An overview of threats and best practices in all stages of software development in thecloud.

The future of application security is in the cloud. Software development and application deployment continue to move from on-premise to various types of cloud environments. While the basics of application security (AppSec) carry over from on-premise, the cloud introduces new areas of complexity and a new set of requirements.

AppSec best practices for the cloud are somewhat different from standard AppSec best practices. Cloud applications tend to be more segmented into different services and are more likely to use other cloud services, delivered via API, to compose application functionality. AppSec teams may need to coordinate with security and ops teams from cloud service providers (CSPs) to ensure proper coverage and to adapt cloud-specific best practices. This blog covers AppSec cloud best practices and offers a basic framework on how to think about cloudAppSec.

Cloud application security is the discipline of securing application code running in public, private, or hybrid cloud environments. Logically, this means threat modeling for cloud environments and deploying tools and controls to protect applications running in thecloud.

It also involves creating policies and compliance processes that may be different from traditional application security practices used for legacy on-premise application deployments. More specifically, traditional security for applications has focused on the network and infrastructure layer. In the cloud, because applications tend to be more accessible to third-parties via API and incorporate third-party code and services, more care must be taken to secure the application code and application environment itself.

For cloud applications, software development is more likely to involve rapid iterations pushed through Continuous Integration / Continuous Deployment (CI/CD) pipelines. This dynamic is causing security to shift left with developers increasingly responsible for writing secure code and DevOps teams responsible for testing code with security tooling prior to code submission. For this reason, the AppSec team has an expanded role in defining cloud security best practices but also teaching developers and DevOps teams how to better secure applications at the code and CI/CD pipelinestages.

It is critical that AppSec teams understand and plan for their level of responsibility in guarding applications. The different types of cloud environments determine who is responsible for security. In a private cloud, the organization owns full responsibility for the fullstack.

For applications running in public cloud service provider (CSP) environments like Amazon Web Services, Microsoft Azure, and Google Cloud, responsibility for application security starts at the operating system layer. That said, AppSec teams should still factor in the risk of compromise of lower layers of the CSPs multi-tenant environment.

For Platform-as-a-Service offerings like RedHat OpenShift or Heroku, security teams are primarily responsible for security of the application code anddata.

For SaaS applications, AppSec teams do not need to be involved as full responsibility is on the vendor. The only exception is if a SaaS application integrates directly into a cloud application, in which case the AppSec team must be mindful of the risks of this integration and apply controls against those risks, e.g., data loss protection or payment gateway abuse. The reality is that in an era of microservices and APIs, application security rarely stops at the application or cloudedge.

Cloud applications face the same threats as on-premise applications plus several additional risk types. The list of threats that AppSec teams must guard against includes:

For best results, think about your cloud AppSec practice as segmented into stages. The first stage, application development, requires a certain set of best practices. The second stage, formal application security, requires an overlapping but slightly different set of practices. The third stage, DevOps and production, requires yet another overlapping set of practices. The three stages do tend to blend together in rapidly iterating application development organizations but this remains a useful guide to building a cloud AppSec best practices playbook.

For developers responsible for shifting left application security, key considerations and best practices include:

AppSec teams often conduct their own security reviews on top of existing efforts by development teams. As advanced security practitioners, AppSec teams should apply a broad range of security measures and best practices more appropriate to a discrete security discipline. Specifically, AppSec working with the network security and operations teams should put in place and or at least verify and help configure solutions for the following:

DevOps manages CI/CD solutions and controls application code deployment and lifecycle. DevOps is responsible for implementing any of the elements of AppSec practices that work at the CI/CD level. This mayinclude:

Cloud AppSec practices will continue to evolve. What we have detailed here is a starting point. Because cloud and cloud services are changing so rapidly, it is important to review cloud AppSec best practices and playbooks frequently. Just as the lines of responsibility between networking, development and operations have blurred, in cloud AppSec the lines have also blurred. Cooperation between all stakeholders is essential, however.

Responsibility for security is shifting left but the AppSec team remains the quarterback and the ultimate accountable party for ensuring that cloud applications remain safe and performant. Creating a detailed runbook for cloud AppSec and the responsibilities of the different stakeholders will help clarify your cloud AppSec approach and create a practice guide you can follow to continuously evolve and improve your cloud security.

To shift left and get started with cloud AppSec in the development stage, create a free account with a modern static analysis tool. A single scan from ShiftLeft CORE finds vulnerabilities in custom code, CVEs in open-source code, and hard-coded secrets. It is delivered as SaaS so it is easy for DevOps to integrate into your CI/CD and, because it never takes source code off of your servers, it is a safe alternative to on-premtools.

Best Practices for Application Security in the Cloud was originally published in ShiftLeft Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

*** This is a Security Bloggers Network syndicated blog from ShiftLeft Blog - Medium authored by The ShiftLeft Team. Read the original post at: https://blog.shiftleft.io/best-practices-for-application-security-in-the-cloud-dd1ce72cca26?source=rss----86a4f941c7da---4

See more here:

Best Practices for Application Security in the Cloud - Security Boulevard

(ABC4) So, you walk into a bar. No, this isnt the start of a bad joke, but it could be the start of a potential threat to the security of your personal information, experts say.

Living in Utah, those of us who drink alcohol have become accustomed to presenting our IDs at the door of any establishment that serves booze. Thats certainly not new, especially in a state with historically restrictive liquor laws. But, what is new are the ID-scanning apps that are being used at some local bars, pubs, breweries, and eateries.

These apps, which can be downloaded onto any device with the ability to support them like phones and iPods are a new alternative to the typical barcode scanner or PalmPilot resemblant ID readers were used to seeing.

And while these apps certainly do increase convenience for bar staff, they open the doors up to a lot of potential security risks for patrons.

