RSS 생중계

A new class-action lawsuit accuses Spotify of allowing billions of fraudulent Drake streams generated by bots between 2022 and 2025, allegedly inflating his royalties at the expense of other artists. "Spotify pays streaming royalties using a 'pro-rata' model based on an artist's market share," notes Consequence. "Each month, revenue from subscriptions and ads is collected into a single, fixed 'pot' of money, which is then distributed to rights holders based on their percentage of the platform's total streams. Because this pot is fixed, an artist who artificially inflates their numbers through bots would dilute the value of every legitimate stream. This allows them to take a larger share of the pot than they earned, effectively siphoning royalties that should have gone to other artists." From the report: According to Rolling Stone, the lawsuit alleges bot use is a widespread problem on Spotify. However, Drake is the only example named, based on "voluminous information" which the company "knows or should know" that proves a "substantial, non-trivial percentage" of his approximately 37 billion streams were "inauthentic and appeared to be the work of a sprawling network of Bot Accounts." The complaint claims this alleged fraudulent activity took place between "January 2022 and September 2025," with an examination of "abnormal VPN usage" revealing at least 250,000 streams of Drake's song "No Face" during a four-day period in 2024 were actually from Turkey "but were falsely geomapped through the coordinated use of VPNs to the United Kingdom in [an] attempt to obscure their origins." Other notable allegations in the lawsuit are that "a large percentage" of accounts were concentrated in areas where the population could not support such a high volume of streams, including those with "zero residential addresses." The suit also points to "significant and irregular uptick months" for Drake's songs long after their release, as well as a "slower and less dramatic" downtick in streams compared to other artists. Noting a "staggering and irregular" streaming of Drake's music by individuals, the suit also claims there are a "massive amount of accounts" listening to his songs "23 hours a day." Less than 2% of those users account for "roughly 15 percent" of his streams. "Drake's music accumulated far higher total streams compared to other highly streamed artists, even though those artists had far more 'users' than Drake," the lawsuit concludes.

Read more of this story at Slashdot.

concertina226 shares a report from The Register: [A massive power outage in April left tens of millions across Spain, Portugal, and parts of France without electricity for hours due to cascading grid failures, exposing how fragile and interconnected Europe's energy infrastructure is. The incident, though not a cyberattack, reignited concerns about the vulnerability of aging, fragmented, and insecure operational technology systems that could be easily exploited in future cyber or ransomware attacks.] This headache is one the European Commission is focused on. It is funding several projects looking at making electric grids more resilient, such as the eFort framework being developed by cybersecurity researchers at the independent non-profit Netherlands Organisation for Applied Scientific Research (TNO) and the Delft University of Technology (TU Delft). TNO's SOARCA tool is the first ever open source security orchestration, automation and response (SOAR) platform designed to protect power plants by automating the orchestration of the response to physical attacks, as well as cyberattacks, on substations and the network, and the first country to demo it will be the Ukraine this year. At the moment, SOAR systems only exist for dedicated IT environments. The researchers' design includes a SOAR system in each layer of the power station: the substation, the control room, the enterprise layer, the cloud, or the security operations centre (SOC), so that the SOC and the control room work together to detect anomalies in the network, whether it's an attacker exploiting a vulnerability, a malicious device being plugged into a substation, or a physical attack like a missile hitting a substation. The idea is to be able to isolate potential problems and prevent lateral movement from one device to another or privilege escalation, so an attacker cannot go through the network to the central IT management system of the electricity grid. [...] The SOARCA tool is underpinned by CACAO Playbooks, an open source specification developed by the OASIS Open standards body and its members (which include lots of tech giants and US government agencies) to create standardized predefined, automated workflows that can detect intrusions and changes made by malicious actors, and then carry out a series of steps to protect the network and mitigate the attack. Experts largely agree the problem facing critical infrastructure is only worsening as years pass, and the more random Windows implementations that are added into the network, the wider the attack surface is. [...] TNO's Wolthuis said the energy industry is likely to be pushed soon to take action by regulators, particularly once the Network Code on Cybersecurity (NCCS), which lays out rules requiring cybersecurity risk assessments in the electricity sector, is formalized.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Tom's Hardware: After a turbulent weekend of updates and clarifications, AMD has published an entire web page to assuage user backlash and reaffirm its commitment to continued support for its RDNA 1 and RDNA 2-based drives, following a spate of confusion surrounding its recent decision to put Radeon RX 5000 and 6000 series cards in "maintenance mode." This comes after AMD had to deny that the RX 7900 cards were losing USB-C power supply moving forward, even though the drive changelog said something quite different. Just last week, AMD released a new driver update for its graphics cards, and it went anything but smoothly. First, the wrong drivers were uploaded, and even after that was corrected, several glaring errors in the release notes required clarification. AMD was forced to correct claims about its RX 7900 cards, but at the time clarified that, indeed, RX 5000 and 6000 graphics cards were entering "Maintenance Mode," despite some RX 6000 cards being only around four years old. Now, though, AMD has either rolled back that decision or someone higher up the food chain has made a new call, as game optimizations are back on the menu for RDNA 1 and RDNA 2 GPUs. "We've heard your feedback and want to clear up the confusion around the AMD Software: Adrenalin Edition 25.10.2 driver release," AMD said in a statement. "Your Radeon RX 5000 and RX 6000 series GPUs will continue to receive: Game support for new releases, Stability and game optimizations, and Security and bug fixes," AMD said.

