Categories
Art & Life Culture Education Foodies/Tastylicious Lifestyle Perspectives Programs & Events Science

D&R Greenway Land Trust announces Holiday Open House and ‘Talk about Trees’ at the Discovery Center at Point Breeze in Bordentown

The public is invited to a Holiday Open House on Saturday, Dec. 2, 2 to 4 p.m. at D&R Greenway Land Trust’s Discovery Center at Point Breeze, located at 101 Park St., Bordentown, N.J.

 

The public is invited to enjoy mulled cider, hot chocolate and cookies at a Holiday Open House at D&R Greenway’s Discovery Center at Point Breeze on Saturday, Dec. 2,  2 p.m. to 4 p.m.

Photo –  Display case in the Natural World Room at the Discovery Center at Point Breeze includes tree core samples among Native American and bird exhibits.

 

Located at 101 Park Street, Bordentown, N.J., the Discovery Center was created by D&R Greenway Land Trust in a renovated historic home that belonged to Joseph Napoleon Bonaparte’s gardener in the early 1800s. The house will be open with exhibits about the history, land and people of Point Breeze, including the Lenape and Bonaparte.

Photo – Historic Map showing location of historic trees at Point Breeze

 

During the month of December, a Holiday Tree will grace the Crown Jewels Gallery.

 

Visitors are invited to bring an ornament to decorate the tree, commemorating the history of Point Breeze, the natural features that can be found on the land or the local community. Homemade Fleur de Lis ornaments will be available to decorate for a small donation.

 

On Sunday, Dec. 10, at 1 p.m., Dr. Dan Druckenbrod of Rider University will present “Talk about Trees” to tell the story of historic trees he has discovered on the Point Breeze land through a survey and tree core sampling.  Three of Dr. Druckenbrod’s core samples are on display at the Discovery Center, including one from a tree dated before the Bonaparte era.

 

A noted dendrologist, he has conducted a scientific study that began under the ownership of Divine Word Missionaries and continued with permission from the State and co-managers the City of Bordentown and D&R Greenway.  Dr. Druckenbrod is preparing to publish a book on his work and will reveal previously unknown facts. This will be a unique opportunity to hear about his discoveries first-hand.  Please send RSVP’s to info@drgreenway.org for the Dec. 10 Talk About Trees lecture.

 

Photo – Welcome to the Holiday Open House at the Discovery Center

These two events, the Holiday Open House on Saturday, Dec. 2, and the “Talk about Trees” on Sunday, Dec. 10, celebrate the Discovery Center’s new weekend visitor hours. Beginning in December, the Discovery Center will be open on Saturdays and Sundays from 12 Noon – 4 p.m. every weekend. The Discovery Center will be closed on Christmas Eve and New Years Eve. Special holiday hours have been added on Dec. 26 – 27 to accommodate families who are home for the holidays.

 

Layers of history are represented at the Discovery Center.  Visitors learn the preservation story and about the land’s Lenape inhabitants in the Peoples Room. The Crown Jewels Gallery showcases special features of Point Breeze, seen as the “crown jewels” that can be found on the land, in reference to Bonaparte’s escape as King of Spain from where he is reputed to have taken the Crown Jewels to support his lifestyle in exile. Climbing a staircase to the second floor, visitors pass beneath an Italian glass chandelier that symbolizes Joseph and his brother Napoleon Bonaparte’s Italian ancestry and birth on the island of Corsica.

 

In the Walk Through Time Room, visitors view an 1819 painting of Jospeh Bonaparte, thanks to the family of Louis Mailliard, his lifelong confidant and Secretary. Turing to the Natural World room, stories focus on nature and the Delaware River, including the nearly extinct sturgeon and birds seen by John James Audubon and ornithologist Charles Lucien Bonaparte.

 

Admission to the Discovery Center at Point Breeze is free.  A suggested donation of $10 provides the donor with a souvenir magnet and supports programs and exhibits. RSVP to info@drgreenway.org.

 

Beginning in December, the new open hours for visitors will be Saturdays and Sundays from 12 noon- 4 p.m.  A special holiday lecture, Talk about Trees, will be presented on Sunday, Dec. 10, at 1 p.m. during Visitor Hours. Holiday hours include the afternoons of Dec. 26 – 27.

