Author name: Shannon Garcia

apple-vision-pro’s-content-drought-improves-with-new-3d-videos

Apple Vision Pro’s content drought improves with new 3D videos

Apple, Apple TV, culture, Immersive Video, Mixed Reality, Tech, virtual reality, vision pro, visionOS / /

Immersive Video —

It’s still not the weekly cadence we expected, but it’s something.

–

  • Boundless premieres tonight, taking Vision Pro users on a hot air balloon ride in Turkey.

  • Submerged will be Apple’s first fictional short film for Vision Pro.

  • Users will get a glimpse into the 2024 NBA All-Star Weekend.

  • This cryptic image teases The Weeknd’s Vision Pro “experience.”

  • The new series Elevated will tour places of interest around the world from above.

  • Apple is partnering with Red Bull for a surfing documentary.

  • Wild Life returns with an episode about elephants in a wildlife preserve.

Today, Apple announced a slate of more than a dozen upcoming Immersive Videos for its Vision Pro spatial reality headset. The first, titled Boundless, launches tonight at 9 pm ET. More will follow in the coming weeks and months.

The announcement follows a long, slow period for new Vision Pro-specific video content from Apple. The headset launched in early February with a handful of Immersive Video episodes ranging from five to 15 minutes each. Since then, only three new videos have been added.

On March 28, Apple released a highlight reel of Major League Soccer plays from the season that had ended months prior. A second episode of Prehistoric Planet, Apple’s Immersive Video dinosaur nature documentary, went live on April 19. Likewise, a new episode of the Adventure series titled “Parkour” landed on May 24.

The MLS video played more like a short ad for Apple’s MLS programming than anything else, but other Immersive Videos have impressed with their quality if not their creative ambition. They’re all short videos that put the viewer inside a moment in space and time with either animals or people doing their thing. The videos are high-resolution, and the 3D is generally well done. The production values are high, even if the narratives are light. They come across as tech demos, as much as anything, but they are impressive.

Tonight’s Boundless episode will allow viewers to see what it’s like to ride in a hot air balloon over sweeping vistas. Another episode titled “Arctic Surfing” will arrive this fall, Apple says. Sometime next month, Apple will publish the second episode of its real wildlife documentary, simply titled Wild Life. The episode will focus on elephants in Kenya’s Sheldrick Wildlife Trust. Another episode is in the works, too. “Later this year,” Apple writes in its newsroom post, “viewers will brave the deep with a bold group of divers in the Bahamas, who come face-to-face with apex predators and discover creatures much more complex than often portrayed.”

More on the way

In September, we’ll see the debut of a new Immersive Video series titled Elevated. Apple describes it as an “aerial travel series” in which viewers will fly over places of interest. The first episode will take viewers to Hawaii, while another planned for later this year will go to New England.

Apple is additionally partnering with Red Bull for a look at surfing called Red Bull: Big-Wave Surfing.

In addition to those documentary episodes, there will be three short films by year’s end. One will be a musical experience featuring The Weeknd, and another will take basketball fans inside the 2024 NBA All-Star Weekend. There will also be Submerged, the first narrative fictional Immersive Video on the platform. It’s an action short film depicting struggles on a submarine during World War II.

It’s good to see Apple finally making some movement here; the drought of content after the launch didn’t inspire confidence in the platform. Many people with mixed reality headsets use them a bunch for a few weeks but either fail to find ways to fit them into their daily habits or run out of compelling content and taper off before long. To keep people invested in visionOS, Apple needs to keep a rapid cadence of new content that users look forward to at least every week. Otherwise, some users will see their headsets sit on shelves, forgotten.

When I reviewed the Vision Pro, I assumed that the Immersive Video episodes would roll out weekly. That hasn’t proven the case, and it still doesn’t look like it will. Apple is going to have to invest more in content (and take more risks with that content, moving beyond short tech demo documentaries) to make the Vision Pro stick with customers.

Listing image by Apple

Apple Vision Pro’s content drought improves with new 3D videos Read More »

netflix-is-kicking-us-subscribers-off-its-cheapest-ad-free-plan-soon

Netflix is kicking US subscribers off its cheapest ad-free plan soon

ads, netflix, streaming, Tech / /

It was only a matter of time —

Subscribers will have to pay $15.49 for commercial-free Netflix.

–

cobra kai

Enlarge / Ad-free Basic subscribers will be crane-kicked off the plan soon.

Netflix/YouTube

Netflix today confirmed suspicions that it will stop letting people pay $12 per month to stream without commercials.

The ad-free Basic plan was the cheapest way to watch Netflix without commercials. The plan limits users to 720p resolution and one device and lets people download content. Netflix stopped offering the Basic plan to new subscribers in January. In June, Netflix started booting subscribers in the UK and Canada off the plan and automatically put them onto a cheaper subscription plan with ads.

In a letter to shareholders today [PDF], Netflix confirmed publicly for the first time that it “will now start” to phase out the ad-free Basic plan in the US and France. This will make the cheapest commercial-free Netflix plan $15.49/month in the US. That Standard plan supports up to two devices, downloads, and 1080p resolution.

Netflix thinks killing the Basic plan will help it gain more subscribers who watch commercials, which, on average, generates more revenue for the company.

As expected from a streaming company these days, Netflix touted its ad tier to shareholders, noting that the $7 tier now represents “over 45 percent” of new sign-ups in areas where it’s sold. Per Netflix’s letter, ads will only be an increasingly larger part of its strategy, as Netflix aims to “achieve critical ad subscriber scale for advertisers in our ad countries in 2025, creating a strong base from which we can further increase our ad membership in 2026 and beyond.”