Basically, by having your ID scanned with an app, you are putting your trust and your personal information in the hands of an app developer somewhere, Mu Zhang, a University of Utah professor who has done extensive research on computer security and privacy, says.

They use a barcode scanner to try to scan your ID, but you dont actually know how your information will be used by these applications, Zhang explains. It really just depends on the developers, so the question will be, how much do you trust those developers?

And since the apps are likely not open source meaning their code is available for anyone to look at youll have to place even more trust in the app creator.

If the source code is not public, you have to rely on the app-maker to be honest about this, he says. But assuming that they are honest, the privacy policy of the app can tell you a lot about what the app captures, what it does with that data, and why, and how.

But, Sameer Patil, a professor in the University of Utahs School of Computing, notes, as a bar patron, you have no idea about and likely no time to peruse an apps privacy policy before meeting a friend for a beer after work or hitting the bars on a Friday night.

And, in addition to the app creators, the apps may put personal information in the hands of whoever is wielding the scanning device itself. And though wed like to assume our local bartenders and bouncers have our best interests at heart, its hard to always know for sure.

So, if its the bartenders personal phone, all they have to do is take a screenshot, Patil says. So, even if the app doesnt save it, if the bartender wanted to save your ID, they could take a screenshot of it while its scanned and they have it in their photo album.

But, its unlikely that theyd be able to get a full picture of your ID. According to the Utah Department of Alcoholic Beverage Control, ID scanners arent legally allowed to display more than the individuals name, age, birth date, and gender, in addition to the license number and expiration date.

However, if the device doing the scanning has any harmful malware downloads, there could be even more potential for concern beyond your terrible DMV photo living on in infamy.

Traditionally, [malware apps] just collect, for example, your phone number, your SMS, or your contact information from your device, Zhang says. So now they actually have another channel to get your real bio from your drivers license.

Jun Xu, who is also a professor at the University of Utah, ran several common ID scanner apps Bar and Club Stats, Veriscan, and Vemos through an open-sourced online detection tool to evaluate the possibilities of some common security concerns, like malware interference.

The detection tool uncovered that both Bar and Club Stats and VeriScan might save some data to the phone the ID is scanned on. This leaves information with the ability to be potentially poached by malware, Xu says.

There is a piece of code which is used by this app that has a vulnerability, and because of that vulnerability, the other apps can access the data saved, he explains.

The way some of the apps are communicating with their servers could invite potential security risks, too. Things like encryption whether or not the data is readable to outside parties and the list of servers the app is allowed to communicate with play huge roles in overall app security.

If the information is analyzed locally on the device, theres very little security risk, Patil says. But, if the data is transmitted to a third party, things get dicier. Third-party access means more eyes on your information and therefore, greater potential for a breach.

Whatever information [the app] is getting from that drivers license be it an actual photo of it or the information that it can have gleaned from that photo it sends it somewhere else, to a third party, he explains hypothetically. As soon as information leaves the phone and goes to another party, then we have to worry about, well, who that party is and what are they doing with that information?

Patil also adds that, if this data is transmitted on the cloud, it could leave personal information at increased risk for a data leak.

And, according to Xus security risk detection, these could be very real threats. One of the apps, Veriscan, seems to communicate some messages to its server without encrypting them. This means that hackers with bad intentions can potentially access the apps communication channels, effectively eavesdropping and garnering them the ability to steal private data.

Additionally, Bar and Club Stats doesnt seem to have any restriction pertaining to trusted servers the app can communicate with. This makes it easier for the connection to be intercepted by an unintended party, which could also result in a data leak.

When youre talking to someone, you have to make sure that the one youre talking to is the one you trust, right? Xu explains with an example. Like now, youre talking to me. You have to make sure: OK, Im talking to Jun. Its the same with communication between the mobile app and the server.

But despite the potential security risks, there are luckily some protections in place for private material gleaned by ID scanners in the state of Utah. Aside from the restrictions on the type of personal information displayed by scanners, according to the DABC, the data gained through ID scans can only be stored by bars for seven days, after which it must be deleted.

The DABC enforces this policy through annual checks of Utah bars, in addition to the more regular checks performed by the State Bureau of Investigation, which is a division of the Utah Department of Public Safety.

But, there is no specific guidance from the DABC about the use of apps for ID verification yet, so its important to be aware of the risks.

As Patil advises: If I was a patron at such a bar, I wouldnt agree to my ID being scanned by an app that I dont even know, on somebody elses phone.

Read the rest here:

Why is the bouncer scanning my ID with a phone? Scanner apps could present some security risks, experts say - ABC 4

DevSecOps short for development, security and operations combines separate traditional development, security and operations functions to increase the security of applications and digital services.

As the name implies, DevSecOps aims to integrate security testing into agile IT and DevOps development as seamlessly and as transparently as possible. Ideally, this is done without reducing the agility or speed of developers or requiring them to leave their development toolchain environment, says market researcher Gartner.

DevSecOps is based on core DevOps principles such as automation, and continuous and iterative improvements, as well as giving developers primary responsibility for security rather than leaving that function to a dedicated security team after applications have gone into production.

In DevSecOps, the you code it, you own it philosophy extends beyond code development to security monitoring and incident response, with any business impacts of security breaches reported to the developer, according to Gartner.

DevSecOps allows developers to continuously check their code for security issues as they create it and to fix problems immediately. Security feedback can be provided through traditional ticketing systems or the developers integrated development environment (IDE), says Dale Gardner, a senior research director at Gartner. Some tools that allow developers to receive and act on security issues in their IDE can, he says, point to specific lines of code and say, The problem is here like we found SQL injection in your code; heres why its a bad thing and how you should go about fixing it.