 

The Discovery Center will be closed on Christmas Eve and New Year’s Eve.

 

Group tours may be scheduled on weekdays by appointment. Information is available at www.drgreenway.org, or by calling D&R Greenway at 609-924-4646. RSVP to info@drgreenway.org.

About D&R Greenway Land Trust: D&R Greenway Land Trust is an accredited nonprofit that has reached a new milestone of over 22,000 acres of land preserved throughout central New Jersey since 1989. By protecting land in perpetuity and creating public trails, it gives everyone the opportunity to enjoy the great outdoors. The land trust’s preserved farms and community gardens provide local organic food for residents of the region—including those most in need. Through strategic land conservation and stewardship, D&R Greenway combats climate change, protects birds and wildlife, and ensures clean drinking water for future generations.

 

D&R Greenway’s mission is centered on connecting land with people from all walks of life. www.drgreenway.org; info@drgreenway.org. Follow us on Facebook and Instagram.

Categories
Business Culture Digital - AI & Apps Economics Healthcare Lifestyle News Now! Science Sports & Gaming Technology Travel & Leisure

Aetrex launches FitStarter technology platform to offer retailers immediate footwear fitting solution

Integrating the Heeluxe SmartLast system with Aetrex’s 3D foot scanning technology, retailers can provide fit recommendations to consumers upon program implementation

 

TEANECK, N.J. — (BUSINESS WIRE) — Aetrex, Inc. (“Aetrex”), a global market leader in foot scanning technology and data-driven orthotics and comfort footwear, today announced FitStarter, a personalized footwear recommendation platform designed to help retailers improve their shoe fitting service for shoppers, reduce returns and increase customer satisfaction.

 

Developed in partnership with the premier shoe fit testing company Heeluxe, FitStarter is an accurate, turnkey starting point to Aetrex’s AI-powered shoe match-making platform, FitGenius. Retailers can easily add FitStarter to their existing Albert 3D foot scanner (Albert 2 Pro or Albert 3DFit) software.

 

To support FitStarter, Aetrex is establishing multiple Fit Labs to analyze shoes submitted by participating retailers each season. A member of the Aetrex Technology team will analyze the shoes using the patented Hank Jr Shoe Fitting SmartLast system developed by Heeluxe, which leverages pressure sensor technology. Within days, retailers will have footwear and fit recommendations available within their Aetrex Albert software. Once Aetrex collects shoe data within the Fit Lab, the FitStarter platform will analyze each customer’s unique 3D foot scan data collected in store alongside the Fit Lab data to provide immediate, personalized fitting recommendations.

 

“While FitGenius remains our gold standard fit recommendation offering for retailers, not every retailer has the capacity to quickly collect the required 5,000 foot scan data points necessary to feed the AI platform,” said Larry Schwartz, CEO of Aetrex.

 

“With FitStarter, retailers can provide accurate shoe fit recommendations from day-one of installation while also collecting the foot scan data points needed to upgrade to the premium FitGenius AI.”

 

The FitStarter program provides in-store shoppers with personalized fit recommendations, while FitGenius has the capability to provide ideal footwear recommendations to consumers both in store and online. After a shopper completes an Aetrex 3D foot scan at a participating retail location, FitStarter will rank the retailer’s footwear inventory based on the likelihood of a good fit for that individual from excellent to poor. It will also display a graphic of the consumer’s selected shoe, highlighting areas that fit well and potential areas of pressure. FitStarter also considers the shopper’s preference for shoe fit, ranging from snug to roomy.

 

“Like Aetrex, Hank Jr Shoe Fitting is focused on data-driven technology solutions to improve footwear fit and design, bringing natural synergy to our partnership,” said Dr. Geoffrey Gray, founder of Heeluxe and Hank Jr Shoe Fitting, Inc.

 

“This partnership allows us to bring our shoe data and testing process to the masses in an effort to help shoppers around the world get into the right fitting footwear on the first try, quickly and easily.”

 

FitStarter will be available to existing and interested Aetrex foot scanning partners on January 1, 2024 on a service subscription model. To learn more about FitStarter and all Aetrex technology offerings, visit aetrex.com.

