Helium Computer: Verifiable Computation via Zero-Knowledge Proofs and Hardware Attestation

The helium computer project stands out as a noteworthy effort to bring verifiable computation into practical use across distributed networks. By focusing on transparency as a core principle, the initiative addresses longstanding concerns about whether complex calculations performed on remote machines can be trusted without direct oversight. The approach outlined on the helium.computer blog explains how cryptographic proofs and open verification methods allow anyone to confirm that specific tasks were executed exactly as claimed.

At its foundation, the system relies on zero-knowledge proofs combined with specialized hardware attestations. These tools generate compact certificates that demonstrate a program ran correctly on authorized equipment while keeping the underlying data private when necessary. The blog post highlights that such certificates can be independently checked by any participant in the network, removing the need to trust a central operator or a single cloud provider. This model shifts the balance from blind faith toward mathematical certainty, a change that carries implications for fields ranging from artificial intelligence training to financial modeling.

The motivation for this work stems from repeated incidents in which users discovered discrepancies between promised and actual computation. Reports of altered training runs, hidden backdoors in inference engines, and opaque pricing models have eroded confidence in outsourced processing. Helium Computer responds by requiring every node to produce a verifiable record of its activity. When a machine completes a workload, it attaches a proof that links the input, the program logic, and the output in an unforgeable chain. Verifiers can sample these records at random and confirm their accuracy without rerunning the entire job, which keeps costs manageable even at large scale.

One practical application involves large language model inference. Organizations that depend on external services for generating text or analyzing documents often worry about data leakage or model tampering. With Helium’s framework, a service provider can prove that a specific model version processed a given prompt and produced a particular response. The proof reveals nothing about the model weights themselves, preserving proprietary information while still allowing the customer to audit the integrity of the operation. The blog entry notes that this capability opens doors for regulated industries where audit trails are mandatory.

Another area of focus is decentralized training of machine learning models. Instead of concentrating compute power in a handful of data centers, the network can recruit GPUs and TPUs from many independent operators. Each contributor submits a proof alongside gradient updates or checkpoint files. Aggregators then verify that the submitted work matches the expected training protocol before incorporating the results. This arrangement reduces single points of failure and spreads economic incentives across a wider group of hardware owners. The transparency layer ensures that no participant can inject malicious updates without detection.

Hardware plays a central role in making these guarantees practical. The system incorporates devices that support remote attestation, a feature built into modern secure processors. When a node boots, it generates a cryptographic signature that identifies both the hardware model and the exact software image loaded into memory. This signature becomes part of the larger proof chain, linking the physical machine to the logical execution. The helium.computer blog explains that without this hardware root of trust, software-only proofs would remain vulnerable to kernel-level manipulation.

Beyond the technical architecture, the project places emphasis on open specifications. All proof formats, verification algorithms, and attestation protocols are published under permissive licenses. Independent researchers can implement their own checkers and run parallel validations, creating a marketplace of auditors rather than a monopoly. This openness contrasts with proprietary systems that keep their validation methods secret, often citing security through obscurity. Helium Computer argues that true security emerges only when multiple parties can examine and improve the same verification code.

Economic design also receives careful attention. Nodes earn rewards for completing verifiable tasks, with payouts tied directly to the quality and timeliness of their proofs. If a node fails to produce a valid certificate or if its hardware attestation does not match the registered profile, the network can slash its stake or withhold payment. This mechanism discourages cheating and encourages operators to maintain clean, up-to-date equipment. The blog post points out that such incentives align individual profit motives with collective trust requirements, a balance often missing from volunteer-based distributed computing projects.

Scalability remains an active research topic. Generating succinct proofs for very large computations can require substantial overhead, both in time and memory. The team has explored recursive proof composition, where smaller proofs are combined into a single master certificate that still validates the entire workload. Early benchmarks suggest that verification time stays nearly constant even as the original job grows to millions of GPU hours. Continued improvements in proof systems, such as newer folding schemes and hardware-accelerated polynomial commitments, are expected to drive these costs down further.