In its research reports, Gartner recommends extending scans for known vulnerabilities and misconfigurations to not only custom code, but the open-source and third-party components that often make up the bulk of modern applications. It also recommends scanning and monitoring all infrastructure as code (such as automation scripts, templates, images and blueprints that determine the configuration of the IT infrastructure) for vulnerabilities. And it recommends controls to assure the correct version of a script is being used and that platform control and configuration scripts dont contain secrets such as credentials.

Application programming interfaces (APIs) through which many cloud-native applications communicate are a growing area of interest for DevSecOps practitioners, says Gardner, with Gartners surveys showing the percentage of organizations testing APIs for security vulnerabilities rising from the single digits to around 30% in the last few years.

Gartner recommends threat modeling as an essential step in DevSecOps to set policies covering what level of risk the organization is comfortable with, allowing developers and security staff to de-emphasize those vulnerabilities that are unlikely to be exploited or applications that are less critical to the business.

In a DevSecOps environment, Gartner recommends all scans be fully automated using APIs triggered by the developers continuous integration/continuous deployment (CI/CD) toolchain and events such as committing code to a new environment or posting it for review by others.

Among the DevSecOps practices Gartner recommends are that infrastructure updates such as security patches and configuration changes be made by developers and deployed by automated tools, and that libraries, components and OS images used to create production images be kept in secure repositories.

DevSecOps has the potential to reduce cybersecurity risks to the enterprise, its brands, its data and its customers more completely, more quickly and at lower cost than by performing security checks only after code has been released into production.

If I can have the developers fix something right away, its cheaper and easier than waiting hours and days [to fix] something, says Gardner. Along with tangible benefits such as reduced deployment time and effort, there are intangible business benefits such as delivering more features to the market more quickly as well as avoiding the reputational or regulatory costs of a security breach.

DevSecOps requires changes in the roles performed by, and the skills required of, both developers and security teams. This can require retraining, changes to workflows and increased collaboration between developers who were traditionally focused on speeding great apps to market and security teams that traditionally prioritize security.

Gartner recommends training developers in at least the basics of secure coding and common application vulnerabilities. This includes foundational security hygiene; secure configuration of applications, operating systems and container environments; and how to correctly use the enterprises systems for managing secrets such as passwords. Security professionals should be trained in newer cloud-native development and deployment technologies, which can require cost and effort.

The use of internal secure code repositories also requires an ongoing commitment between development architects and information security to keep it up to date, and a process for developers to request new frameworks and libraries, says Gartner.

Futile attempts to create zero-vulnerability applications can slow developers down, causing them to waste time chasing false positives or addressing vulnerabilities that pose lower risk because they are not directly or easily exploitable, says Gartner. Instead, it recommends focusing developers and testers on the most critical security issues identified through threat modeling.

For new applications, Gartner recommends having simple, automated security requirements using a threat modeling tool. For existing applications, it suggests an incremental approach to threat modeling, focused on major changes to applications.

Among the new technologies that may be required is strong version control to ensure that only code that has been properly scanned for flaws is put into production, as well as to determine where insecure code has been used so it can be remediated. DevSecOps may also require new capabilities to identify and verify the security of the APIs used to connect web applications.

Another challenge, says Gardner, is getting application security professionals to change their mindset from serving as a security guardian at the end of the development process to advising developers throughout the process on how to improve application security.

Gardner separates DevSecOps tools into three categories: threat modeling, traditional testing tools used in DevSecOps, and observability and monitoring.

Threat modeling: DevSecOps tools that automate this formerly work-intensive task include SD Elements from Security Compass, ThreatModeler (from the company of the same name), the IriusRisk Threat Modeling Platform, as well as various open-source tools.

Traditional testing tools: Traditional testing tools used in DevSecOps include Checkmarx, a leader in Gartners 2021 Magic Quadrant for Application Security Testing, which says Checkmarxs graphical presentation of control and data paths across microservice environments helps developers better understand where best to focus remediation efforts. Another is Synopsys, whose recently added microservices analysis provides a visual interface that can help identify potentially unsafe data flow issues, says Gartner, while its new Intelligent Orchestration solution integrates into continuous integration/continuous delivery pipelines.

Forrester Research praised the integration capabilities of Micro Focus Fortify that support the developer toolchain, as well as the ability to accept scanning data from third-party tools.

Observability and monitoring: In the monitoring and observability space, Gardner cited the Dynatrace Software Intelligence Platform, which Dynatrace claims can discover new code deployed into production and scan it for known vulnerabilities. Bionic claims to continuously discover and analyze applications, services, APIs, data flows and dependencies; provide alerts on architecture drift and policy violations; and provide a feedback loop to engineering teams so architectures comply with standards.

Contrast Security claims such as observability capabilities as automatically identifying, diagnosing and verifying the remediation of vulnerabilities in applications and APIs, and providing a comprehensive view of all open-source components and their dependencies.

DevSecOps can require extensive changes in how organizations think about, organize and staff for software development, security and operations. It requires an integrated, continuous and iterative approach to security that gives broader security responsibilities to developers, and new tools to provide the needed visibility and tracking of custom and open source code.

The benefits, though, are the ability to respond nimbly to new business challenges while protecting customers, business partners or the brand from ongoing cyberthreats.

Read the rest here:

DevSecOps: Pros and Cons - ITPro Today

When cryptically coloured squares began flooding Lau Chaak-mings social media feeds earlier this month, the 37-year-old linguistics professor didnt take much notice. But curiosity soon got the better of him, and it wasnt long before Lau was waiting until midnight when the daily puzzle refreshes to play Wordle, the word game that has taken the internet by storm.

Last Friday, while eating breakfast at a local cafe with a co-worker, Lau realised that many of the items on the menu were Wordle-length. Things like saido (French toast), hofun (rice noodles) and gaafe (coffee) were all five letters long when written in Jyutping, a romanisation system used to spell out Cantonese words.