 

About Aetrex

Aetrex, Inc. is widely recognized as a global leader in foot scanning technology and data-driven orthotics and comfort footwear. Aetrex has developed state-of-the-art foot scanning devices, including Albert, Albert 2 Pro and Albert 3DFit (2022 and 2023 CES Innovation Award Honorees), Albert Pressure and iStep, designed to accurately measure feet and determine foot type and pressure points. Since 2002, Aetrex has placed over 12,000 scanners worldwide that have performed more than 50 million unique customer foot scans, currently averaging more than 2.5 million scans a year.

 

The company is renowned for its over-the-counter orthotics – the worlds #1 premium foot orthotic. With fashion, function and quality at the forefront, Aetrex also designs and manufactures stylish, performance footwear. Based in New Jersey, Aetrex is consistently named one of New Jersey’s Top 100 Privately Held Companies and was also included in NJBIZ’s Top 30 Manufacturing Companies. It has remained privately owned by the Schwartz family for three generations. For additional information, visit www.aetrex.com.

Contacts

Media
Simone Migliori

aetrex@matternow.com
617-874-5484

Categories
Business Culture Digital - AI & Apps Lifestyle Regulations & Security Science Technology

AI development will likely move faster; be more dispersed, less controlled after failed coup at OpenAI

—  Failed coups, as seen at OpenAI, often accelerate the thing that they were trying to prevent

—  Over the past week, OpenAI’s board went through four CEOs in five days.

 

Over the past week, OpenAI’s board went through four CEOs in five days.

 

It accused the original chief executive, Sam Altman, of lying, but later backed down from that and refused to say what that meant.

 

Ninety per cent of the organisation’s staff signed an open letter saying they’d quit if the board didn’t. Silicon Valley was both riveted and horrified.

 

By Wednesday, Altman was back, two of the three external board members had been replaced, and everyone could get some sleep.

 

It would be easy to say that this chaos showed that both OpenAI’s board and its curious subdivided non-profit and for-profit structure were not fit for purpose. One could also suggest that the external board members did not have the appropriate background or experience to oversee a $90bn company that has been setting the agenda for a hugely important technology breakthrough.

 

One could probably say less polite things too, and all of that might be true, but it would also be incomplete.   As far as we know (and the very fact that I have to say that is also a problem), the underlying conflict inside OpenAI was one that a lot of people have pointed to and indeed made fun of over the past year.

 

OpenAI was created to try to build a machine version of something approximating to human intelligence (so-called “AGI,” or artificial general intelligence). The premise was that this was possible within years rather than decades, and potentially very good but also potentially very dangerous, not just for pedestrian things such as democracy or society but for humanity itself.

That’s the reason for the strange organisational structure — to control the risk. Altman has been building this thing as fast as possible, while also saying very loudly and often that this thing is extremely dangerous and governments should get involved to control any attempts to build it. Well, which is it?

 

Many in tech think that airing such concerns is a straightforward attempt at anti-competitive regulatory capture. This particularly applies to broader moves against open-source AI models (seen in the White House’s executive order on AI last month): people think that OpenAI is trying to get governments to ban competition. That might be true, but I personally think that people who claim AGI is both close and dangerous are sincere, and that makes their desire to build it all the more conflicted. That seems to be the best explanation of what has happened at OpenAI: those who think we should slow down and be careful mounted a coup against those who think we should speed up and be careful.

 

Part of the problem and conflict when it comes to discussing AGI is that it’s an abstract concept — a thought experiment — without any clear or well-understood theoretical model. The engineers on the Apollo Program knew how far away the moon was and how much thrust the rocket had but we don’t know how far away AGI is, nor how close OpenAI’s large language models are, nor whether they can get there.

You could spend weeks of your life watching videos of machine-learning scientists arguing about this and conclude only that they don’t know either. ChatGPT might scale all the way to the Terminator in five years, or in five decades, or it might not. This might be like looking at a 1920s biplane and worrying that it might go into orbit. We don’t know.  This means most conversations about the risk of AI become hunts for metaphors (it’s “like” nuclear weapons, or a meteorite, or indeed the Apollo Program).

 

Or they dredge up half-forgotten undergraduate philosophy classes (Pascal’s wager! Plato’s cave!), or resort to argument from authority (Geoff Hinton is worried! Yann LeCun is not!). In the end, this comes down to how you, instinctively, feel about risk. If you cannot know what is close or not, is that a reason to worry or a reason not to worry? There is no right answer.