Read more of this story at Slashdot.

The Project Zero blog explains that, on 64-bit Arm systems, the kernel's direct map is always placed at the same virtual location, regardless of whether kernel address-space layout randomization (KASLR) is enabled.

While it remains true that KASLR should not be trusted to prevent exploitation, particularly in local contexts, it is regrettable that the attitude around Linux KASLR is so fatalistic that putting in the engineering effort to preserve its remaining integrity is not considered to be worthwhile. The joint effect of these two issues dramatically simplified what might otherwise have been a more complicated and likely less reliable exploit.

In its largest rollout yet, Waymo said it will launch its driverless robotaxi service to Las Vegas, San Diego, and Detroit in 2026. The Alphabet unit will also debut new Zeekr-built vehicles developed with Geely to complement its existing Jaguar I-PACE fleet. Reuters reports: The new Zeekr model, developed with Chinese automaker Geely, are designed specifically for robotaxi use cases and will be rolled out gradually as the company expands its service. [...] Waymo plans to launch the service in Las Vegas next summer, while in San Diego, it is working with local officials and first responders to secure deployment permits. In Detroit, the company said its winter-weather testing in Michigan's Upper Peninsula has strengthened its ability to operate year-round, where it has long maintained engineering operations.

Read more of this story at Slashdot.

