdk, kernel, mariadb, osbuild-composer, perl, php:8.2, python-urllib3, python3.11, python3.11-urllib3, python3.12, and python3.12-urllib3), SUSE (alloy, avahi, bind, buildah, busybox, container-suseconnect, coredns, gdk-pixbuf, gimp, go1.24, go1.24-openssl, go1.25, helm, kernel, kubernetes, libheif, libpcap, libpng16, openjpeg2, openssl-1_0_0, openssl-1_1, openssl-3, php8, python-jaraco.context, python-marshmallow, python-pyasn1, python-urllib3, python-virtualenv, python311, python313, rabbitmq-server, xen, zli, and zot-registry), and Ubuntu (containerd, containerd-app and wlc).
An anonymous reader quotes a report from Forbes: Gatik, a Silicon Valley startup developing self-driving delivery trucks, says its commercial operations are about to scale up dramatically, from fewer than a dozen driverless units running in multiple U.S. states now to hundreds of box trucks by the end of the year. CEO Gautam Narang said it's also booked contracts with retailers worth at least $600 million for its automated fleet. "We have 10 fully driverless, revenue-generating trucks on public roads. Very soon, in the coming weeks, we expect that increase to 60 trucks," he told Forbes. "We expect to end the year with hundreds of driverless trucks -- revenue-generating -- deployed across multiple markets in the U.S."
Though the Mountain View, California-based company hasn't raised as much funding as rivals, including Aurora, Kodiak and Canada's Waabi, Gatik said it's actually scaling up faster than any other robot truck developer. Unlike those companies, it focuses on smaller freight delivery vehicles, rather than full-size semis, supplied by truckmaker Isuzu that operate mainly between warehouses and supermarkets and other large stores. The company's focus has been on so-called middle-mile trucking, which, like long-haul routes, has a severe shortage of human drivers, according to Narang. Currently, its trucks are on the road in Texas, Arkansas, Arizona, Nebraska and Ontario, Canada.
The company has been generating revenue since shortly after its founding in 2017, hauling loads for customers like Walmart in trucks with human safety drivers at the wheel. Beginning late last year, it began shifting to fully driverless units and is getting more trucks from Isuzu built specifically to incorporate its tech, Narang said. "The hardware that we are using, this is our latest generation, has been designed to enable driver-out across thousands of trucks."
Read more of this story at Slashdot.
Apple TV+ has landed the screen rights to Cosmere, the sprawling literary universe created by Brandon Sanderson. "The first titles being eyed for adaptation are the Mistborn series, for features, and The Stormlight Archive series, for television," reports the Hollywood Reporter. From the report: The deal is rare one, coming after a competitive situation which saw Sanderson meet with most of the studio heads in town. It gives the author rarefied control over the screen translations, according to sources. Sanderson will be the architect of the universe; will write, produce and consult; and will have approvals. That's a level of involvement that not even J.K. Rowling or George R.R. Martin enjoys.
Sanderson's literary success and fan following helped pave the way for such a deal. One of the most prolific and beloved fantasy authors working today, he has sold over 50 million copies of his books worldwide, collectively across his series. [...] While the Cosmere books are set in various worlds and eras, the underlying premise concerns a being named Adolnasium who is killed by a group of conspirators. The being's power is broken into 16 shards, which are then spread out throughout many worlds by the conspirators, spreading many kinds of magic across the universe.
Read more of this story at Slashdot.
Scientific American's Elizabeth Anne Brown recently "polled the great art houses of Europe" about whether they'd had any recent experiences with mold in their collections. Despite the stigma that keeps many institutions silent, she found that extremophile "xerophilic" molds are quietly spreading through museums and archives, thriving in low-humidity, tightly sealed storage and damaging everything from textiles and wood to manuscripts and stone. An anonymous Slashdot reader shares an excerpt from the article: Mold is a perennial scourge in museums that can disfigure and destroy art and artifacts. [...] Consequently, mold is spoken of in whispers in the museum world. Curators fear that even rumors of an infestation can hurt their institution's funding and blacklist them from traveling exhibitions. When an infestation does occur, it's generally kept secret. The contract conservation teams that museums hire to remediate invasive mold often must vow confidentiality before they're even allowed to see the damage.
But a handful of researchers, from in-house conservators to university mycologists, are beginning to compare notes about the fungal infestations they've tackled in museum storage depots, monastery archives, crypts and cathedrals. A disquieting revelation has emerged from these discussions: there's a class of molds that flourish in low humidity, long believed to be a sanctuary from decay. By trying so hard to protect artifacts, we've accidentally created the "perfect conditions for [these molds] to grow," says Flavia Pinzari, a mycologist at the Council of National Research of Italy. "All the rules for conservation never considered these species."
These molds -- called xerophiles -- can survive in dry, hostile environments such as volcano calderas and scorching deserts, and to the chagrin of curators across the world, they seem to have developed a taste for cultural heritage. They devour the organic material that abounds in museums -- from fabric canvases and wood furniture to tapestries. They can also eke out a living on marble statues and stained-glass windows by eating micronutrients in the dust that accumulates on their surfaces. And global warming seems to be helping them spread. Most frustrating for curators, these xerophilic molds are undetectable by conventional means. But now, armed with new methods, several research teams are solving art history cold cases and explaining mysterious new infestations...
The xerophiles' body count is rising: bruiselike stains on Leonardo da Vinci's most famous self-portrait, housed in Turin. Brown blotches on the walls of King Tut's burial chamber in Luxor. Pockmarks on the face of a saint in an 11th-century fresco in Kyiv. It's not enough to find and identify the mold. Investigators are racing to determine the limits of xerophilic life and figure out which pieces of our cultural heritage are at the highest risk of infestation before the ravenous microbes set in.
Read more of this story at Slashdot.
The Linux kernel community has formalized a continuity plan for the day Linus Torvalds eventually steps aside, defining how the process would work to replace him as the top-level maintainer. ZDNet's Steven Vaughan-Nichols reports: The new "plan for a plan," drafted by longtime kernel contributor Dan Williams, was discussed at the latest Linux Kernel Maintainer Summit in Tokyo, where he introduced it as "an uplifting subject tied to our eventual march toward death." Torvalds added, in our conversation, that "part of the reason it came up this time around was that my previous contract with Linux Foundation ended Q3 last year, and people on the Linux Foundation Technical Advisory Board had been aware of that. Of course, they were also aware that we'd renewed the contract, but it meant that it had been discussed."
The plan stops short of naming a single heir. Instead, it creates an explicit process for selecting one or more maintainers to take over the top-level Linux repository in a worst-case or orderly-transition scenario, including convening a conclave to weigh options and maximize long-term project health. One maintainer in Tokyo jokingly suggested that the group, like the conclave that selects a new pope, be locked in a room and that a puff of white smoke be sent out when a decision was reached.
The document frames this as a way to protect against the classic "bus factor" problem. That is, what happens to a project if its leader is hit by a bus? Torvalds' central role today means the project currently assumes a bus-factor of one, where a single person's exit could, in theory, destabilize merges and final releases. In practice, as Torvalds and other top maintainers have discussed, the job of top penguin would almost certainly currently go to Greg Kroah-Hartman, the stable-branch Linux kernel maintainer. Responding to the suggestion that the backup replacement would be Greg KH, Torvalds said: "But the thing is, Greg hasn't always been Greg. Before Greg, there was Andrew Morton and Alan Cox. After Greg, there will be Shannon and Steve. The real issue is you have to have a person or a group of people that the development community can trust, and part of trust is fundamentally about having been around for long enough that people know how you work, but long enough does not mean to be 30 years."
Read more of this story at Slashdot.