 

Unfortunately for the “doomers”, the events of the last week have sped everything up. One of the now resigned board members was quoted as saying that shutting down OpenAI would be consistent with the mission (better safe than sorry). But the hundreds of companies that were building on OpenAI’s application programming interfaces are scrambling for alternatives, both from its commercial competitors and from the growing wave of open-source projects that aren’t controlled by anyone.

 

AI will now move faster and be more dispersed and less controlled. Failed coups often accelerate the thing that they were trying to prevent.

Indeed, a common criticism of the doomers is that their idea that one powerful piece of software and a few brilliant engineers can transform the world is just another form of naive and simplistic tech utopianism — it fails to understand the real nature of power, complexity and human systems. The doomers on the board demonstrated exactly that — they did not know how power works.

 

 

 

— Benedict Evans / Financial Times

(The writer is a technology analyst)

Techmeme

Categories
Business Culture Digital - AI & Apps Healthcare Lifestyle Perks Science Special/Sponsored Content

Paula’s Choice’s entire website is 20 percent off for Black Friday

Paula’s Choice, the home to the top dermatologist-recommended exfoliants, is having a huge sale on their site for Black Friday and Cyber Monday.

 

The cult favorite brand is already ultra-affordable compared to most luxe skincare brands but loyalists claim that their products are just as good (if not better) than bold-faced brands with heftier price tags.

 

Right now, their entire website is currently 20% off. This means if you stock up on all your skincare essentials now, you can get their best-selling Gel Exfoliant for only $27 and Reconditioning Moisturizer for $9.60 — a total steal.

 

The Seattle-based skincare brand is loved by dermatologists for a reason. They pride themselves on being cruelty-free and fragrance-free, avoiding popular non-natural ingredients such as Dioxane, Essential Oils, Formeldahyde, Nanoparticles and Phthalates.

 

In addition to clean ingredients, Paula’s Choice also never tests on animals at any stage in development and use recyclable packaging to reduce their carbon footprint.

 

Plus, their stuff actually works. As a firsthand user of Paula’s Choice myself, I can say my skin complely changed after integrating their products into my skincare routine. Clogged pores, dry skin, white heads — I struggle with it all less since using their Pore Normalizing Cleanser every night.

 

Check out Paula’s Choice entire sale here, and the best products below. If you’re looking for more beauty steals, look through our roundup of the best Black Friday beauty deals here.

 

GEL EXFOLIANT

Courtesy of Paula’ Choice

 

 

This leave-on gel exfoliant removes layers of dull skin, shrinking clogged pores and diminishing wrinkles in the process.

RECONDITIONING MOISTURIZER

Courtesy of Paula’s Choice

 

Add instant moisture to your skin with this overnight sheer moisturizer, powered by superfoods such as flaxseed, wild cherry and arugula.

PORE NORMALIZING CLEANSER

Courtesy of Paula’s Choice

 

 

This gentle, acne-fighting cleanser removes excess oil, clears up clogged pores and removes makeup without drying the skin.

 

 

Variety

Categories
Business Economics Energy Environment Science

Asbury Carbons Inc. announces price increases across all graphite product lines, cokes, and non-carbon materials

ASBURY, N.J. — (BUSINESS WIRE) — Asbury Carbons Inc. announced on Friday that it will be introducing price increases for its graphite products (natural and synthetic) as well as cokes and non-carbon materials.

Price increases will range up to 10 percent, depending on the product and grade, and will go into effect for shipments beginning Jan. 1, 2024.

 

These price increases are necessary to help offset the increased cost of raw materials, energy, transportation, and manufacturing.

 

About Asbury Carbon, Inc.

Founded in 1895 by Harry M. Riddle and based in Asbury, NJ, Asbury Carbons Inc. is the world’s most reliable source for high-quality graphite, cokes, carbon materials, and graphene-engineered solutions.

 

The company provides more than 2,000 grades of materials, which it processes to customers’ exacting requirements for various applications, including polymers and rubbers, paints and coatings, lubricants, specialty ceramics, friction products, insulation, and other materials.

 

For nearly 130 years, Asbury has set an industry standard for meeting customers’ needs, providing flexible and innovative solutions, and investing in employees. The company operates 12 manufacturing locations across the U.S., Mexico, Canada, and the Netherlands and has sales offices across North America, Europe and Asia. For more information, please visit https://www.asbury.com/.