One of his friends had already made a variation of Wordle using Cangjie, a system for typing characters. Inspired, Lau, who works at the Education University of Hong Kong, also set out to make a puzzle variant in his native language. He called it Zidou, which means know.

Drawing on a comprehensive word list compiled during a previous project, a Cantonese dictionary he built seven years ago, Lau filtered out all the five-letter words and picked about 900 of the most common ones to be used as possible answers. Then, he input the words into Wordles open-source code.

It was quite easy to make. I did it in three hours, he told HKFP.

Laus Zidou is one of countless Wordle spin-offs created since the original game went viral. Josh Wardle, a New York-based software engineer, launched the puzzle last October as a gift to his word game-loving partner.

After Wardle added a sharing function to the game allowing players to brag about their linguistic prowess Wordle became an internet sensation. The puzzles allure lies in its simplicity: any five-letter word starts the game, with colour-coded tiles indicating how close to the answer players might be.

Zidou, too, has made the rounds online since its debut early on Saturday morning. On local forum LIHKG, people have been posting their grids of green, yellow and grey squares, and the link to the professors late-night creation.

At first I thought I would be quite happy if there were just a few hundred people playing, Lau said. But by the second night, there were already more than 10,000 plays. Ive averaged over 10,000 each day. Its quite exciting.

The consensus, unsurprisingly, is that Zidou is tough. While non-native Cantonese learners are usually taught some sort of romanisation either Jyutping or another commonly used system, Yale native speakers are generally unfamiliar with spelling Chinese characters out phonetically.

The Jyutping for some words is straightforward they are spelled how they sound. But others might be trickier.

In an LIHKG thread called Cantonese Wordle is very difficult, people expressed their frustrations over the game though that didnt stop many from trying.

I googled a Jyutping list to help, one user, who still used up all six tries before getting the answer, said.

Lau conceded that the game is hard. The English Wordle is already difficult, and these are words that we look at and spell everyday. For us, we rarely see Chinese characters spelled out in Jyutping, he said.

He lamented that the only romanisation system students learn at local schools is for Mandarin, not Cantonese. It is sad that they are taught Hanyu Pinyin, Lau said, referring to the name of the standard Mandarin romanisation system, but nothing about their native tongue.

Language talk aside, Lau said he created Zidou more out of his own personal interests than as an educational tool to promote Cantonese romanisation.

I just thought it would be fun, he said. I didnt make it as part of my language research, and its not related to my university work.

Still, he hoped that people who play the game are not just randomly guessing, but are picking up a thing or two about Jyutping. Zidou has an additional feature that sets it apart from other Wordle variations after a five-letter word is input, the game displays the respective Chinese characters so that players know the exact corresponding word. Because Cantonese is a tonal language, there is often more than one.

If 100 people who play the game learn Jyutping, then I think thats a good thing, Lau added.

Go here to see the original:

Wordle: As word puzzle takes over the internet, Hong Kong professor creates Cantonese version - Hong Kong Free Press

SpaceX launches Starship in 1st successful flight

SpaceX launched and successfully landed its futuristic Starship on Wednesday, finally nailing a test flight of the rocketship that Elon Musk intends to use to land astronauts on the moon and send people to Mars. (May 5)

AP

A claim has again emerged on social mediathat avideo purportedlyreleased by WikiLeaks proves a moon landing was faked. It does not specifywhich of NASA's crewed moon landings is in question, though its contents suggest it refers to the Apollo 11 lunar mission in 1969.

Versions of the video, linked from a blog,were posted roughly 150times on Facebook throughout 2020 and 2021and circulated on Twitter in late 2021. It showed up again this month in aJan. 24 Facebook post that had more than 100 interactions in a day.

The video itself contains amontage of scenes with overdubbed voices. Some scenes appear to show authentic footage from the Apollo 11 mission,while othersshow activity on a film set.

The video maintains a caption throughout that reads "Wikileaks releases moon landing cut scenes filmed in Nevada desert." It also features what appears to be a WikiLeaks logo in the upper left-hand corner of the screen for much of the video.

"This is ultimate proof that they FAKED it! Yet another HUGE lie exposed," reads the blog.

But this is wrong.

There is no record of the video being released by WikiLeaks. Further, the video contains already publicly available "behind the scenes" footage from the fictional 1970s movie "Capricorn One."

The claim was fact-checked by Reuters and found to be false.

Special access for subscribers!Click here to sign up for our fact-check text chat

USA TODAY reached out to the Facebook users who shared the claimfor comment. The Twitter users could not be reached.

While the video purportedly came from WikiLeaks, USA TODAY could not locate it on the WikiLeaks website. WikiLeaks did not immediately respond to a request for comment.

Shedding further doubt on the authenticity of the video, apparent "behind thescenes" footage from the late 1970s movie "Capricorn One"is spliced throughout. "Capricorn One" is a fictional story about a cover-up of a faked space mission to Mars. The apparent "behind the scenes" footage was uploaded to YouTube in 2014.

The video also contains what appears to be authentic footage from the Apollo 11 mission, including astronautEdwin "Buzz" Aldrin on the moon.

Fact check: Fake Mars photo not connected to NASA

USA TODAY previously debunked another social mediaclaimthatastronauts never landed on the moon.In that case, amismatch between a photo of an astronaut's lunar footprint and the sameastronaut's boot raised suspicions. While the lunar footprint showedtread, the astronaut's boot had a smooth sole.

However, the lunar footprint was made while the astronaut was wearing a treaded"lunar overshoe" which was discarded when the astronauts left the moon.