Privacy considerations receive equal weight. Many workloads involve sensitive information that cannot be revealed during verification. Zero-knowledge techniques allow proofs to attest to correct execution without exposing the data that was processed. For example, a medical research group could confirm that a statistical model was trained on patient records without ever disclosing those records to the compute provider or to the public verifiers. The same holds for proprietary algorithms in financial risk systems or recommendation engines. The blog entry underscores that privacy and transparency are not mutually exclusive when the right cryptographic primitives are applied.

Adoption pathways include integration with existing cloud orchestration tools. Developers can submit jobs through familiar interfaces while the backend automatically wraps them in proof-generating runtimes. This compatibility lowers the barrier for teams already invested in containerized workflows. Over time, the project anticipates that proof generation will become a standard checkbox option in major cloud platforms, much like encryption at rest or audit logging. As more organizations demand verifiable computation, providers that cannot supply proofs may find themselves at a competitive disadvantage.

Challenges persist. Not every algorithm lends itself easily to efficient proof generation. Certain floating-point operations common in scientific computing still require careful reformulation to fit within the constraints of current proof systems. Similarly, interactive machine learning pipelines that depend on human feedback loops introduce timing and nondeterminism issues that must be handled explicitly. The helium computer team acknowledges these limitations and publishes regular updates on which workloads are fully supported and which require additional engineering.

Community governance adds another layer of transparency. Decisions about protocol upgrades, supported hardware profiles, and dispute resolution mechanisms are made through on-chain voting weighted by staked tokens. This structure prevents any single company from unilaterally changing the rules. Detailed meeting notes and code repositories are available for public inspection, allowing outside contributors to follow along and submit improvements. The blog post presents this openness as essential for long-term credibility, especially when the network’s value rests on collective confidence.

Looking forward, the project aims to expand beyond pure computation into data availability and storage proofs. Combining verifiable execution with guaranteed data persistence would create end-to-end assurances for complete data pipelines. A researcher could prove that a dataset was stored reliably, preprocessed according to documented steps, and then used to train a model whose outputs satisfy predefined statistical tests. Each link in that chain would carry its own cryptographic evidence, forming a tamper-proof audit log spanning multiple operators and time periods.

Educational resources also form part of the initiative. The blog regularly publishes tutorials on how to generate and verify proofs using open-source libraries. Sample code demonstrates integration with popular deep learning frameworks, showing developers how little extra work is required to add transparency to their existing pipelines. By lowering the technical barrier, the project hopes to encourage broader experimentation and feedback from real-world users.

In practice, several pilot programs have already tested the system at modest scale. A financial analytics firm used the network to run Monte Carlo simulations for portfolio stress testing. Each simulation run produced a proof that the random seeds, model parameters, and numerical methods followed the approved specification. Auditors could later confirm that no shortcuts were taken and that the reported risk metrics were derived from the stated inputs. The firm reported that this verifiable approach satisfied both internal compliance teams and external regulators more effectively than traditional signed reports.

Another pilot involved training a computer vision model on crowdsourced imagery. Contributors uploaded photos along with metadata proofs that established the images had not been altered after capture. Training nodes then produced a certificate showing that the model had been updated only with verified data and according to the agreed learning schedule. The resulting model could be distributed with a guarantee of provenance, giving downstream users confidence that the training set met quality and ethical standards.

These examples illustrate how verifiable computation moves from theoretical possibility to daily utility. As hardware becomes more efficient at generating proofs and as software libraries mature, the overhead continues to shrink. The helium.computer blog maintains that the ultimate goal is to make transparency the default setting for any outsourced workload, so that trust becomes an automatic property rather than an expensive add-on.

The broader impact could extend to scientific research, where reproducibility has become a pressing concern. Journals increasingly require authors to share not only data and code but also the exact compute environment used to produce published results. A verifiable compute layer would allow researchers to attach a compact proof to their papers, letting peers confirm that the claimed experiments were executed faithfully. This practice would reduce the frequency of retracted studies and accelerate collective progress by making verification faster and cheaper.