 

Contacts

Phone: +1 908.537.2155

Email: info@asbury.com

Categories
Digital - AI & Apps Lifestyle Science Technology

Meta unveils new AI tools to edit images and generate videos from text instructions, which uses its image generation model Emu

Mike Wheatley / SiliconANGLE:

 

 

—  Artificial intelligence researchers from Meta Platforms Inc. said they have made significant advances in AI-powered image and video generation.

 

The Facebook and Instagram parent has developed new tools that enable more control over the image editing process via text instructions, and a new method for text-to-video generation. The new tools are based on Meta’s Expressive Media Universe or Emu, the company’s first foundational model for image generation.

 

EMU was announced in September and today it’s being used in production, powering experiences such as Meta AI’s Imagine feature that allows users to generate photorealistic images in Messenger. In a blog post, Meta’s AI researchers explained that generative AI image generation is often a step-by-step process, where the user tries a prompt and the picture that’s generated isn’t quite what they had in mind. As a result, users are forced to keep tweaking the prompt until the image created is closer to what they had imagined.

 

Emu Edit for image editing

What Meta wants to do is to eliminate this process and give users more precise control, and that’s what its new Emu Edit tool is all about. It offers a novel approach to image manipulation, where the user simply inputs text-based instructions. It can perform local and global editing, adding or removing backgrounds, color and geometry transformations, object detection, segmentation and many more editing tasks.

 

“Current methods often lean toward either over-modifying or under-performing on various editing tasks,” the researchers wrote.

 

“We argue that the primary objective shouldn’t just be about producing a ‘believable’ image. Instead, the model should focus on precisely altering only the pixels relevant to the edit request.”

 

To that end, Emu Edit has been designed to follow the user’s instructions precisely to ensure that pixels unrelated to the request are untouched by the edit made. As an example, if a user wants to add the text “Aloha!” to a picture of a baseball cap, the cap itself should not be altered.

 

The researchers said incorporating computer vision into instructions for image generation models allows it to give users unprecedented control in image editing.

 

Emu Edit was trained on a dataset that contains 10 million synthesized samples, with each one including an input image, a description of the task to be performed and the targeted output image. The researchers believe this is the largest dataset of its kind ever created, allowing Emu Edit to deliver unrivaled results in terms of instruction faithfulness and image quality.

Emu Video for video generation

Meta’s AI team has also been focused on enhancing video generation. The researchers explained that the process of using generative AI to create videos is actually similar to image generation, only it involves bringing those images to life by bringing movement into the picture.

 

The Emu Video tool leverages the Emu model and provides a simple method for text-to-video generation that’s based on diffusion models. Meta said the tool can respond to various inputs, including text only, image only or both together.

 

The video generation process is split into a couple of steps, the first being to create an image conditioned by a text prompt, before creating a video based on that image and another text prompt. According to the team, this “factorized” approach offers an extremely efficient way to train video generation models.

 

“We show that factorized video generation can be implemented via a single diffusion model,” the researchers wrote. “We present critical design decisions, like adjusting noise schedules for video diffusion, and multi-stage training that allows us to directly generate higher-resolution videos.”

 

 

Meta said the advantage of this new approach is that it’s simpler to implement, using just a pair of diffusion models to whip up a 512-by-512 four-second video at 16 frames per second, compared with its older Make-A-Video tool, which uses five models. The company says human evaluations of this work reveal that it’s “strongly preferred” over its earlier work in image generation in terms of its overall quality and its faithfulness to the original text prompt.

 

Emu Video boasts other capabilities too, including the ability to animate user’s images based on simple text prompts, and once again it outperforms its earlier work.

 

For now, Meta’s research into generative AI image editing and video generation remains ongoing, but the team stressed there are a number of exciting use cases for the technology. For instance, it can enable users to create their own animated stickers and GIFs on the fly, rather than searching for existing ones that match the idea they’re trying to convert. It can also enable people to edit their own photographs without using complicated tools such as Photoshop.

 

The company added that its latest models are unlikely to replace professional artists and animators anytime soon. Instead, their potential lies in helping people to express themselves in new ways.