The news comes as streamers grapple with increasing streaming subscription costs. Netflix most recently hiked pricing in October. In January, the company suggested to shareholders that more price hikes were possible, saying that it would “occasionally ask our members to pay a little extra to reflect” platform improvements.

Not cozying up with competition

If today’s news makes you hope for a convenient streaming-only deal that lets you subscribe to Netflix and another video streaming service for cheaper, you’re out of luck. Netflix today said it’s not interested in streaming-only bundles.

Bundle deals, which combine streaming and other services for a cheaper subscription rate, have become the streaming industry’s answer to high cancellation rates among subscribers, including those who quickly cancel and resubscribe depending on what’s available to stream that month.

In its letter, Netflix noted that although cable or mobile providers or device-makers may offer deals combining Netflix and another streaming service, Netflix does not make deals that bundle it with another rival streamer, like Disney+ or Max. The company claimed that Netflix is already “a go-to destination,” which “limits the benefit to Netflix of bundling directly with other streamers.”

That means if you’re hoping to save money on your Netflix subscription, which keeps getting more expensive, the only options are to watch Netflix with commercials or get a cable-reminiscent bundle that includes a different kind of service, like Comcast or Verizon Wireless.

We know which option Netflix would like you to pick. But for frustrated streamers, finding a reasonable way to watch all the stuff you want online the way you want keeps getting harder.

Netflix added 8 million subscribers in Q2 2024, it said today. It’s still the biggest video streaming service by subscriber count at 278 million. Amazon Prime Video, which claimed “over 200 million” users in April, follows.

Netflix is kicking US subscribers off its cheapest ad-free plan soon Read More »

Navigating the CrowdStrike Outage: Insights from a Tech Industry Veteran

Navigating / /

As a seasoned CIO/CISO and tech industry analyst with 35 years of experience, I’ve seen my fair share of cybersecurity incidents. However, the recent CrowdStrike outage stands out due to its extensive impact across multiple sectors. Here’s a deep dive into what happened, the repercussions, and the lessons we can all learn from this incident.

Background and Initial Reaction

I started my journey in IT in the late ’80s when I wrote a piece of software called PleadPerfect. Over the years, I’ve worn many hats—engineer, architect, and executive at both large and small companies. For the last 18 years, I’ve been a CIO/CISO for organizations ranging from 8-11 figures in revenue.

When I first heard about the CrowdStrike-related outage, my initial reaction was one of deep concern. I took a moment of silence in honor of the lost hours my peers and fellow IT pros sacrificed with their families to fix a problem that should never have occurred. The lack of good QA practices shown by CrowdStrike is deeply upsetting. They should have caught this issue in testing before releasing it to the public. The fact that it affected every Windows OS since 2008 is inexcusable.

Understanding the Incident

CrowdStrike’s Falcon software is installed at the core of the OS, which is how it protects machines so effectively. However, this tight integration also causes significant problems when updates are not properly tested. The faulty update led to widespread instances of the “Blue Screen of Death” (BSOD), causing machines to crash and not automatically recover. The recovery process involved booting machines in safe mode and deleting a CrowdStrike file—a task complicated by the inability to remotely enter safe mode on every device/OS. Additionally, best practices dictate securing the boot drive with BitLocker, which requires a key to unlock and enter safe mode. These keys are often stored in systems also affected by this flaw, greatly increasing the effort and time required for recovery.

Such incidents are not uncommon in the cybersecurity industry, but this one is particularly damaging because it stems from a QA and testing issue, not a cybersecurity breach. The tight integration between Falcon and the OS made the damage far more widespread and the recovery process far more onerous.

Impact on Businesses and Services

All sectors and industries were affected, but critical infrastructure sectors were hit the hardest. Transportation (airlines), banking/financial services, and healthcare (hospitals and emergency rooms) pose the most risk to world economies when disrupted. The three biggest US airlines, as well as those around the world, experienced grounded flights and communication issues. Banks in many countries went offline, and hospital networks faced significant disruptions.

Response and Resolution

CrowdStrike’s response to the incident was swift, but I am not sure what more they can do at this point. I did not feel George Kurtz’s (the CEO) apology was “full-throated” and took sufficient responsibility for the incident. This is nobody else’s fault but CrowdStrike’s. While they have committed to helping everyone affected, they have 24,000 customers, all of whom are impacted, so they cannot give each the attention they need. Billions of dollars in damage are being done to those companies from this outage.

Lessons Learned

The key lessons from this incident are clear: Be careful where you place your trust in other companies and partners. Ensure your contracts allow you to seek damages, as that may be the only recourse in such situations. Have a comprehensive disaster recovery (DR) plan and test it regularly. The number of companies having to rebuild their backup infrastructure just to restore systems because they cannot access (or do not have) their BitLocker keys is far too great.

To better prepare for and prevent similar issues, develop and thoroughly test your recovery plans. Consider using a completely different set of security tools for backup and recovery to avoid similar attack vectors. Treat backup and recovery infrastructure as a critical business function and harden it as much as possible.

Future of Cybersecurity

Time will tell how this incident influences future cybersecurity practices and policies. Between the SolarWinds and CrowdStrike issues, both being failures of best practices by the companies themselves, something has to change.

Emerging technologies like AI and machine learning could help predict and prevent similar issues by identifying potential vulnerabilities before they become problems. However, the real fix may lie in revamping processes and possibly having independent bodies audit and certify the practices of technology companies.