Regulatory bodies may also find value in the approach. Agencies responsible for overseeing algorithmic trading, credit scoring, or medical device software could require proof-based attestations instead of self-reported compliance. Because the proofs are machine-checkable, enforcement becomes partly automated, freeing human auditors to focus on higher-level policy questions. The cryptographic receipts would serve as digital equivalents of sealed laboratory notebooks, providing immutable evidence of proper procedure.

Helium Computer’s emphasis on transparency therefore addresses both technical and societal needs. By combining hardware roots of trust, succinct cryptographic proofs, open specifications, and aligned economic incentives, the project constructs a foundation on which more reliable distributed systems can be built. The ongoing work documented on the project’s blog demonstrates steady progress toward making verifiable computation accessible, affordable, and routine across a growing range of applications. As these tools become standard practice, the distinction between trusted and untrusted compute environments may gradually disappear, replaced by environments where correctness can be confirmed by anyone at any time.

from WebProNews https://ift.tt/sx9OvUE

Meta’s Muse Image Lets Strangers Generate Your Face From Instagram Photos — And It’s On By Default

Meta rolled out Muse Image on July 7. The new model from Meta Superintelligence Labs generates and edits pictures with striking accuracy. It handles complex prompts. It pulls from multiple references. And it turns public Instagram profiles into raw material for anyone who types an @-mention.

But here’s the part that lands like a quiet bombshell. If your Instagram account sits on public settings, others can create images of you. No permission asked. No alert sent. You’re opted in from the start.

The Mechanics Behind the Likeness Grab

The process looks simple on the surface. A user opens Meta AI in Instagram, WhatsApp or the dedicated app. They type a prompt. They add @yourusername as a reference. Muse Image scans available public photos. It blends your features into whatever scene the prompter describes. The output carries an invisible Content Seal watermark. Yet that mark only identifies the image as AI-made. It does nothing to stop creation or notify the subject.

Meta’s own policy states the rule without apology. Instagram Help Center explains: “You will not be notified about content created using AI features at Meta.” The same page notes that public accounts on default settings allow “people may be able to create content with your Instagram content using AI features at Meta.” No push notification announced the change. No explicit consent screen appeared for millions of users.

And. This isn’t some distant beta test. Reports surfaced within hours of launch. TechCrunch detailed how the feature fits a pattern Meta has repeated before. TechCrunch pointed to the company’s 2021 decision to shut down facial recognition after lawsuits and regulatory heat. Now the same data practices return under a creative banner. Users retain some control through settings. But the default favors broad access.

Wired tested the rollout and found the updated language hadn’t reached every account by Tuesday afternoon. Wired described the fastest fix: switch the account to private via browser. The mobile app path requires more steps. Profile. Hamburger menu. Sharing and reuse. Toggle off both Posts and Reels under the section labeled “Allow people to use your content on Instagram and with AI features on Meta.” Even then, previously generated images stay in circulation. The opt-out blocks only future use.

Gizmodo captured the frustration in real time. Gizmodo noted the burden falls entirely on individuals to discover and disable the capability. Privacy advocates have flagged this approach for years. Meta collects vast stores of faces and contexts. Then it opens selective doors unless users actively close them.

The Digital Trends piece that first highlighted the default-on status pulled no punches. Digital Trends observed that a watermark alone fails to address deeper questions of likeness rights. Creators, influencers and ordinary users now compete with synthetic versions of themselves. Some versions will flatter. Others will distort. A few could damage reputations. None require the original person’s approval.

Yet Meta frames the release as pure advancement. In its announcement, the company called Muse Image its most advanced image generation model yet. It follows instructions faithfully. It edits with precision. It composes from multiple references. Early tests shared on X showed the system combining web search, text rendering and multi-stage editing. One post from AI researcher Alexandr Wang linked to research samples that demonstrated these strengths. But the same capabilities that impress engineers also amplify the privacy stakes.