 

— Techmeme

Categories
Business Digital - AI & Apps Government Lifestyle Regulations & Security Science Technology

Port Authority NY NJ expands service and a new 15-device client emerges

MOUNTAIN VIEW, Calif. — (BUSINESS WIRE) — $KSCP #SecurityRobotKnightscope, Inc. [Nasdaq: KSCP] “(Knightscope” or the “Company),” a leading developer of autonomous security robots and blue light emergency communication systems, on Friday announces an expansion of services in New York and a new sale of 15 machines to a police department in California.

 

Port Authority New York New Jersey added the Knightscope Emergency Management System (KEMS) Professional service to monitor its 11 K1 Call Boxes on the George Washington Bridge. The KEMS platform allows clients and technicians to better understand the real-time health and status of deployed emergency communication devices. The cloud-based application monitors the system wide state-of-health, alerts users concerning operational issues, provides technicians real-time error detection/diagnostics, and collects/reports system performance statistics.

 

A police department in Southern California is purchasing 5 K1 Blue Light Towers to be installed in a new public park and 10 K1 Blue Light E-Phones in a new parking structure.

 

Knightscope’s Blue Light Towers, E-Phones and Call Boxes expand access to emergency communications for motorists, bicyclists and pedestrians utilizing the bridge as well as the park visitors by providing direct access to emergency services for people who may be experiencing danger, a crisis or some form of distress.

 

Learn More

Knightscope’s ASR services and industry leading emergency communications products help better protect the places people live, work, study and visit. To learn more about Knightscope’s Blue Light Emergency Communication Systems or Autonomous Security Robots – now with the option of Private LTE – book a discovery call or demonstration now at www.knightscope.com/discover.

 

About Knightscope

Knightscope is an advanced public safety technology company that builds fully autonomous security robots and blue light emergency communications systems that help protect the places people live, work, study and visit. Knightscope’s long-term ambition is to make the United States of America the safest country in the world. Learn more about us at www.knightscope.com. Follow Knightscope on Facebook, X (formerly Twitter), LinkedIn and Instagram.

 

Forward-Looking Statements

This press release may contain “forward-looking statements” about Knightscope’s future expectations, plans, outlook, projections and prospects. Such forward-looking statements can be identified by the use of words such as “should,” “may,” “intends,” “anticipates,” “believes,” “estimates,” “projects,” “forecasts,” “expects,” “plans,” “proposes” and similar expressions. Forward-looking statements contained in this press release and other communications include, but are not limited to, statements about the Company’s profitability and growth. Although Knightscope believes that the expectations reflected in these forward-looking statements are based on reasonable assumptions, there are a number of risks and uncertainties that could cause actual results to differ materially from such forward-looking statements. These risks and uncertainties include, among other things, the risk that the restructuring costs and charges may be greater than anticipated; the risk that the Company’s restructuring efforts may adversely affect the Company’s internal programs and the Company’s ability to recruit and retain skilled and motivated personnel, and may be distracting to employees and management; the risk that the Company’s restructuring efforts may negatively impact the Company’s business operations and reputation with or ability to serve customers; the risk that the Company’s restructuring efforts may not generate their intended benefits to the extent or as quickly as anticipated. Readers are urged to carefully review and consider any cautionary statements and other disclosures, including the statements made under the heading “Risk Factors” in Knightscope’s Annual Report on Form 10-K for the year ended December 31, 2022. Forward-looking statements speak only as of the date of the document in which they are contained, and Knightscope does not undertake any duty to update any forward-looking statements, except as may be required by law.

Contacts

Stacy Stephens
Knightscope, Inc.
(650) 924-1025

Categories
Business Digital - AI & Apps Regulations & Security Science Technology

GitGuardian: Nearly 3K of the 450K projects submitted to PyPI exposed at least one credential in code, like API keys, including some from ‘very large companies’

—  Many transgressions come from “very large companies that have robust security teams.”

 

 

Dan Goodin / Ars Technica:

 

Despite more than a decade of reminding, prodding, and downright nagging, a surprising number of developers still can’t bring themselves to keep their code free of credentials that provide the keys to their kingdoms, to anyone who takes the time to look for them.