Personal Insights

As someone deeply involved in the tech industry, I stay updated with the latest cybersecurity trends and threats by reading extensively, following industry developments, consuming relevant content, talking to peers, and moving out of my silo to share and learn from others.

My advice to fellow CIOs and CISOs is simple: Plan for the worst and test for the worst. If you fail to prepare for these kinds of incidents, you will be in the worst possible position when the board asks for your response.

Final Thoughts

The recent CrowdStrike outage was a wake-up call for many in the tech industry. It highlighted the vulnerabilities inherent in our interconnected world and underscored the need for robust cybersecurity measures. By learning from this incident and implementing the lessons outlined above, we can better prepare for and prevent similar issues in the future.

Stay vigilant, stay prepared, and let’s continue to fortify our defenses against the ever-evolving landscape of cybersecurity threats.

Navigating the CrowdStrike Outage: Insights from a Tech Industry Veteran Read More »

illegal-drug-found-in-diamond-shruumz-candies-linked-to-severe-illnesses

Illegal drug found in Diamond Shruumz candies linked to severe illnesses

diamond shruumz, hallucinogenic, health, muscimol, Mushroom, poison, psilocin, psilocybin, psychedelics, Science / /

More drugs —

New testing finds psilocin, related to psilocybin, in gummies purchased in 2023.

–

Illegal drug found in Diamond Shruumz candies linked to severe illnesses

Newly released testing data of Diamond Shruumz-brand gummies purchased in 2023 identified the presence of psilocin, a hallucinogenic drug closely related to the magic-mushroom drug psilocybin that is classified as a Schedule I drug, alongside psilocybin, heroin, and LSD.

The finding comes as Diamond Shruumz’s current line of gummies, chocolates, and candy cones is being recalled and are under active investigation in connection to a nationwide rash of severe illnesses, which have involved seizures, intubation, and intensive care. As of the latest update on July 15, 69 people in 28 states have been sickened after eating a Diamond Shruumz product. Sixty of the 69 sought medical care, 36 were hospitalized, and there is one potentially associated death under investigation.

The new finding of psilocin in the products, published by researchers at the University of Virginia, adds to growing concern about psychedelic mushroom candies generally. Although the candies are marketed as being legal, they have often been found to contain various undisclosed illegal drugs, gray market synthetic versions of drugs, as well as dangerous adulterants and contaminants.

In the ongoing investigation of Diamond Shruumz candies—led by the Food and Drug Administration and the Centers for Disease Control and Prevention, with the help of America’s Poison Centers and state and local partners—researchers have not identified psilocin in products linked to the illnesses. Instead, they have found a closely related synthetic hallucinogenic compound called 4-acetoxy-N,N-dimethyltryptamine, also known as psilacetin or 4-AcO-DMT. Psilacetin is thought to be metabolized into psilocin in the body and is said to have similar effects as taking magic mushrooms or psilocybin. The different testing results between the FDA-led investigation and the new UVA study may be due to possible formulation changes between 2023 and 2024 or simply differences in the products or batches of candies tested so far.

The UVA researchers, who published their findings in the CDC’s Morbidity and Mortality Weekly Report, looked into the mushroom candies after four adults reported illnesses to a local poison control center between September and November 2023. The people went to the emergency department with tachycardia, confusion, anxiety or somnolence, and nausea after eating gummy candies labeled as containing Amanita muscaria mushrooms. Amid their investigation into those cases, a 3-year-old also fell ill in June 2024 after accidentally eating two gummies sold as containing A. muscaria. All of the adults and the toddler recovered from their illnesses quickly, though the toddler was hospitalized for a day for observation.

Not legal or safe

A. muscaria is a legal hallucinogenic mushroom that contains psychoactive compounds ibotenic acid and muscimol. These resemble neurotransmitters in the brain and can cause gastrointestinal symptoms, agitation, and seizures.

The UVA researchers couldn’t track down the specific brands or products the sickened adults took, but they collected six similar products from nearby gas stations and smoke shops. Those six products included two Diamond Shruumz products, which were not sold as containing A. muscaria. Using liquid chromatography-mass spectrometry, the researchers found that the two Diamond Shruumz gummy products (Sour Peach Apple and Rainbow flavors) contained psilocin. The Rainbow flavor also contained caffeine.

In addition, a product labeled as “Wonderland Legal Psychedelics Cherry Nirvana” contained psilocin, the synthetic hallucinogen N,N-dimethyltryptamine, a compound found in kratom called mitragynine, and caffeine.  A product labeled as “Urb Magic Amanita Mushroom Watermelon” contained psilocybin, psilocin, and the stimulant 2-phenethylamine. A product called “Psilly’s Legal Psychedelic Mushrooms Fruit Punch” contained the stimulant ephedrine, and the product “Tryp mushroom gummies” wasn’t found to contain any concerning compounds.

The UVA study was not able to test for ibotenic acid or muscimol. In Diamond Shruumz’s recall notice, the company said it had found higher than normal levels of muscimol in its products. FDA testing has not identified muscimol in product testing, according to results released so far.

“People tend to equate ‘legal’ with ‘safe,’ which is not necessarily the case. These products are not regulated and can contain any number of unlabeled substances which, when consumed, can cause undesired symptoms,” lead author of the UVA study Avery Michienzi said in a statement. “Some packages will have QR codes showing that the products were tested in a lab and contain only what they are labeled to contain. These have been found to be inaccurate.”

The FDA this week warned that even though all of Diamond Shruumz’s products have been recalled, they remain on the shelves of stores nationwide. The agency said it is reaching out to industry partners to raise awareness of the recall and monitoring the effectiveness of Diamond Shruumz’s recall efforts.