Based on our research, we rateFALSEthe claim that a video was released by WikiLeaks and proves a moon landing was faked. The video combines seemingly authenticimages of the Apollo 11 missionwith "behind the scenes" footagefrom a late 1970s fictional movie.USA TODAY could not locaterecords of the videoon the WikiLeaks site.

Thank you for supporting our journalism.You cansubscribe to our print edition, ad-free app or electronic newspaper replica here.

Our fact-check work is supported in part by a grant from Facebook.

Go here to see the original:

Fact check: WikiLeaks did not release footage that proves moon landing staged - USA TODAY

WikiLeaks founder Julian Assange has been given permission to appeal his extradition to the US.

Britains High Court ruled on Monday he could take his case to the UK Supreme Court.

The decision is the latest step in Assanges long battle to avoid being sent to the United States to face espionage charges over WikiLeaks publication of classified documents more than a decade ago.

Just over a year ago, a district court judge in London rejected a US extradition request on the grounds that Assange was likely to kill himself if held under harsh US prison conditions.

US authorities later provided assurances that the WikiLeaks founder would not face the severely restrictive conditions that his lawyers said would put his physical and mental health at risk.

Last month the High Court overturned the lower courts decision. High Court justices Ian Burnett and Timothy Holroyd said the American promises were enough to guarantee Assange would be treated humanely.

They said the US promises were solemn undertakings, offered by one government to another, which will bind all officials and prosecutors who will deal with the relevant aspects of Mr Assanges case now and in the future.

Assanges lawyers say those promises cant be trusted and asked Britain's High Court to appeal the decision.

On Monday, the court granted Assange permission to appeal.

They argued the US governments pledge that Assange wont be subjected to extreme conditions is meaningless because it is conditional and could be changed at the discretion of American authorities.

Assange, 50, has been held at the high-security Belmarsh Prison in London since 2019 when he was arrested for skipping bail during a separate legal battle.

Before that, he spent seven years holed up inside Ecuadors Embassy in London. Assange sought protection in the embassy in 2012 to avoid extradition to Sweden to face allegations of rape and sexual assault.

Sweden dropped the sex crimes investigations in November 2019 because so much time had elapsed.

American prosecutors say Assange unlawfully helped US Army intelligence analyst Chelsea Manning steal classified diplomatic cables and military files that WikiLeaks later published, putting lives at risk.

Lawyers for Assange argue that their client shouldnt have been charged because he was acting as a journalist and is protected by the First Amendment of the US Constitution that guarantees freedom of the press.

They say the documents he published exposed US military wrongdoing in Iraq and Afghanistan.

More here:

WikiLeaks founder Assange wins bid to appeal his extradition to the US - Euronews

You can say whatever you want were on Spotify.

Those were Joe Rogans words of reassurance to a podcast guest when she paused to joke that she would be arrested for what she said next. Like, YouTubes not gonna pull it, he went on, prompting her laughter. Were in a weird realm.

The remarks, made during Rogans interview with Canadian anti-transgender writer Meghan Murphy last August, reflects a difficult truth for the worlds largest music streaming platform as it seeks to extend its dominance, and becomes a media company in its own right.

Under heavy political pressure tech giants like Facebook, YouTube and Twitter have increased efforts to tackle misinformation on their platforms during the pandemic, tightening their rules and hiring third-party fact-checkers (albeit with limited success).

Audio streaming platforms like Spotify have so far escaped a similar level of scrutiny. But the Swedish-based, public company is now being forced to grapple with questions of its responsibility over misinformation and pseudoscience as it makes exclusive multimillion-dollar deals with popular podcasters.

Its flagship grab is undoubtedly The Joe Rogan Experience, Spotifys number one podcast, whose colourful and free-wheeling host was paid a reported $100m in early 2020 for exclusive rights to his show.

This week, Rogan once again proved the tricky balancing act for Spotify. In a four-hour interview, broadcast on Tuesday, he gave the self-help author and anti-feminist mystic, Dr Jordan Peterson, a platform to claim without evidence that climate science has no basis in reality, and that solar power kills more people than nuclear.

Its the latest example of Rogan and his guests appearing to have free rein to spread false claims and conspiracy theories, which in the past have spanned topics from the coronavirus vaccine and Dr Anthony Fauci to transgender people.

In some instances, Rogans words appeared to break with what Spotify has said publicly about Covid-19 misinformation.

The streaming service has previously told news outlets that it bans false or dangerous deceptive content about COVID-19, which may cause offline harm and/or pose a direct threat to public health.

It also claims to have removed over 20,000 podcast episodes related to COVID-19 since the start of the pandemic.

Yet no misinformation policy is listed in Spotifys user guidelines or in summaries of prohibited content on the company website. Spotify did not respond to a list of questions from The Independent seeking clarity on its policies surrounding misinformation.

Spotify has a hate speech policy on its website banning content that expressly and principally promotes, advocates, or incites hatred or violence against people based on characteristics such as race, sex, and sexual orientation.

Rogan has showed time and time and again that he will misinform his audience on Spotify and wont face any repercussions for doing so, says Alex Paterson, a senior researcher with the left-wing campaign group Media Matters for America, who listened to over 300 hours of the podcast in 2021.

Spotifys complete failure to mitigate Rogans harmful rhetoric about the pandemic demonstrates clearly that when it comes to their top podcast host [the stated] policy is just a hollow PR strategy.

Theres no such thing as climate

Rogan, who is also a stand-up comedian and a combat sports commentator, was Spotifys most-listened podcaster in both 2020 and 2021.

Before his deal with the company he had an estimated 11 million downloads per episode, although that figure likely included some automatic downloads that were never listened to. According to Chartmetrics and Viberate, two analytics companies, his audience is mostly young men aged 18-35 in English-speaking countries.

That is a familiar audience to Dr Peterson, who is not a climate scientist but a clinical psychologist who became famous for his anti-political correctness views, attacks on the trans community, arguments that white privilege isnt real, and defence of the patriarchy.