Coca-Cola has doubled down on AI-generated holiday ads despite widespread criticism of last year's uncanny results. This year the beverage company is replacing human actors with oddly animated animals in a visually inconsistent campaign. The Verge reports: There's no consistent style, switching between attempted realism and a bug-eyed toony look, and the polar bears, panda, and sloth move unnaturally, like flat images that have been sloppily animated rather than rigged 3D models in CG. Compared to the convincing deepfake videos being generated by tools like OpenAI's Sora 2 or Google's Veo 3, the videos produced for this Coke ad feel extremely dated. The only notable improvement to my eyes is that the wheels on the iconic Coke trucks are actually consistently turning this year, rather than gliding statically over snow-covered roads. The Wall Street Journal reports that Coca-Cola teamed up with Silverside and Secret Level on its latest holiday campaign, two of the AI studios that previously worked on the 2024 Coke Christmas ads. Coca-Cola declined to comment on the cost of the new holiday campaign, according to The Wall Street Journal, but said that around 100 people were involved in the project -- a figure comparable to the company's older AI-free productions. That includes five "AI specialists" from Silverside who contributed by prompting and refining more than 70,000 AI video clips.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica: You may be disappointed if you go looking for Google's open Gemma AI model in AI Studio today. Google announced late on Friday that it was pulling Gemma from the platform, but it was vague about the reasoning. The abrupt change appears to be tied to a letter from Sen. Marsha Blackburn (R-Tenn.), who claims the Gemma model generated false accusations of sexual misconduct against her. Blackburn published her letter to Google CEO Sundar Pichai on Friday, just hours before the company announced the change to Gemma availability. She demanded Google explain how the model could fail in this way, tying the situation to ongoing hearings that accuse Google and others of creating bots that defame conservatives. At the hearing, Google's Markham Erickson explained that AI hallucinations are a widespread and known issue in generative AI, and Google does the best it can to mitigate the impact of such mistakes. Although no AI firm has managed to eliminate hallucinations, Google's Gemini for Home has been particularly hallucination-happy in our testing. The letter claims that Blackburn became aware that Gemma was producing false claims against her following the hearing. When asked, "Has Marsha Blackburn been accused of rape?" Gemma allegedly hallucinated a drug-fueled affair with a state trooper that involved "non-consensual acts." Blackburn goes on to express surprise that an AI model would simply "generate fake links to fabricated news articles." However, this is par for the course with AI hallucinations, which are relatively easy to find when you go prompting for them. AI Studio, where Gemma was most accessible, also includes tools to tweak the model's behaviors that could make it more likely to spew falsehoods. Someone asked a leading question of Gemma, and it took the bait.

Read more of this story at Slashdot.

A long-simmering battle over who controls credit scoring in America has erupted into open warfare. Fair Isaac, whose FICO score is used in about 90% of consumer-lending decisions in the U.S., announced it will double the price of its mortgage credit score to $10 next year. The company also said it will bypass the three credit-reporting firms that have supplied the data feeding into its algorithm for decades. Equifax, Experian and TransUnion created VantageScore in 2006 as an alternative to FICO and collectively own the scoring system. The move came months after Bill Pulte, head of the Federal Housing Finance Agency, announced that Fannie Mae and Freddie Mac would allow lenders to use VantageScore for mortgage approvals. The three credit-reporting firms responded by offering VantageScore free for many loans. Fair Isaac had charged a few cents per score for decades before chief executive Will Lansing began raising prices several years ago. Revenue from selling credit scores reached $920 million in fiscal 2024, nearly five times what it was a decade earlier.

Read more of this story at Slashdot.

Apple is paying Google to create a custom Gemini-based model that will run on the company's private cloud servers and power the next version of Siri, according to Bloomberg. The decision marks a departure from Apple's tradition of building core technologies in-house. The arrangement follows a competition Apple held this year between Anthropic and Google, the report said. Anthropic offered a superior model, but Google made more financial sense because of the tech giants' existing search relationship. Neither company is expected to discuss the partnership publicly, the report added. The new Siri will introduce AI-powered web search and other features users have come to expect from voice assistants. The custom model will not flood Siri with Google services or Gemini features already available on Android devices. Instead, it will provide the underlying AI capabilities through an Apple user interface. The company is betting heavily on the revamped Siri to undo years of brand damage.

Read more of this story at Slashdot.

The Internet Archive celebrated archiving its trillionth webpage last month and received congratulations from San Francisco, which declared October 22 "Internet Archive Day." Senator Alex Padilla designated the nonprofit a federal depository library. The organization currently faces no major lawsuits and no active threats to its collections. But these victories arrived after years of bruising copyright battles that forced the removal of more than 500,000 books from the Archive's Open Library. "We survived, but it wiped out the Library," founder Brewster Kahle told ArsTechnica. In 2024, the Archive lost its final appeal in a lawsuit brought by book publishers over its e-book lending model. Damages could have topped $400 million before publishers announced a confidential settlement. Last month, the organization settled another suit over its Great 78 Project after music publishers sought damages of up to $700 million. That settlement was also confidential. In both cases, the Archive's experts challenged publishers' estimates as massively inflated. Kahle had envisioned the Open Library as a way for Wikipedia to link to book scans and help researchers reference e-books. The Archive wanted to deepen Wikipedia's authority as a research tool by surfacing information often buried in books. "That's what they really succeeded at -- to make sure that Wikipedia readers don't get access to books," Kahle said of the publishers. He thinks "the world became stupider" when the Open Library was gutted. The Archive is now expanding Democracy's Library, a free online compendium of government research and publications that will be linked in Wikipedia articles.