Illegal drug found in Diamond Shruumz candies linked to severe illnesses Read More »

formula-e-wraps-its-10th-season-this-weekend—what’s-next-for-the-sport?

Formula E wraps its 10th season this weekend—what’s next for the sport?

Cars, Formula E / /

gen3 eco sounds good —

Team bosses and Formula E’s CEO tell us what has worked and where things go next.

–

Antonio Felix da Costa, TAG Heuer Porsche Formula E Team, Porsche 99X Electric Gen3

Enlarge / Antonio Felix da Costa leads the way into turn one at Portland International Raceway.

Sam Bagnall/Formula E

PORTLAND, Ore.—Formula E wraps up its 10th series with a pair of races in London this weekend. It’s been a competitive manufacturer’s championship between Porsche and Jaguar. This weekend, seven drivers are still in contention to win the driver’s title after a double-header in Portland on June 29-30 that saw cars going five-wide down the main straight as they reached the highest top speeds of the season. It was the second visit by Formula E to the picturesque Portland International Raceway, and Ars spoke with some of the sport’s bigwigs to see what they think it’s getting right and where the technical evolution of the cars is headed.

Formula E has come a long way since 2014. Racing then exclusively in city centers, the cars were slow at first. And even as they developed, they carried too small a battery to complete even a relatively short race distance. There was a big upgrade in 2018 with the start of season five: The Gen2 car now has battery packs sufficient for 45 minutes-plus-a-lap races. The Gen2 car raced well, too, even putting on a better show at Monaco than Formula 1 has been able to muster for decades.

We expected another big improvement in lap times when the Gen3 car arrived at the start of last season. The Gen3 car featured much less weight and much more power, but also a change of tire supplier. Originally meant to last multiple race weekends, the rubber supplied by Hankook this season and last has much less grip than the Michelins it replaced. That’s kept cornering speeds relatively low and made the cars even harder to drive.

There are no bad drivers in Formula E, but the cars are hard to handle.

Enlarge / There are no bad drivers in Formula E, but the cars are hard to handle.

Sam Bagnall/Getty Images.

That is not necessarily a bad thing, as the series has always written the rules to make things hard on the drivers and teams. For example, while the battery packs are larger now, they still don’t actually have quite enough charge to complete a race distance without careful energy management. But while the race officials get data-rich telemetry streams from all the cars during a race, the teams have to rely on each driver keeping tabs on their own state of charge and reporting that back via radio to the engineers in the garage so the boffins can calculate the optimal strategy.

More technical changes are in store. In 2025 and 2026, the series will move to the Gen3 Evo car, which will have on-demand all-wheel drive and more grip from better tires, among other tweaks. Meanwhile, everyone in Formula E has been thinking hard about Gen4, which is due to arrive for season 13.

What has worked?

I asked Formula E CEO Jeff Dodds, as well as some of the team principals, to start off by blowing their own horns a bit—what’s Formula E been doing right? “We’ve just announced our Gen3 Evo car, which gets to 60 miles an hour in 1.8 seconds, and we’re still an infancy business, only 10 years old, still playing around with early tech. So I think over time, a massive strength of ours is how that technology allows performance of the car to improve,” Dodds said.

At Portland, we saw pack racing down the main straight.

Enlarge / At Portland, we saw pack racing down the main straight.

Simon Galloway/Formula E

McLaren team principal Ian James, who previously led Mercedes to a Formula E championship before it quit the sport, was proud of how far Formula E has come over the last decade. “Gen2 really saw a step forward in that respect and a professionalization of the whole series. I think with Gen3 we’re really starting to unlock the performance potential of electric motorsport. And we’re going to see that take another notch up in Gen3 Evo,” James said.

Existing as a relevant arena for electric vehicle R&D is Formula E’s big strength, according to Nissan team principal Tommaso Volpe. “Representing a big car manufacturer in the sport I think the main strength is how relevant it is for a big transformation that is happening in mobility… using electrification as a key technology,” Volpe said. This is something that the motorsports cannot claim. They have other strengths, but they can not claim to be that relevant, purely speaking from the R&D perspective,” Volpe said.

For a company like Nissan, the primary benefit is still getting its EV tech in front of eyeballs, something Formula E’s deal to stream races live over Roku has no doubt helped. But there are other benefits to participation. “You cannot use the same motor, but the efforts that we put in place when we develop a Formula E car, in maximizing the energy efficiency of the hardware—so the materials we use, the solutions, the design—is something that is absolutely relevant for the core business and you can transfer some of these ideas and experience,” Volpe said.

Formula E wraps its 10th season this weekend—what’s next for the sport? Read More »

crowdstrike-fixes-start-at-“reboot-up-to-15-times”-and-get-more-complex-from-there

CrowdStrike fixes start at “reboot up to 15 times” and get more complex from there

azure, Biz & IT, BSOD, Crowdstrike, microsoft, microsoft azure, Tech / /

turning it off and back on again, and again, and again —

Admins can also restore backups or manually delete CrowdStrike’s buggy driver.

–

CrowdStrike fixes start at “reboot up to 15 times” and get more complex from there

Airlines, payment processors, 911 call centers, TV networks, and other businesses have been scrambling this morning after a buggy update to CrowdStrike’s Falcon security software caused Windows-based systems to crash with a dreaded blue screen of death (BSOD) error message.

We’re updating our story about the outage with new details as we have them. Microsoft and CrowdStrike both say that “the affected update has been pulled,” so what’s most important for IT admins in the short term is getting their systems back up and running again. According to guidance from Microsoft, fixes range from annoying but easy to incredibly time-consuming and complex, depending on the number of systems you have to fix and the way your systems are configured.