Climate is about everything, okay, says Dr Peterson on the episode. But your models arent based on everything. Your models are based on a set number of variables. So that means youve reduced the variables which are everything to that set.

Well, how did you decide which set of variables to include in the equation if its about everything? [...] Because your models do not and cannot model everything.

At one point, Rogan acknowledges that his guest went on these rants but continues the conversation on climate change. Dr Peterson then alleges, with zero factual basis, that more people die every year from solar energy than die from nuclear.

Asked what he means, Dr Peterson laughs and says: No, you fall off the roof when youre installing it ... gravity! He describes this as a good example of unintended consequences.

Dr Petersons claims were widely panned as "climate denial", "wackadoo" and "completely wrong". John Cook, who studies climate change denial narratives at the Monash Climate Change Communication Research Hub in Melbourne, Australia, toldThe Independent that they were very old, debunked arguments that Ive seen a million times over the last decade and a half.

Dr Cook added: He talks as if hes saying something insightful, but its a complete misunderstanding of how science works.

Dr Peterson did not respond to a request to comment from The Independent.

Joe Rogan guest claims pandemic is just a money grab, they are trying to kill us

Climate denial is nothing new, and has been around for as long as scientists have been sounding the alarm on the fact that humans are causing the steep rise in global temperatures, primarily from the burning of fossil fuels. Its less common, however, for climate myths to be pumped into the auditory canals of millions with only a glancing, credulous attempt at being challenged.

Podcasts are very intimate, says Dr Cook. Its like youre listening in on a conversation.

Rogans just asking questions style in which he seeks out fringe figures with unusual perspectives and mostly listens non-judgmentally actually plays into a highly common climate denial tactic, Dr Cook notes, that of spuriously casting doubt on scientific conclusions.

Joe Rogan vs Neil Young

Rogans statements about Covid-19 and its vaccines have attracted anger, as has his choice of guests to discuss the pandemic.

One recent interview was with Dr Robert Malone, an infectious disease specialist banned from Twitter for spreading misinformation. Dr Malone has questioned the Covid jabs effectiveness and falsely suggested that millions of people had been hypnotised into believing that the vaccines work to prevent serious disease.

Rogan has claimed that young people and children should not get the vaccine and inaccurately stated they are gene therapy. He has promoted the anti-parasite drug Ivermectin, whose effect on coronavirus remains unclear, and suggested that prolific conspiracy theorist Alex Jones was right to worry about microchips being hidden in Covid vaccines.

On the other hand, Rogan has also given a platform to an authoritative medical figure, Dr Sanjay Gupta, a neurosurgeon and chief medical correspondent for CNN.

Still, Mr Paterson of Media Matters for America says: [Rogan] plays a crucial role in the right-wing echo chamber by amplifying vaccine sceptics and coronavirus conspiracy theorists, says Mr Paterson, of Media Matters for America.

Dr Malones appearance prompted a group of doctors and scientists to sign an online petition calling on Spotify to adopt policies to prevent the spread of misinformation on its platform.

By allowing the propagation of false and societally harmful assertions, Spotify is enabling its hosted media to damage public trust in scientific research and sow doubt in the credibility of data-driven guidance offered by medical professionals, the letter read. It had been signed by more than 1,300 people as of Friday.

The veteran rocker Neil Young took issue with Rogans coronavirus misinformation and asked Spotify to remove his music this week.

They can have Rogan or Young. Not both, he wrote on his website.

Neil Young on stage in Quebec in 2018

(Alice Cliche / AFP via Getty Images)

Spotify has removed Youngs music from the platform, saying: We regret Neils decision to remove his music from Spotify, but hope to welcome him back soon.

The Joe Rogan episode with Dr Malone remains available.

Announcing his Spotify deal in 2020, Rogan stressed to his audience that it will be exactly the same show and that Spotify wont have any creative control.

Since then, he has repeatedly boasted about his freedom. Spotify has given me no pushback whatsoever. Its been amazing, he said in September. And in May, he said: Theyre f***ing great. They dont say s***.

He added: I tested it, too like when I brought Alex Jones on? I was like lets see! You guys talk a lot of s***, lets see! That f***ing guy is right way more than hes wrong.

Taking the biggest bite

All this comes as Spotify colonises the podcasting industry at breakneck pace.

Having launched in 2008, it is already the worlds largest music streaming service, according to Midia Research, controlling one-third of the market compared to 15 per cent for its next largest competitor, Apple music.

The company reports that it has 381 million users, including 172 million subscribers, across 184 markets and hosts 70 million tracks, including more than 3.2 million podcast titles. Some estimates now suggest it has a bigger podcast audience than Apple, the free app that comes pre-installed on every iPhone.

Joe Rogan continues to ignore covid science even as he reads it out loud

Among the 20,000 podcast episodes that Spotify claims to have removed due to vaccine misinformation include that of Australian anti-vaxxer and celebrity chef Pete Evans.

The policy applies to music too: Spotify reportedly nixed a controversial anti-lockdown song by Stone Roses frontman Ian Brown last March.

In 2018, it deleted several episodes of Infowars, a radio show hosted by Alex Jones, for hate speech. The interview with Mr Jones on The Joe Rogan Experience, is still available.

Spotify has not left Rogan completely alone. It has removed as many as 42 episodes dating from before his exclusive deal with the streaming service, including interviews with far right figures such as activist Milo Yiannopolous and Proud Boys founder Gavin McInnes.

Spotifys chief executive, Daniel Ek, has said that he does not believe Spotify has any editorial responsibility over its podcasts.

"We have a lot of really well-paid rappers too that make tens of millions of dollars, if not more, each year from Spotify, Mr Ek told Axios last year. And we dont dictate what theyre putting in their songs, either."