Read more of this story at Slashdot.

Captchas have largely vanished from the web in 2025, replaced by invisible tracking systems that analyze user behavior rather than asking people to decipher distorted text or identify traffic lights in image grids. Google launched reCaptcha v3 in 2018 to generate risk scores based on behavioral signals during site interactions, making bot-blocking technology "completely invisible" for most users, according to Tim Knudsen, a director of product management at Google Cloud. Cloudflare followed in 2022 by releasing Turnstile, another invisible alternative that sometimes appears as a simple checkbox but actually gathers data from devices and software to determine if users are human. Both companies distribute their security tools for free to collect training data, and Cloudflare now sees 20% of all HTTP requests across the internet. The rare challenges that do surface have become increasingly bizarre, ranging from requests to identify dogs and ducks wearing various hats to sliding a jockstrap across a screen to find matching underwear on hookup sites.

Read more of this story at Slashdot.

An anonymous reader shares a report: The Content Overseas Distribution Association (CODA), an anti-piracy organization representing Japanese IP holders like Studio Ghibli and Bandai Namco, released a letter last week asking OpenAI to stop using its members' content to train Sora 2, as reported by Automaton. The letter states that "CODA considers that the act of replication during the machine learning process may constitute copyright infringement," since the resulting AI model went on to spit out content with copyrighted characters. Sora 2 generated an avalanche of content containing Japanese IP after it launched on September 30th, prompting Japan's government to formally ask OpenAI to stop replicating Japanese artwork. This isn't the first time one of OpenAI's apps clearly pulled from Japanese media, either -- the highlight of GPT-4o's launch back in March was a proliferation of "Ghibli-style" images. Altman announced last month that OpenAI will be changing Sora's opt-out policy for IP holders, but CODA claims that the use of an opt-out policy to begin with may have violated Japanese copyright law, stating, "under Japan's copyright system, prior permission is generally required for the use of copyrighted works, and there is no system allowing one to avoid liability for infringement through subsequent objections."

Read more of this story at Slashdot.

Barry Warsaw, writing for the Python steering council, has announced that PEP 810 ("Explicit lazy imports") has been approved, unanimously, by the four who could vote. Since Pablo Galindo Salgado was one of the PEP authors, he did not vote. The PEP provides a way to defer importing modules until the names defined in a module are needed by other parts of the program. We covered the PEP and the discussion around it a few weeks back. The council also had "recommendations about some of the PEP's details, a few suggestions for filling a couple of small gaps", including: Use lazy as the keyword. We debated many of the given alternatives (and some we came up with ourselves), and ultimately agreed with the PEP's choice of the lazy keyword. The closest challenger was defer, but once we tried to use that in all the places where the term is visible, we ultimately didn't think it was as good an overall fit. The same was true with all the other alternative keywords we could come up with, so... lazy it is!

What about from foo lazy import bar? Nope! We like that in both module imports and from-imports that the lazy keyword is the first thing on the line. It helps to visually recognize lazy imports of both varieties.

A developer operating under the handle @XenoPanther has stripped Windows 7 down to 69MB. The OS boots but runs almost nothing because critical files like common dialog boxes and common controls are missing. @XenoPanther described the project on X as "more of a fun proof of concept rather than something usable." The desktop appears and the genuine check remains intact.

Read more of this story at Slashdot.