Microsoft’s Azure status page outlines several fixes. The first and easiest is simply to try to reboot affected machines over and over, which gives affected machines multiple chances to try to grab CrowdStrike’s non-broken update before the bad driver can cause the BSOD. Microsoft says that some of its customers have had to reboot their systems as many as 15 times to pull down the update.

Early guidance for fixing the CrowdStrike bug is simply to reboot systems over and over again so that they can try to grab a non-broken update.

Enlarge / Early guidance for fixing the CrowdStrike bug is simply to reboot systems over and over again so that they can try to grab a non-broken update.

Microsoft

If rebooting doesn’t work

If rebooting multiple times isn’t fixing your problem, Microsoft recommends restoring your systems using a backup from before 4: 09 UTC on July 18 (just after midnight on Friday, Eastern time), when CrowdStrike began pushing out the buggy update. Crowdstrike says a reverted version of the file was deployed at 5: 27 UTC.

If these simpler fixes don’t work, you may need to boot your machines into Safe Mode so you can manually delete the file that’s causing the BSOD errors. For virtual machines, Microsoft recommends attaching the virtual disk to a known-working repair VM so the file can be deleted, then reattaching the virtual disk to its original VM.

The file in question is a CrowdStrike driver located at Windows/System32/Drivers/CrowdStrike/C-00000291*.sys. Once it’s gone, the machine should boot normally and grab a non-broken version of the driver.

Deleting that file on each and every one of your affected systems individually is time-consuming enough, but it’s even more time-consuming for customers using Microsoft’s BitLocker drive encryption to protect data at rest. Before you can delete the file on those systems, you’ll need the recovery key that unlocks those encrypted disks and makes them readable (normally, this process is invisible, because the system can just read the key stored in a physical or virtual TPM module).

This can cause problems for admins who aren’t using key management to store their recovery keys, since (by design!) you can’t access a drive without its recovery key. If you don’t have that key, Cryptography and infrastructure engineer Tony Arcieri on Mastodon compared this to a “self-inflicted ransomware attack,” where an attacker encrypts the disks on your systems and withholds the key until they get paid.

And even if you do have a recovery key, your key management server might also be affected by the CrowdStrike bug.

We’ll continue to track recommendations from Microsoft and CrowdStrike about fixes as each company’s respective status pages are updated.

“We understand the gravity of the situation and are deeply sorry for the inconvenience and disruption,” wrote CrowdStrike CEO George Kurtz on X, formerly Twitter. “We are working with all impacted customers to ensure that systems are back up and they can deliver the services their customers are counting on.”

CrowdStrike fixes start at “reboot up to 15 times” and get more complex from there Read More »

major-outages-at-crowdstrike,-microsoft-leave-the-world-with-bsods-and-confusion

Major outages at CrowdStrike, Microsoft leave the world with BSODs and confusion

airlines, Biz & IT, Crowdstrike, Cybersecurity, falcon sensor, global outage, microsoft, microsoft azure, Security / /

Y2K24 —

Nobody’s sure who’s at fault for each outage: Microsoft, CrowdStrike, or both.

–

A passenger sits on the floor as long queues form at the check-in counters at Ninoy Aquino International Airport, on July 19, 2024 in Manila, Philippines.

Enlarge / A passenger sits on the floor as long queues form at the check-in counters at Ninoy Aquino International Airport, on July 19, 2024 in Manila, Philippines.

Ezra Acayan/Getty Images

Millions of people outside the IT industry are learning what CrowdStrike is today, and that’s a real bad thing. Meanwhile, Microsoft is also catching blame for global network outages, and between the two, it’s unclear as of Friday morning just who caused what.

After cybersecurity firm CrowdStrike shipped an update to its Falcon Sensor software that protects mission-critical systems, blue screens of death (BSODs) started taking down Windows-based systems. The problems started in Australia and followed the dateline from there.

TV networks, 911 call centers, and even the Paris Olympics were affected. Banks and financial systems in India, South Africa, Thailand, and other countries fell as computers suddenly crashed. Some individual workers discovered that their work-issued laptops were booting to blue screens on Friday morning. The outages took down not only Starbucks mobile ordering, but also a single motel in Laramie, Wyoming.

Airlines, never the most agile of networks, were particularly hard-hit, with American Airlines, United, Delta, and Frontier among the US airlines overwhelmed Friday morning.

CrowdStrike CEO “deeply sorry”

Fixes suggested by both CrowdStrike and Microsoft for endlessly crashing Windows systems range from “reboot it up to 15 times” to individual driver deletions within detached virtual OS disks. The presence of BitLocker drive encryption on affected devices further complicates matters.

CrowdStrike CEO George Kurtz posted on X (formerly Twitter) at 5: 45 am Eastern time that the firm was working on “a defect found in a single content update for Windows hosts,” with Mac and Linux hosts unaffected. “This is not a security incident or cyberattack. The issue has been identified, isolated and a fix has been deployed,” Kurtz wrote. Kurtz told NBC’s Today Show Friday morning that CrowdStrike is “deeply sorry for the impact that we’ve caused to customers.”

As noted on Mastodon by LittleAlex, Kurtz was the Chief Technology Officer of security firm McAfee when, in April 2010, that firm sent an update that deleted a crucial Windows XP file that caused widespread outages and required system-by-system file repair.

The costs of such an outage will take some time to be known, and will be hard to measure. Cloud cost analyst CloudZero estimated mid-morning Friday that the CrowdStrike incident had already cost $24 billion, based on a previous estimate.