Audio misinformation is harder to challenge

Until recently misinformation on Spotify has flown under the radar compared to social networks such as Facebook, Dr Cook says.

One reason is because audio content is more difficult to search through and scrutinise compared to the short snippets of text, often tied to a URL, found on other platforms.

In the past, Dr Cooks team has used artificial intelligence (AI) to analyse data from blogs and think-tank publications, but he says that would be much harder to do with podcasts.

That makes it more difficult to track and challenge the reach of climate misinformation on Spotify even as the company boasts about its own green credentials and says it is listening to the science.

This is a really massive problem, says Dr Valerie Wirtschafter, a senior data analyst at the Brookings Institution, who has studied how disinformation spread through podcasts on the Big Lie that victory had been stolen from Donald Trump in the 2020 presidential election.

Dr Wirtschafter and her colleague Dr Chris Meserole, director of research for Brookings AI and Emerging Technology Initiative, are undertaking new research which will analyse 79 podcasts and 37,000 episodes for verifiable falsehoods on the Covid pandemic, while also exploring broader disinformation including climate denial.

Figuring out the reach of audio disinformation is critical due to how listeners respond to the medium.

The [podcast hosts] are in your ear, youre often listening to them alone, you choose when to start these episodes, Dr Wirtschafter says, noting that research has shown that people are more likely to incorporate information they hear from podcasts into their beliefs.

Theres an intimacy factor, she added. These hosts often develop identities, personalities that people gravitate toward. Thats really important in this conversation. On the flip side of that intimacy, theres this implicit level of trust that gets built. But that podcaster could be anybody.

Why Spotify needs Joe Rogan

The big question is: will Spotify ever part ways with its number one podcasting star? According to John Sullivan, a professor at Muhlenberg College in Pennsylvania who studies podcasting and tech industries, that is not likely.

Spotify honestly couldnt have cared less about Joe Rogan; what they wanted was Joe Rogans audience, says Professor Sullivan.

He argues that Spotify should not be seen as a media company, because its game plan is simply to suck as much of the podcast industry into its platform as possible, with each exclusive content deal a means to that end.

Traditionally, podcasts have been distributed via web links that made it hard to measure their audience and almost impossible to censor them.

By contrast, Spotify is a very sophisticated surveillance machine that tracks every second of its users listening, helping it develop recommendation algorithms that keep subscribers on board and sell targeted adverts aimed at non-subscribers.

As such, Prof Sullivan says the company needs to grow as big as possible as quickly as it can so that it can become dominant before regulators and politicians grow restive.

If it can get to that point, then, like Facebook, it will be rich enough to resist or adapt to whatever new regulations come its way.

At the moment its fair to say that Spotify needs [Rogan] more than the other way around, says Prof Sullivan. Its in a moment now where its trying to maximise its growth as quickly as possible. Someone like Joe Rogan is in an ideal position, because he holds the keys to that growth so that probably gives him a level of confidence about saying and doing whatever he would like.

He adds that Spotifys reported $100m investment in Mr Rogan will make it harder to give him up, to say nothing of the public firestorm it could ignite by deplatforming him.

The current approach may already be bearing fruit. According to Chartmetrics, Joe Rogans followers on Instagram are posting about Spotify more often over time, having started out less interested in it than the average user.

However, musicians might be able to force its hand if they follow the path of Young and pull their content from the service. A big enough boycott, Prof Sullivan says, would bite into Spotifys core revenue.

In the meantime, Dr Cook believes that Spotifys supposed rules against dangerous Covid-19 misinformation should be extended to other kinds.

While many tech giants put false Covid claims in a different category, saying they can directly cause harm to life and limb, Dr Cook says this is short-sighted.

Covid misinformation is much more immediate, says Dr Cook. People will hear something, and then theyll step outside and not wear a mask, or they wont get vaccinated, or they wont socially distance.

Climate misinformation is more complicated, because its such a holistic issue. Its long-term, its global. Its harder to get our head around, but the threat is actually much greater than Covid misinformation because its this existential problem on a global scale, decades and centuries into the future.

The rest is here:

He can do what he likes: Inside Spotifys love affair with Joe Rogans misinformation - The Independent

RIYADH: Spreading the truth about climate change and the need for sustainability is very important in relation to a changing climate, and how it impacts life on Earth, said panelists at a discussion hosted by the Swedish and Swiss embassies to the Kingdom.

Swedish Ambassador Niclas Trouv and his Swiss counterpart Andr Schaller jointly organized the discussion on climate and sustainability perspectives on Thursday night, at the Swedish ambassadors residence in Riyadh, where some of the best drivers in motorsport have gathered ahead of Season 8 of the ABB FIA Formula E World Championship.

The much anticipated first race on Friday night begins with a double-header in Diriyah, promising an exhilarating race experience using electric cars.

Run under LED lights at the UNESCO World Heritage Site on the outskirts of Riyadh, the night races, which will take place on Jan. 28 and 29, are being held in the Kingdom for the fourth consecutive year since the venue joined the calendar in 2018.

Speaking to Arab News, Trouv said: We had an important discussion in the panel. The occasion why we are here is the ABB-sponsored Formula E race. What is interesting now is the feel here in the Kingdom, and also of course in Sweden and Switzerland and the rest of the world, the enormous push that we feel now for sustainable green solutions.

As I shared with the audience here at the discussion, almost half of the new cars that were sold in Sweden last year were non-carbon, nonfossil, i.e electric or hybrid cars. Around the world, we now see an enormous push for electric vehicles like the Formula E races, as we will see on Friday night in Diriyah.