Public reaction on X mixed excitement with alarm. Multiple users posted warnings within the first 24 hours. One account shared the WION News article that called the feature a pathway to deepfakes. WION emphasized that strangers can now @-mention any public profile and pull facial data without consent or notification. The story stressed the absence of proactive outreach from Meta. No mass email. No in-app banner. Just a revised help page that most users will never read.

This pattern echoes earlier Meta moves on AI training data. The company faced backlash in 2024 when it updated policies to scrape public posts for model improvement. European regulators pushed back. Some users formed opt-out campaigns. Now the focus shifts from training to direct generation. The data stays inside Meta’s systems. The outputs spread across chats, stories and external platforms.

So what happens when a brand, a troll or a marketer generates dozens of images featuring your face in fabricated scenarios? Current tools offer limited recourse. Reporting mechanisms exist for harassment or impersonation. But proving harm from a single AI image remains difficult. Watermarks help detect fakes after the fact. They don’t prevent the initial creation.

Meta insists users hold the reins. Settings exist. Private accounts limit exposure. The company shut down its old facial recognition system amid criticism. Yet the new feature revives similar data practices under the banner of creativity. Regulators in the EU and elsewhere have already signaled interest in biometric data and consent defaults. Lawsuits over likeness rights have multiplied as generative tools proliferate.

Industry watchers expect further scrutiny. The speed of deployment outpaced communication. The default setting maximized adoption at the expense of awareness. And the technology itself continues to improve. Muse Video sits in preview. Future updates could extend the same reference system to moving images. The stakes rise accordingly.

Users who want to act now face a clear but imperfect path. Make the account private. Disable the content reuse toggle. Monitor for unauthorized images in the wild. These steps reduce risk. They don’t eliminate it. Existing generations persist. And determined prompters can still reference cached or shared versions of public photos.

The launch reveals a deeper tension. Tech giants race to ship powerful media tools. They build on years of accumulated user data. They prioritize engagement and capability over exhaustive consent flows. The result feels both inevitable and unsettling. Powerful AI arrives. Your face helps power it. Whether you like it or not.

Meta has updated its help documentation. It has provided opt-out instructions. It has added technical safeguards like invisible watermarks. But the core choice remains: broad access by default, individual action required to withdraw. That choice will define the conversation in the weeks ahead. As more users discover the feature through articles or personal experience, pressure will build for clearer notifications, retroactive controls or stricter defaults.

One thing is certain. The images are already being made. Some will delight their subjects. Others will provoke outrage. A few may spark legal tests. All of them trace back to the same pool of public Instagram photos. And to a policy that assumed most people wouldn’t mind until they did.

from WebProNews https://ift.tt/qZDveE2

Robot Labor Takes Shape: AI Pushes Autonomy From Warehouses to Uncertain Horizons

Robots have long handled the dirty, dull and dangerous jobs. Yet something shifted in recent years. Advances in artificial intelligence now point toward machines that tackle sequences of unpredictable tasks without constant human guidance. The change arrives not from one breakthrough but from the steady stacking of data, models and hardware improvements.

From Narrow Tasks to Broader Capabilities

Industrial robots once followed rigid scripts inside safety cages. Today many operate with greater independence. Boston Dynamics deploys its four-legged Spot for inspections in hazardous spots. The machine navigates slippery surfaces thanks to reinforcement learning that lets it recover balance after slips. Its wheeled cousin Stretch grabs totes in warehouses run by DHL and others. These systems show autonomy works best in controlled settings. But real-world messiness changes everything.

