Never quit, Hiro Wakabayashi.

InfraMunk, Gmunk

Licensing agreement will allow listeners to use AI to create content on streaming platform for first time

Spotify and Universal Music Group have agreed on a deal that will allow subscribers to generate song covers and remixes using artificial intelligence.

The licensing agreement is the first time the Swedish streaming company will allow listeners to use AI to create content through its platform.

Continue reading...

‘I have a thing called Iran, and other things,’ says president as he considers invitation to Donald Trump Jr’s nuptials

Get Me to the Church on Time, sang Alfred Doolittle in the musical My Fair Lady. But for Donald Trump, attending a wedding is not simple – even when it’s that of his son.

On Thursday, the US president admitted that he might skip Donald Trump Jr’s nuptials, reportedly taking place in the Bahamas over the upcoming Memorial Day weekend.

Continue reading...

The Oscar-winning actor’s role in the mythical drama has been attacked by Elon Musk and others on the far right

Oscar-winning actor Lupita Nyong’o has responded to far-right criticism of her role in Christopher Nolan’s adaptation of The Odyssey.

In the big-budget film, out in July, the star plays Helen of Troy alongside cast members including Matt Damon, Anne Hathaway, Tom Holland and Zendaya.

Continue reading...

You know your Google API key has leaked so you rush to disable it before bad actors can start running up charges on your account. Bad news: According to security researchers at Aikido, people can use the API keys for up to 23 minutes after a user deletes them, creating a window of opportunity that, when combined with Google’s automatic billing tier upgrades, can devastate victims. “We've identified a substantial window where an attacker with access to a leaked Google API key can continue to misuse that credential, after the user believes the key is revoked,” Joseph Leon, a security researcher with Aikido, told The Register. “In that window, an attacker could run up charges, pull sensitive files uploaded to Gemini, and exfiltrate cached context.” Aikido tested the gap during 10 trials over two days. In each trial, researchers created an API key, deleted it, and then sent three to five authenticated requests per second until no valid response came back for several minutes. From the time a user deletes the Google API key to when it can no longer be used propagates gradually across Google's infrastructure, he said. Some servers reject the key within seconds while others keep accepting it for 23 minutes. What this means is that an attacker holding a deleted key can repeatedly send requests until one reaches a server that has not caught up, Leon said. If Gemini is enabled on the project, they can dump files that were uploaded and exfiltrate cached conversations. The paper cited a similar problem researchers disclosed in December involving AWS keys. In that case, after deletion, attackers had a four-second window to exploit, and researchers showed how they could create new credentials in that time. “Four seconds was enough to matter on AWS,” Leon wrote in the paper. “Given recent attention to Google API keys used to access Gemini, we set out to measure how long Google's API key revocation window remains open.” Flaws can hit devs with huge surprise bills The Register has reported numerous cases of Google API key abuse in which developers are suddenly hit with five figure bills after their credentials are compromised. The problem was compounded in April after Google reworked its billing policy to include spending tiers for users. While developers initially thought of it as a way to limit costs, Google automatically upgrades that spending tier to the next highest level without their knowledge. For users who have been working with Google for more than 30 days and have spent more than $1,000 over the lifetime of the account, their cap can be increased from $250 to $100,000 if their usage spikes – a windfall for crooks if the credentials fall into the wrong hands. Developers whose Google API keys were stolen told The Register that their bills rocketed up to five figures minutes after their credentials were stolen, as bad actors loaded up on Google’s Gemini models such as Nano Banana and its video production model Veo 3. Google issued refunds in the three instances that The Register brought to its attention, returning $154,000 to those developers. The victims told The Register that, during the attack, they were frantically trying to shut down the spending and turn off access to their projects even as costs climbed by thousands of dollars. Leon said in cases where a Google developer tries to shut off access to their account, deleting the API key will still give crooks time to inflict damage. “It's hard to put a dollar figure on it,” Leon told us. “The window averaged 16 minutes in our testing and stretched to nearly 23 at the worst. During that window, the success rate is wildly unpredictable. We saw minutes where over 90% of requests still authenticated, and others where fewer than 1% did. An attacker who knows this can send requests at high volume to maximize their odds of hitting a server that hasn't caught up. For Google API keys with Gemini access, the damage isn't just a compute bill. It's the files and cached context an attacker can exfiltrate before the key actually dies.” Using VMs, Aikido tested its findings across three Google Cloud regions – east coast US, western Europe, and southeast Asia – then they spot checked those results on different dates. For each trial, Aikido deleted a single API key and sent requests from each of the three VMs in parallel, Leon wrote in the paper. “VMs further from the US picked up the deletion faster, which is the opposite of what you'd expect. We can't say exactly why from the outside. Google's request routing is more complex than ‘VM region equals server region,’ and a VM in Singapore isn't necessarily talking to servers in Singapore,” the paper states. “But the pattern was consistent across trials, which points to something about regional infrastructure, caching, or routing affinity driving the difference.” The trial used keys with access to Gemini, but he observed the same behavior with keys scoped to other GCP APIs, such as BigQuery and Maps. Google has built faster revocation for other credential types, Leon said. He said Google’s service account API credential revocations propagate in about 5 seconds. Gemini's newer API key format – the one that starts with AQ – propagates in about a minute. “Both run at Google scale. Both suggest this is technically solvable for Google API keys, too,” Leon wrote. But Google told Aikido it has no plans to address the 23-minute gap researchers found with its other API keys. “After reviewing our report, they closed it as ‘Won't Fix (Infeasible)’ with the comment ‘the delay due to propagation of the deletion of these keys is working as intended,’ “ Leon told us. The Register has reached out to Google about this research, but has not yet received a response. ®