Multiple outages, unclear blame

Microsoft services were, in a seemingly terrible coincidence, also down overnight Thursday into Friday. Multiple Azure services went down Thursday evening, with the cause cited as “a backend cluster management workflow [that] deployed a configuration change causing backend access to be blocked between a subset of Azure Storage clusters and compute resources in the Central US region.”

A spokesperson for Microsoft told Ars in a statement Friday that the CrowdStrike update was not related to its July 18 Azure outage. “That issue has fully recovered,” the statement read.

News reporting on these outages has so far blamed either Microsoft, CrowdStrike, or an unclear mixture of the two as the responsible party for various outages. It may be unavoidable, given that the outages are all happening on one platform, Windows. Microsoft itself issued an “Awareness” regarding the CrowdStrike BSOD issue on virtual machines running Windows. The firm was frequently updating it Friday, with a fix that may or may not surprise IT veterans.

“We’ve received feedback from customers that several reboots (as many as 15 have been reported) may be required, but overall feedback is that reboots are an effective troubleshooting step at this stage,” Microsoft wrote in the bulletin. Alternately, Microsoft recommend customers that have a backup from “before 19: 00 UTC on the 18th of July” restore it, or attach the OS disk to a repair VM to then delete the file (Windows/System32/Drivers/CrowdStrike/C00000291*.sys) at the heart of the boot loop.

Security consultant Troy Hunt was quoted as describing the dual failures as “the largest IT outage in history,” saying, “basically what we were all worried about with Y2K, except it’s actually happened this time.”

United Airlines told Ars that it was “resuming some flights, but expect schedule disruptions to continue throughout Friday,” and had issued waivers for customers to change travel plans. American Airlines posted early Friday that it had re-established its operations by 5 am Eastern, but expected delays and cancellations throughout Friday.

Ars has reached out to CrowdStrike for comment and will update this post with response.

This is a developing story and this post will be updated as new information is available.

Major outages at CrowdStrike, Microsoft leave the world with BSODs and confusion Read More »

fcc-closes-“final-loopholes”-that-keep-prison-phone-prices-exorbitantly-high

FCC closes “final loopholes” that keep prison phone prices exorbitantly high

Policy, prison phone prices / /
A telephone on a wall inside a prison.

Enlarge / A telephone in a prison.

The Federal Communications Commission today voted to lower price caps on prison phone calls and closed a loophole that allowed prison telecoms to charge high rates for intrastate calls. Today’s vote will cut the price of interstate calls in half and set price caps on intrastate calls for the first time.

The FCC said it “voted to end exorbitant phone and video call rates that have burdened incarcerated people and their families for decades. Under the new rules, the cost of a 15-minute phone call will drop to $0.90 from as much as $11.35 in large jails and, in small jails, to $1.35 from $12.10.”

The new rules are expected to take effect in January 2025 for all prisons and for jails with at least 1,000 incarcerated people. The rate caps would take effect in smaller jails in April 2025.

Worth Rises, a nonprofit group advocating for prison reform, said it “estimates that the new rules will impact 83 percent of incarcerated people (about 1.4 million) and save impacted families at least $500 million annually.”

New power over intrastate calls

The FCC has taken numerous votes to lower prison phone rates over the years, but today’s is particularly significant. While the FCC was previously able to cap prices of interstate calls, an attempt to set prices for intrastate calls was struck down in court in 2017.

Prison phone companies could sue again. But the FCC said it now has authority over intrastate prison phone prices because of the Martha Wright-Reed Just and Reasonable Communications Act, which was approved by Congress and signed by President Biden in January 2023. The new law “empowered the FCC to close the final loopholes in the communications system,” the commission said.

The 2023 law—named for a grandmother who campaigned for lower prison phone rates—”removes the principal statutory limitations that had prevented the Commission from setting comprehensive just and reasonable rates,” the FCC said. Specifically, the law removed “limits to the Commission’s ability to regulate rates for intrastate calls and video communications.”

More than half of prison audio call traffic is intrastate, with the calling and called parties both in the same state, according to data in a draft of the FCC order released before the meeting.

The FCC’s work to reduce prison phone rates “was not always embraced by the courts,” Chairwoman Jessica Rosenworcel said today. “We were told—over and over again—that the commission did not have the authority to address every aspect of these rates, because while interstate calls fell within our jurisdiction, intrastate calls did not.”

Previously, the FCC imposed price caps on interstate calls ranging from $0.14 to $0.21 per minute for audio calls, depending on the size of the facility. Going forward, a uniform set of price caps ranging from $0.06 to $0.12 per minute will apply to both interstate and intrastate calls.

FCC closes “final loopholes” that keep prison phone prices exorbitantly high Read More »

the-next-nvidia-driver-makes-even-more-gpus-“open,”-in-a-specific,-quirky-way

The next Nvidia driver makes even more GPUs “open,” in a specific, quirky way

Biz & IT, CUDA, Linux, Linux kernel, NVIDIA, nvidia drivers, Open Source, Tech / /

You know open when you see it —

You can’t see inside the firmware, but more open code can translate it for you.

–

GeForce RTX 4060 cards on display in a case

Getty Images

You have to read the headline on Nvidia’s latest GPU announcement slowly, parsing each clause as it arrives.

“Nvidia transitions fully” sounds like real commitment, a burn-the-boats call. “Towards open-source GPU,” yes, evoking the company’s “first step” announcement a little over two years ago, so this must be progress, right? But, back up a word here, then finish: “GPU kernel modules.”