 

The lapse stems from immature coding practices in which developers embed cryptographic keys, security tokens, passwords, and other forms of credentials directly into the source code they write. The credentials make it easy for the underlying program to access databases or cloud services necessary for it to work as intended. I published one such PSA in 2013 after discovering simple searches that turned up dozens of accounts that appeared to expose credentials securing computer-to-server SSH accounts. One of the credentials appeared to grant access to an account on Chromium.org, the repository that stores the source code for Google’s open source browser.

 

In 2015, Uber learned the hard way just how damaging the practice can be. One or more developers for the ride service had embedded a unique security key into code and then shared that code on a public GitHub page. Hackers then copied the key and used it to access an internal Uber database and, from there, steal sensitive data belonging to 50,000 Uber drivers.

 

The credentials exposed provided access to a range of resources, including Microsoft Active Directory servers that provision and manage accounts in enterprise networks, OAuth servers allowing single sign-on, SSH servers, and third-party services for customer communications and cryptocurrencies. Examples included:

  • Azure Active Directory API Keys
  • GitHub OAuth App Keys
  • Database credentials for providers such as MongoDB, MySQL, and PostgreSQL
  • Dropbox Key
  • Auth0 Keys
  • SSH Credentials
  • Coinbase Credentials
  • Twilio Master Credentials.

 

Also included in the haul were API keys for interacting with various Google Cloud services, database credentials, and tokens controlling Telegram bots, which automate processes on the messenger service. This week’s report said that exposures in all three categories have steadily increased in the past year or two.

 

The secrets were exposed in various types of files published to PyPI. They included primary .py files, README files, and test folders.

Enlarge / Most common types of files other than .py containing a hardcoded secret in PyPI packages.

 

GitGuardian tested the exposed credentials and found that 768 remained active. The risk, however, can extend well beyond that smaller number. GitGuardian explained:

 

It is important to note that just because a credential can not be validated does not mean it should be considered invalid. Only once a secret has been properly rotated can you know if it is invalid. Some types of secrets GitGuardian is still working toward automatically validating include Hashicorp Vault Tokens, Splunk Authentication Tokens, Kubernetes Cluster Credentials, and Okta Tokens.

 

There are no good reasons to expose credentials in code. The report said the most common cause is by accident.

 

“In the course of outreach for this project, we discovered at least 15 incidents where the publisher was unaware they had made their project public,” the authors wrote. “Without naming any names, we did want to mention some of these were from very large companies that have robust security teams. Accidents can happen to anyone.”

 

Over the past decade, various mechanisms have become available for allowing code to securely access databases and cloud resources. One is .env files that are stored in private environments outside of the publicly available code repository. Others are tools such as the AWS Secrets Manager, Google Cloud’s Secret Manager, or the Azure Key Vault. Developers can also employ scanners that check code for credentials inadvertently included.

 

The study examined PyPI, which is just one of many open source repositories. In years past, code hosted in other repositories such as NPM and RubyGems has also been rife with credential exposure, and there’s no reason to suspect the practice doesn’t continue in them now.

 

 

Techmeme

Categories
Business Culture Digital - AI & Apps International & World Lifestyle Perspectives Regulations & Security Science Technology

Companies that provide Microsoft, Google, and others with AI data-labeling services often hire minors, which can be traumatic

 

Niamh Rowe / Wired:

 

 

Like most kids his age, 15-year-old Hassan spent a lot of time online. Before the pandemic, he liked playing football with local kids in his hometown of Burewala in the Punjab region of Pakistan. But Covid lockdowns made him something of a recluse, attached to his mobile phone.

 

“I just got out of my room when I had to eat something,” says Hassan, now 18, who asked to be identified under a pseudonym because he was afraid of legal action.

 

But unlike most teenagers, he wasn’t scrolling TikTok or gaming. From his childhood bedroom, the high schooler was working in the global artificial intelligence supply chain, uploading and labeling data to train algorithms for some of the world’s largest AI companies.

 

The raw data used to train machine-learning algorithms is first labeled by humans, and human verification is also needed to evaluate their accuracy. This data-labeling ranges from the simple—identifying images of street lamps, say, or comparing similar ecommerce products—to the deeply complex, such as content moderation, where workers classify harmful content within data scraped from all corners of the internet. These tasks are often outsourced to gig workers, via online crowdsourcing platforms such as Toloka, which was where Hassan started his career.

 

A friend put him on to the site, which promised work anytime, from anywhere. He found that an hour’s labor would earn him around $1 to $2, he says, more than the national minimum wage, which was about $0.26 at the time. His mother is a homemaker, and his dad is a mechanical laborer.