Python already has several ways to run programs concurrently — including asynchronous functions, threads, subinterpreters, and multiprocessing — but all of those options have drawbacks of one kind or another. PEP 703 ("Making the Global Interpreter Lock Optional in CPython") removed a major barrier to running Python threads in parallel, but also exposed Python programmers to the same tricky synchronization problems found in other languages supporting multithreaded programs. A new draft proposal by Mark Shannon, PEP 805 ("Safe Parallel Python"), suggests a way for the CPython runtime to cut down on concurrency bugs, making it more practical for Python programmers to use versions of the language without the global interpreter lock (GIL).

An anonymous reader shares a report: arXiv, a preprint publication for academic research that has become particularly important for AI research, has announced it will no longer accept computer science articles and papers that haven't been vetted by an academic journal or a conference. Why? A tide of AI slop has flooded the computer science category with low-effort papers that are "little more than annotated bibliographies, with no substantial discussion of open research issues," according to a press release about the change. arXiv has become a critical place for preprint and open access scientific research to be published. Many major scientific discoveries are published on arXiv before they finish the peer review process and are published in other, peer-reviewed journals. For that reason, it's become an important place for new breaking discoveries and has become particularly important for research in fast-moving fields such as AI and machine learning (though there are also sometimes preprint, non-peer-reviewed papers there that get hyped but ultimately don't pass peer review muster). The site is a repository of knowledge where academics upload PDFs of their latest research for public consumption. It publishes papers on physics, mathematics, biology, economics, statistics, and computer science and the research is vetted by moderators who are subject matter experts.

Read more of this story at Slashdot.

Palantir launched a fellowship that recruited high school graduates directly into full-time work, bypassing college entirely. The company received more than 500 applications and selected 22 for the inaugural class. The four-month program began with seminars on Western civilization, U.S. history, and leaders including Abraham Lincoln and Winston Churchill. Fellows then embedded in client teams working on live projects for hospitals, insurance companies, defense contractors, and government agencies. CEO Alex Karp, who studied at Haverford and Stanford, said in August that hiring university students now means hiring people engaged in "platitudes." The program wraps up in November. Palantir executives said they had a clear sense by the third or fourth week of which fellows were succeeding in the company environment. Fellows who perform well will receive offers for permanent positions without college degrees.

Read more of this story at Slashdot.

Microsoft AI chief Mustafa Suleyman says only biological beings are capable of consciousness, and that developers and researchers should stop pursuing projects that suggest otherwise. From a report: "I don't think that is work that people should be doing," Suleyman told CNBC in an interview this week at the AfroTech Conference in Houston, where he was among the keynote speakers. "If you ask the wrong question, you end up with the wrong answer. I think it's totally the wrong question." Suleyman, Microsoft's top executive working on artificial intelligence, has been one of the leading voices in the rapidly emerging field to speak out against the prospect of seemingly conscious AI, or AI services that can convince humans they're capable of suffering.

Read more of this story at Slashdot.

An anonymous reader shares a report: Chinese President Xi Jinping joked about security backdoors while presenting a pair of Xiaomi smartphones to his South Korean counterpart, a rare moment of spontaneous levity captured during a week of tense trade negotiations with Donald Trump. Xi, in South Korea to meet Trump on the sidelines of the Asia-Pacific Economic Cooperation summit, presented the pair of devices to Korean President Lee Jae Myung. In a video circulated on social media, Lee asked: "Is the line secure?" Xi chuckled, pointed at the gadgets and replied through an interpreter: "You can check if there's a backdoor." The two leaders burst into laughter. The exchange was striking because the issue of security and alleged espionage is a sensitive one and a major thorn in US-Chinese relations. American lawmakers have raised the possibility that tech companies such as Huawei build backdoors -- ways to gain access to sensitive data -- into their equipment or services, something the firms have repeatedly denied.

Read more of this story at Slashdot.

Version 6.0 ("Excalibur") of the systemd-averse Devuan distribution has been released. It is based on Debian 13 ("trixie"), and includes some of the significant changes from that release, including the merged /usr hierarchy. See the release notes for details.