So, Nvidia has “achieved equivalent or better application performance with our open-source GPU kernel modules,” and added some new capabilities to them. And now most of Nvidia’s modern GPUs will default to using open source GPU kernel modules, starting with driver release R560, with dual GPL and MIT licensing. But Nvidia has moved most of its proprietary functions into a proprietary, closed-source firmware blob. The parts of Nvidia’s GPUs that interact with the broader Linux system are open, but the user-space drivers and firmware are none of your or the OSS community’s business.

Is it better than what existed before? Certainly. AMD and Intel have maintained open source GPU drivers, in both the kernel and user space, for years, though also with proprietary firmware. This brings Nvidia a bit closer to the Linux community and allows for community debugging and contribution. There’s no indication that Nvidia aims to go further with its open source moves, however, and its modules remain outside the main kernel, packaged up for users to install themselves.

Not all GPUs will be able to use the open source drivers: a number of chips from the Maxwell, Pascal, and Volta lines; GPUs from the Turing, Ampere, Ada Lovelace, and Hopper architectures are recommended to switch to the open bits; and Grace Hopper and Blackwell units must do so.

As noted by Hector Martin, a developer on the Asahi Linux distribution, at the time of the first announcement, this shift makes it easier to sandbox closed-source code while using Nvidia hardware. But the net amount of closed-off code is about the same as before.

Nvidia’s blog post has details on how to integrate its open kernel modules onto various systems, including CUDA setups.

The next Nvidia driver makes even more GPUs “open,” in a specific, quirky way Read More »

nintendo-world-championships:-nes-edition-gave-me-new-respect-for-gaming-speedrunners

Nintendo World Championships: NES Edition gave me new respect for gaming speedrunners

gaming, Nintendo, speedrunning / /
Get ready to repeat this ~25-second slice of <em>Mario</em> over and over… and over… and over.” src=”https://cdn.arstechnica.net/wp-content/uploads/2024/07/nwc3-800×450.png”></img><figcaption> <p><a data-height=Enlarge / Get ready to repeat this ~25-second slice of Mario over and over… and over… and over.

If you’ve ever seen a record-breaking video game speedrun or watched a Games Done Quick marathon, you may have entertained fantasies that you, too, could put up some decent times on your favorite old games. Sure, it would probably take a bit of practice, but what these speedrunners are doing doesn’t look that difficult, does it? How hard can it be to press a few buttons with good timing for a few minutes?

After spending a few weeks with Nintendo World Championships: NES Edition, I no longer think that way. The game’s bite-size chunks of classic Nintendo games highlight the level of precision needed for even a few minutes of speedrunning perfection, not to mention the tedium of practicing the same in-game motions dozens of times to build up the needed muscle memory. In the process, I gained a newfound respect for the skill displayed by the best speedrunners and found a fresh way to experience some classic NES games that I felt I knew backward and forward.

Gotta go fast

While Nintendo World Championships draws its name from a series of competitions dating back to 1990, it draws its inspiration much more directly from the more recent rise of the online speedrunning community. Thus, the game’s main single-player mode is named “Speedrun,” tasking players with putting up the fastest times in 150 mini-challenges spread across 13 different Nintendo-developed NES titles.

Really? Get the Morph Ball? That's all you want me to do here?

Enlarge / Really? Get the Morph Ball? That’s all you want me to do here?

Nintendo

The earliest of these many unlockable challenges seem almost insultingly easy on their face—collecting the first Super Mushroom in Super Mario Bros. or collecting the sword in The Legend of Zelda, for instance. When you first dive in, you may be more than a little bemused to find yourself showered with in-game rewards for spending just a few seconds completing such basic tasks.

But then you look at how much time that challenge took you—which is thrown up in huge numbers on the screen—alongside an even bigger letter grade. The “A” you got for collecting that Mushroom might seem pretty good, at first, but you know you could do better if you didn’t miss the item box with your first few jumps. So you quickly restart the challenge (and breathe deep through a helpful three-second countdown) and trim off half a second on your second attempt, earning an “A+” for your efforts.

If you are a certain type of player, you might say, “Alright, that’s good enough,” rather than repeating this cycle yet again (if so, I’d argue this game is not for you). But if you’re a different type of gamer, the mere knowledge that you could achieve an S rank with some combination of strategy and execution will propel you through entire minutes of repeated attempts, looking to optimize the perfect few seconds of button presses.

The fact that Nintendo doesn’t reveal the specific timing cutoffs for the different letter grades is equal parts frustrating and subtly encouraging, here. There were plenty of challenges where I felt I played as optimally as I could only to be greeted with a mere “A++” rank next to my new best time. The S rank’s mere existence often inspired me to redouble my efforts and look for new ways to trim even more time off my personal best.

Nintendo World Championships: NES Edition gave me new respect for gaming speedrunners Read More »

vulnerability-in-cisco-smart-software-manager-lets-attackers-change-any-user-password

Vulnerability in Cisco Smart Software Manager lets attackers change any user password

Biz & IT, Cisco, passwords, Security, vulnerabilities / /

GET YER PATCH —

Yep, passwords for administrators can be changed, too.

–

Vulnerability in Cisco Smart Software Manager lets attackers change any user password

Cisco on Wednesday disclosed a maximum-security vulnerability that allows remote threat actors with no authentication to change the password of any user, including those of administrators with accounts, on Cisco Smart Software Manager On-Prem devices.

The Cisco Smart Software Manager On-Prem resides inside the customer premises and provides a dashboard for managing licenses for all Cisco gear in use. It’s used by customers who can’t or don’t want to manage licenses in the cloud, as is more common.