GitHub's npm package registry has rolled out a publishing approval step to prevent the distribution of compromised packages before they can poison the software supply chain. Modern software development relies on imported bundles of code known as packages (and sometimes libraries or modules). In the past decade or so, miscreants have focused on gaining access to the accounts of package maintainers. Subverting a widely used package offers a fast track to malware distribution. Last December, amid the Shai-Hulud 2.0 campaign that compromised software packages, GitHub described a series of planned security measures intended to harden security for npm package publishers. One of the measures, staged publishing, has now been implemented. GitHub on Wednesday merged npm stage into npm CLI (v11.15.0) and has updated the registry documentation that describes the process. Staged publishing might also be called gated publishing – it requires a project maintainer to approve changes to a package that has been staged for release. It's been under discussion since 2020. "Instead of publishing directly with npm publish, you can submit packages to a staging area with npm stage publish," the documentation explains. "A maintainer must then review and explicitly approve the staged package — with two-factor authentication (2FA) via the CLI or npmjs.com — before it becomes publicly available." This process should have particular value for automated workflows, which typically don't include a way to authorize via 2FA. Automated workflows often rely on tokens for authentication, but these can be copied and stolen. Tokens that remain valid for long periods of time become attractive targets for cyberattackers. That's why GitHub did away with long-lived classic tokens and encouraged the use of short-lived session tokens and permission-limited access tokens for automation. GitHub's discontinuation of classic tokens hasn't gone all that well because short-lived tokens tend to expire at inconvenient times – no one likes having to regenerate tokens every 90 days or less and then go through the reconfiguration process. Staged publishing should make it easier for developers to set up maintainable workflows without burdensome re-authentication rituals. It gives package publishers the option to stage their package via automation and to delay the 2FA approval for publishing at a later date. GitHub offers trusted publishing as a way to establish trust between npm and the developer's CI/CD provider using OpenID Connect (OIDC) authentication. The OIDC mechanism still doesn't work when trying to publish a package for the first time, but together with staged publishing, the software supply chain looks a bit more defensible – so long as developers avail themselves of these tools. ®

NEW YORK (ANP) - De aandelenbeurzen in New York zijn donderdag met kleine koerswinsten gesloten, waarmee een vervolg werd gegeven aan de flinke plussen een dag eerder. AI-chipconcern Nvidia behoorde echter tot de verliezers op Wall Street na de bekendmaking van kwartaalcijfers woensdag nabeurs.

Nvidia daalde 1,8 procent. De grootste verkoper van chips voor kunstmatige intelligentie (AI) boekte afgelopen kwartaal opnieuw recordresultaten. De omzet steeg met 85 procent tot 81,6 miljard dollar vergeleken met een jaar eerder dankzij de aanhoudende grote vraag naar chips voor AI-datacenters. Volgens topman Jensen Huang verloopt de bouw van AI-fabrieken met "uitzonderlijke snelheden". Nvidia is het waardevolste bedrijf ter wereld, met een beurswaarde van ruim 5 biljoen dollar.

De Dow-Jonesindex eindigde 0,6 procent hoger op 50.285,66 punten. De brede S&P 500 klom 0,2 procent tot 7445,72 punten en de technologiegraadmeter Nasdaq won 0,1 procent tot 26.293,09 punten. De Amerikaanse beurzen gingen een dag eerder tot 1,5 procent omhoog.

Olie

De prijs van een vat Amerikaanse olie daalde 1,1 procent tot 97,20 dollar en Brentolie werd 1 procent goedkoper op 103,95 dollar per vat, na eerder op de dag nog hoger te hebben gestaan. Op woensdag gingen de prijzen ook al flink omlaag door hoop op een snel einde aan de oorlog tussen Iran en de Verenigde Staten en een heropening van de Straat van Hormuz voor olietankers. De Amerikaanse minister van Buitenlandse Zaken, Marco Rubio, zei tekenen te zien van vooruitgang in de vredesgesprekken.

Verder kwamen er nog kwartaalberichten van onder meer kledingmerk Ralph Lauren. Die vielen in de smaak bij beleggers, want het aandeel steeg bijna 14 procent. Ook de producent van landbouwmachines Deere meldde cijfers. Die werden minder goed ontvangen en Deere werd 5,3 procent lager gezet.

Walmart

Walmart leverde 7,3 procent in. De grootste supermarktketen ter wereld boekte afgelopen kwartaal meer omzet dan verwacht, maar de verwachtingen voor het lopende kwartaal stelden teleur.

De producent van belastingsoftware Intuit dook 20 procent in het rood na tegenvallende vooruitzichten voor het gehele jaar. Daarnaast gaat Intuit ongeveer 3000 banen schrappen om kosten te besparen. Volgens het bedrijf kan veel werk worden overgenomen door AI.

Waymo has paused service in Atlanta after one of its driverless cars entered a flooded street and got stuck. It follows a similar pause in San Antonio that prompted a recent software recall (PDF) over flood avoidance. TechCrunch reports: Waymo admitted that it hadn't finished developing a "final remedy" for avoiding flooded areas when it issued its software recall last week. Instead, the company said that it shipped an update to its fleet that placed "restrictions at times and in locations where there is an elevated risk of encountering a flooded, higher-speed roadway," according to documents released by the National Highway Traffic Safety Administration (NHTSA).

But even those precautions apparently were not enough to stop the Waymo robotaxi from entering the flooded intersection in Atlanta. Waymo told TechCrunch on Thursday that the storm in Atlanta produced so much rainfall that flooding was happening before the National Weather Service had issued a flash flood warning, watch, or advisory. The company said its fleet those alerts are part of a larger set of signals it relies on to prepare the vehicles for poor weather.

Read more of this story at Slashdot.

Live coverage of all the build-up ahead of the 2026 Canadian Grand Prix weekend.