 

“You can say I belong to a poor family,” he says.

 

When the pandemic hit, he needed work more than ever. Confined to his home, online and restless, he did some digging, and found that Toloka was just the tip of the iceberg.

“AI is presented as a magical box that can do everything,” says Saiph Savage, director of Northeastern University’s Civic AI Lab.

 

“People just simply don’t know that there are human workers behind the scenes.”

 

At least some of those human workers are children. Platforms require that workers be over 18, but Hassan simply entered a relative’s details and used a corresponding payment method to bypass the checks—and he wasn’t alone in doing so. WIRED spoke to three other workers in Pakistan and Kenya who said they had also joined platforms as minors, and found evidence that the practice is widespread.

“When I was still in secondary school, so many teens discussed online jobs and how they joined using their parents’ ID,” says one worker who joined Appen at 16 in Kenya, who asked to remain anonymous.

 

After school, he and his friends would log on to complete annotation tasks late into the night, often for eight hours or more.

 

Read more here:

Companies that provide Microsoft, Google, and others with AI data-labeling services are inadvertently hiring minors, often exposing them to traumatic content

 

 

 

Techmeme

Categories
Business International & World News Now! Regulations & Security Science Technology

An in-depth look at a covert Russian operation to get dual-use specialist microchips, which are protected by EU export controls, into the hands of the state

—  A rare look inside a covert Russian-led operation to get strategic technology protected by European export controls into the hands of the state

 

 

Financial Times:

 

As their yacht bobbed on the Mediterranean in July 2021, Marc Rocchi snapped a picture of the slightly doughy Russian man in baggy swimming trunks, dozing with his head propped against the helm. The French businessman would later say that he only knew the Russian by his first name, Maxim.

 

But he knew the purchases Maxim had been making for years had been essential to the survival of Ommic, a French microchip manufacturer of which Rocchi was then director-general.  Desperate to keep the flow of chips moving, just a few months earlier Rocchi had flown to Greece to hand-deliver Maxim a shipment of 230 microchips — €45,000 worth. Maxim had, at one point, offered Rocchi “cash and women.” But Rocchi said he declined — he needed Maxim’s business to keep Ommic afloat.

 

Rocchi always knew his business partner was buying microchips on behalf of a Russian state enterprise, and that Maxim used a network of intermediaries to get them out of France and into Russia. And he also knew Maxim was working on behalf of Istok, which Rocchi described as a state research body. Istok is in fact a state-owned technology company that makes electronic warfare systems for the Russian military.

 

Today, Ommic has closed and Rocchi is awaiting trial in France, having been indicted in March. He denies charges of sending secrets to a foreign power that could harm the national interest, exporting dual-use goods to Russia, and submitting false documents.  According to sources familiar with the investigation, Rocchi has previously argued to police that the goods and information sent by Ommic were not subject to controls, disputed that sensitive information was ever sent abroad and said that other people were responsible for any false documents. He has declined to comment to the Financial Times.

 

The photograph was a rare slip in what appears to be a decades-long Russian intelligence operation. The man pictured, Maxim Ermakov, has been sanctioned by the US and UK governments in the past fortnight as part of a major crackdown on the networks that Moscow’s intelligence services use to procure advanced western technology for President Vladimir Putin’s war machine. He did not respond to a request to comment. This rare account of the activities of such a network illustrates how difficult it is for western governments to tackle Russian state smuggling operations, and prevent western technology from being used by Russian industry and the military.

 

Specialist microchips, such as the high-performance gallium nitride and gallium arsenide-integrated circuit boards that Ommic made, are vital to Russian defence manufacturers such as Istok. According to Le Parisien, a senior French defence official told investigators that the chips were a “sensitive, strategic technology”

 

Marc Rocchi being interviewed at a convention in China in 2018 © YouTube
Eoin Sugrue, left, and his brother Denis, in Limerick, Ireland, in 1983. Both brothers have links to Maxim Ermakov © public domain sourced / access rights from WS Collection / Alamy Stock Photo

 

 

Read more here:

An in-depth look at a covert Russian operation to get dual-use specialist microchips, which are protected by EU export controls, into the hands of the state

 

 

 

Techmeme