Sweden and Switzerlands embassies co-hosted the panel discussion, and we are both at the forefront, we want to cooperate with the Kingdom, we want co-creation and innovation together with our Saudi friends and we are ready for business and investment to make the Vision 2030 a reality so that Saudi Arabia also can continue on this very important role towards the sustainable carbon-free future,said the envoy.

Schaller said: Congratulation to Saudi Arabia and also to the ABB for bringing Formula E World Championship races to Diriyah for the fourth consecutive time. It is a race to the future for the sustainable future and it also crosses the rich history and heritage in the Kingdom in front of the wonderful UNESCO World Heritage site.

Its also about the message, the message that if you can do races like this with sustainable and renewable energy-backed electric cars, you can apply the same for commercial vehicles, said Schaller adding these cars do not carry passengers, but it carries an important message.

Formula E CEO Jamie Reigle said: We are delighted to be back to Diriyah for the fourth time, Saudi Arabia is one of the features in the race series of our global calendar. For the last two years we were not able to host the fans because of the coronavirus pandemic. We are happy to host the fans this time, that great news.

We will be doing the live race for the second time ever under the lights, and this is going to be carbon neutral using electric vehicles, and LED lighting. All of the energy consumed for the race is biofuel.

Another panelist, Mohammed Al-Mousa, county managing director of ABB Saudi Arabia, said that technology leader ABB has played a crucial role over years in the Kingdom and is keen to continue the success story of demonstrating sustainable energy commitment, e-mobility and carbon neutrality.

Original post:
Saudi team wins bronze at international cryptography Olympiad event in Russia - Arab News

Bitcoin was the first true cryptocurrency worthy of the name, developed in 2009 by an unknown programmer (or group of programmers) known by the nickname of Satoshi Nakamoto, which first theorized and then created the first true virtual currency based on cryptography. Bitcoin, like almost all cryptocurrencies created subsequently, is based on miningthat is, on the extraction of data through a complex system based on nodes (ie computers connected to each other) and which requires a large amount of energy.

This also contributes to creating pollution, since in the long run the mining compromises the physical integrity of computers, a factor that has contributed to fueling criticism of Bitcoin and all related cryptocurrencies that use the same system, especially in a context green which is becoming more and more popular also in the economic world, to the point that states are making a commitment (at least those that enjoy constant growth) to use less polluting and renewable forms of energy.

The ups and downs of the value of Bitcoin is partly attributable to the situation in Kazakhstan, a country that is going through a period of political and social disagreements mainly due to energy difficulties, a context that has been partly influenced by this mining work. For some years, in fact, numerous investors had decided to move their mining operations to the country, which has become the 2nd largest producer of cryptographic tokens, especially after the bans by China.

Since 2017, the Kazakh government has instead opened its doors to investors but now the situation has worsened to the point that the country is no longer able to keep up with the increasing demand for energy.

Many are ready to bet on a new emigration by investors to new countries, and precisely this stalemate is attributable, at least in part to the value of Bitcoin, which has not undergone positive changes.

Source link

Go here to see the original:
What happens to Bitcoin? Crazy, heres the news - D1SoftballNews.com

Finders panel of 33 fintech specialists has forecasted that the price of bitcoin will peak at about $94K before ending the year above $76K. In addition, the panel expects the price of the cryptocurrency to reach $192,800 in 2025 and $406,400 in 2030.

Finder, a major product comparison website, published an updated bitcoin price prediction Wednesday for 2022 by Finders panel of 33 fintech specialists.

According to the panels BTC price forecasts:

Bitcoin (BTC) is expected to peak at US$93,717 this year before dropping to $76,360 by the end of 2022 This is roughly 60% higher than the price of bitcoin at the beginning of 2022.

The panel of specialists also predicted the price of bitcoin for 2025 and 2030. However, their most recent predictions are lower than their October forecasts. At the time of writing, the price of bitcoin is $36,311.13 based on data from Bitcoin.com Markets.

By the end of 2025, the panel believes that the price of bitcoin will reach $192,800, which is 7% lower than their October forecast.

As for the end of 2030, the panel expects the price of bitcoin to reach $406,400, which is 28% lower than their October forecast.

Finder explained:

Potential interest rate hikes might be whats leading the panel to be more conservative with their predictions compared to back in October.

While the Fed did not raise interest rates at its most recent meeting, the market expects the central bank to raise interest rates several times this year. Investment bank JPMorgan, for example, expects four rate hikes this year.

While several panelists said that increasing interest rates will negatively impact the cryptocurrency market, some believe that it is time to buy BTC, including Finders founder, Fred Schebesta.

He said:

Cryptocurrencies are proving to be a staple competitor to the traditional financial infrastructure of the world, and many projects are now well beyond the theoretical realm of potential value and into reliable delivery.

One powerfully unique aspect of the cryptocurrency landscape is that there are now a number of decentralized finance (defi) platforms that provide access to highly competitive funding, and these offerings are showing zero signs of slowing down, he further opined.

Schebesta personally expects bitcoins price to surge to about $105K by the end of the year, he recently told Daily Mail Australia.

What do you think about the predictions by Finders experts? Let us know in the comments section below.

A student of Austrian Economics, Kevin found Bitcoin in 2011 and has been an evangelist ever since. His interests lie in Bitcoin security, open-source systems, network effects and the intersection between economics and cryptography.

Image Credits: Shutterstock, Pixabay, Wiki Commons

Disclaimer: This article is for informational purposes only. It is not a direct offer or solicitation of an offer to buy or sell, or a recommendation or endorsement of any products, services, or companies. Bitcoin.com does not provide investment, tax, legal, or accounting advice. Neither the company nor the author is responsible, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with the use of or reliance on any content, goods or services mentioned in this article.

Read the original here:
Finder's Experts Predict Bitcoin Will Peak at $94K This Year Markets and Prices Bitcoin News - Bitcoin News