Technology

34702 readers
114 users here now

This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.


Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.


Rules:

1: All Lemmy rules apply

2: Do not post low effort posts

3: NEVER post naziped*gore stuff

4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.

5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)

6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist

7: crypto related posts, unless essential, are disallowed

founded 5 years ago
MODERATORS
1326
1327
1328
 
 

archive

Google has been caught hosting a malicious ad so convincing that there’s a decent chance it has managed to trick some of the more security-savvy users who encountered it.

Looking at the ad, which masquerades as a pitch for the open-source password manager Keepass, there’s no way to know that it’s fake. It’s on Google, after all, which claims to vet the ads it carries. Making the ruse all the more convincing, clicking on it leads to ķeepass[.]info, which when viewed in an address bar appears to be the genuine Keepass site.

A closer link at the link, however, shows that the site is not the genuine one. In fact, ķeepass[.]info —at least when it appears in the address bar—is just an encoded way of denoting xn--eepass-vbb[.]info, which it turns out, is pushing a malware family tracked as FakeBat. Combining the ad on Google with a website with an almost identical URL creates a near perfect storm of deception.

“Users are first deceived via the Google ad that looks entirely legitimate and then again via a lookalike domain,” Jérôme Segura, head of threat intelligence at security provider Malwarebytes, wrote in a post Wednesday that revealed the scam.

Information available through Google’s Ad Transparency Center shows that the ads have been running since Saturday and last appeared on Wednesday. The ads were paid for by an outfit called Digital Eagle, which the transparency page says is an advertiser whose identity has been verified by Google.

Google representatives didn’t immediately respond to an email, which was sent after hours. In the past, the company has said it promptly removes fraudulent ads as soon as possible after they’re reported.

The sleight of hand that allowed the imposter site xn--eepass-vbb[.]info to appear as ķeepass[.]info is an encoding scheme known as punycode. It allows unicode characters to be represented in standard ASCII text. Looking carefully, it’s easy to spot the small comma-like figure immediately below the k. When it appears in an address bar, the figure is equally easy to miss, especially when the URL is backed by a valid TLS certificate, as is the case here.

The use of punycode-enhanced malware scams has a long history. Two years ago, scammers used Google ads to drive people to a site that looked almost identical to brave.com, but was, in fact, another malicious website pushing a fake, malicious version of the browser. The punycode technique first came to widespread attention in 2017, when a Web application developer created a proof-of-concept site that masqueraded as apple.com.

There’s no sure-fire way to detect either malicious Google ads or punycode encoded URLs. Posting ķeepass[.]info into all five major browsers leads to the imposter site. When in doubt, people can open a new browser tab and manually type the URL, but that’s not always feasible when they’re long. Another option is to inspect the TLS certificate to make sure it belongs to the site displayed in the address bar.

1329
1330
1331
1332
1333
 
 

This is over 10 years old but more relevant than ever. :)

1334
 
 

archive.org

X, the platform formerly known as Twitter, will begin charging new users $1 a year to access key features including the ability to tweet, reply, quote, repost, like, bookmark, and create lists, according to a source familiar with the matter. This change will go live today for new users in New Zealand and the Philippines.

Roughly 20 minutes after this story published, X’s Support account confirmed the details, writing that “this new test was developed to bolster our already successful efforts to reduce spam, manipulation of our platform and bot activity, while balancing platform accessibility with the small fee amount. It is not a profit driver.”

Starting today, we're testing a new program (Not A Bot) in New Zealand and the Philippines. New, unverified accounts will be required to sign up for a $1 annual subscription to be able to post & interact with other posts. Within this test, existing users are not affected.

This new test was developed to bolster our already successful efforts to reduce spam, manipulation of our platform and bot activity, while balancing platform accessibility with the small fee amount. It is not a profit driver.

And so far, subscription options have proven to be the main solution that works at scale. — Support (@Support) October 17, 2023

The company published the “Not-a-Bot Terms and Conditions” today outlining its plan for a paid subscription service that gives users certain abilities on their platform, like posting content and interacting with other users. This program is different from X Premium, which offers more features like “Undo” and “Edit” for posts for $8 a month. Given the company’s tumultuous reputation under Musk, some users have voiced their hesitancy to turn over their credit card info.

X owner Elon Musk has long floated the idea of charging users $1 for the platform. During a livestreamed conversation with Israeli prime minister Benjamin Netanyahu last month, Musk said “It’s the only way I can think of to combat vast armies of bots.”

Shortly after the announcement, Musk tweeted that you can “read for free, but $1/year to write.”

“It’s the only way to fight bots without blocking real users,” Musk wrote. “This won’t stop bots completely, but it will be 1000X harder to manipulate the platform.”

X CEO Linda Yaccarino was asked last month onstage at Vox’s Code Conference about how going to a full subscription model on X will affect revenue, something that is now going live to users today. Yaccarino answered at the time, “Did he say that or did he say he’s thinking about it?”

1335
 
 

Before anyone gets too excited, they're going to use RISC-V for watches and such (Wear OS), but it's still a big step towards having Android phones use RISC-V and major adoption. Maybe RISC-V is closer than we thought!

1336
 
 

Even if it’s not anywhere as famous as Silicon Graphics machines, this workstation from the 80s has something that others don’t have; a game exclusive to it, that fully takes advantage of the so impressive graphics that it could display! Check it out at the link here!

Disponibile anche in 🇮🇹

1337
1338
 
 

The new USB-C Apple Pencil supports hover with the iPad Pro and can attach magnetically — but at $79, it’s cheaper than the $129 second-gen Pencil.

The cheaper price means that the Pencil doesn’t come with some of the more advanced features as the first- and second-generation accessories. The device doesn’t support pressure sensitivity, wireless pairing and charging, or the double-tap feature that lets you switch between tools. However, it still supports hover with M2 models of the iPad Pro.

The lower price is nice, but zero pressure sensitivity is a big question mark IMO. You'd expect something at this price to have at least a few levels of sensitivity.

1339
1340
 
 

Sadly, I can't seem to find the full, non paywalled version of the article ._.

1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
view more: ‹ prev next ›