In a bulletin, Cisco warns that the product contains a vulnerability that allows hackers to change any account’s password. The severity of the vulnerability, tracked as CVE-2024-20419, is rated 10, the maximum score.

“This vulnerability is due to improper implementation of the password-change process,” the Cisco bulletin stated. “An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.”

There are no workarounds available to mitigate the threat.

It’s unclear precisely what an attacker can do after gaining administrative control over the device. One possibility is that the web user interface and application programming interface the attacker gains administrative control over make it possible to pivot to other Cisco devices connected to the same network and, from there, steal data, encrypt files, or perform similar actions. Cisco representatives didn’t immediately respond to an email. This post will be updated if a response comes later.

A security update linked to the bulletin fixes the vulnerability. Cisco said it isn’t aware of any evidence that the vulnerability is being actively exploited.

Vulnerability in Cisco Smart Software Manager lets attackers change any user password Read More »

researchers-build-ultralight-drone-that-flies-with-onboard-solar

Researchers build ultralight drone that flies with onboard solar

drone, materials science, Physics, robotics, Science, solar power / /

Where does it go? It goes up! —

Bizarre design uses a solar-powered motor that’s optimized for weight.

–

Image of a metallic object composed from top to bottom of a propeller, a large cylinder with metallic panels, a stalk, and a flat slab with solar panels and electronics.

Enlarge / The CoulombFly doing its thing.

On Wednesday, researchers reported that they had developed a drone they’re calling the CoulombFly, which is capable of self-powered hovering for as long as the Sun is shining. The drone, which is shaped like no aerial vehicle you’ve ever seen before, combines solar cells, a voltage converter, and an electrostatic motor to drive a helicopter-like propeller—with all components having been optimized for a balance of efficiency and light weight.

Before people get excited about buying one, the list of caveats is extensive. There’s no onboard control hardware, and the drone isn’t capable of directed flight anyway, meaning it would drift on the breeze if ever set loose outdoors. Lots of the components appear quite fragile, as well. However, the design can be miniaturized, and the researchers built a version that weighs only 9 milligrams.

Built around a motor

One key to this development was the researchers’ recognition that most drones use electromagnetic motors, which involve lots of metal coils that add significant weight to any system. So, the team behind the work decided to focus on developing a lightweight electrostatic motor. These rely on charge attraction and repulsion to power the motor, as opposed to magnetic interactions.

The motor the researchers developed is quite large relative to the size of the drone. It consists of an inner ring of stationary charged plates called the stator. These plates are composed of a thin carbon-fiber plate covered in aluminum foil. When in operation, neighboring plates have opposite charges. A ring of 64 rotating plates surrounds that.

The motor starts operating when the plates in the outer ring are charged. Since one of the nearby plates on the stator will be guaranteed to have the opposite charge, the pull will start the rotating ring turning. When the plates of the stator and rotor reach their closest approach, thin wires will make contact, allowing charges to transfer between them. This ensures that the stator and rotor plates now have the same charge, converting the attraction to a repulsion. This keeps the rotor moving, and guarantees that the rotor’s plate now has the opposite charge from the next stator plate down the line.

These systems typically require very little in the way of amperage to operate. But they do require a large voltage difference between the plates (something we’ll come back to).

When hooked up to a 10-centimeter, eight-bladed propeller, the system could produce a maximum lift of 5.8 grams. This gave the researchers clear weight targets when designing the remaining components.

Ready to hover

The solar power cells were made of a thin film of gallium arsenide, which is far more expensive than other photovoltaic materials, but offers a higher efficiency (30 percent conversion compared to numbers that are typically in the mid-20s). This tends to provide the opposite of what the system needs: reasonable current at a relatively low voltage. So, the system also needed a high-voltage power converter.

Here, the researchers sacrificed efficiency for low weight, arranging a bunch of voltage converters in series to create a system that weighs just 1.13 grams, but steps the voltage up from 4.5 V all the way to 9.0 kV. But it does so with a power conversion efficiency of just 24 percent.

The resulting CoulombFly is dominated by the large cylindrical motor, which is topped by the propeller. Suspended below that is a platform with the solar cells on one side, balanced out by the long, thin power converter on the other.

Meet the CoulombFly.

To test their system, the researchers simply opened a window on a sunny day in Beijing. Starting at noon, the drone took off and hovered for over an hour, and all indications are that it would have continued to do so for as long as the sunlight provided enough power.

The total system required just over half a watt of power to stay aloft. Given a total mass of 4 grams, that works out to a lift-to-power efficiency of 7.6 grams per watt. But a lot of that power is lost during the voltage conversion. If you focus on the motor alone, it only requires 0.14 watts, giving it a lift-to-power efficiency of over 30 grams per watt.

The researchers provide a long list of things they could do to optimize the design, including increasing the motor’s torque and propeller’s lift, placing the solar cells on structural components, and boosting the efficiency of the voltage converter. But one thing they don’t have to optimize is the vehicle’s size since they already built a miniaturized version that’s only 8 millimeters high and weighs just 9 milligrams but is able to generate a milliwatt of power that turns its propeller at over 15,000 rpm.

Again, all this is done without any onboard control circuitry or the hardware needed to move the machine anywhere—they’re basically flying these in cages to keep them from wandering off on the breeze. But there seems to be enough leeway in the weight that some additional hardware should be possible, especially if they manage some of the potential optimizations they mentioned.

Nature, 2024. DOI: 10.1038/s41586-024-07609-4  (About DOIs).

Researchers build ultralight drone that flies with onboard solar Read More »