Ars Technica examined this shift in a feature published Tuesday. Experts there describe autonomy as a moving target. ISO standards define it as a machine performing tasks based on its current state and sensed data without outside help. Matt Malchano, vice president of software at Boston Dynamics, captured the evolution. “When I started maybe about 15 years ago… the goal was to just get a robot to navigate from point A to point B,” he said. “And now, when we think of autonomy, we think of this huge space of tasks.” (Ars Technica)

Sergey Levine, professor at UC Berkeley and cofounder of Physical Intelligence, stressed the data requirement. “The key to making modern machine learning systems work is to get enough of a critical mass of data so that we see generalization,” Levine explained. “You can either have something that is kind of OK but not amazing at everything or something that’s extremely good at one thing… We really want something that’s extremely good at all things.” The company he helps lead trains a single foundation model that recombines skills across commands and robot types. Success hinges on scale. Without enough varied examples, robots falter when conditions drift even slightly.

Jonathan Hurst, cofounder of Agility Robotics, put the difficulty in perspective. “It’s dramatically harder to have an embodied AI; it’s 10 times harder to have an embodied AI,” he told the publication. Agility’s Digit humanoid currently moves totes in warehouses for GXO, Toyota, Schaeffler and Mercado Libre. Amazon tests it too. Yet deployments keep robots inside work cells separated from people. Safety remains paramount. Hurst noted that true autonomy will eventually mean deciding how to respond when handed a baby. That day sits far off.

Recent industry reports reinforce the pattern. The International Federation of Robotics highlighted agentic AI as a top trend for 2026. This hybrid combines analytical AI for decisions with generative AI for adaptability. The result aims at machines that handle complex environments on their own. (IFR)

Epoch AI assessed current robot performance in February. Navigation succeeds commercially in food delivery and warehouse transport. Manipulation works in structured warehouse picking but stalls in homes or multi-step jobs. Transfer to new objects or settings stays rare. Most systems require task-specific fine-tuning. That bottleneck limits scale. (Epoch AI)

Progress shows in simulation and hardware too. NVIDIA supports benchmarks such as RoboLab for testing generalist policies. University of Maryland researchers, backed by NVIDIA grants, build AI humanoids for household chores. Their systems blend generative AI with sequential decision-making. FieldAI supplies embodied software that works across robot types and recently partnered with Boston Dynamics for dynamic sites. These moves suggest the software layer may prove as decisive as the hardware.

Tesla pursues its Optimus humanoid to manage unsafe or repetitive work. The company applies vision and planning techniques refined in its vehicle fleet. Figure AI targets warehouses and factories with foundation models paired to physical manipulation. Physical Intelligence, Skild AI and others chase a single brain that transfers across bodies and tasks. Venture money flows. Analysts watch for the moment when one model delivers consistent results outside the lab.

Yet gaps persist. Training demands enormous data. Teleoperation by humans costs money and time. Simulations omit real physics quirks. World models that predict outcomes burn compute. Reinforcement learning can suffer catastrophic forgetting when new skills overwrite old ones. And safety incidents linger in memory. A 1979 case in which a Ford robot killed worker Robert Williams still informs standards. Surgical systems from Intuitive delegate most decisions to doctors. Bhushan Patel, principal technical program manager there, said the issue centers on how much control passes to the machine. “The question is not whether the robot is autonomous or not,” he observed. “The question is how much decision-making and action execution we are delegating to machine versus human.” Only a few FDA-cleared systems approach level three autonomy.

Dipam Patel, a Purdue PhD student working with the US Army, offered a blunt standard. “The robot should be able to do everything on its own without any external dependencies. Only then can we push towards general-purpose robots.” His view echoes the long road ahead. Agility aims to ship Digit v5, its first cooperatively safe AI-enabled humanoid, within the next 12 months. Hyundai trains Atlas humanoids at a metaplant for possible 2028 deployment in electric-vehicle production. Timelines stretch. Full home deployment that handles children or fragile objects could take decades.

Economics will decide adoption speed. One human supervising ten robots slashes costs below human labor. Recent reinforcement learning work shared on X improved recovery from mid-task errors. Success rates on 16-step missions rose from 38 percent to 71 percent. The gain matters because real deployments meet surprises. Robots that self-correct reduce supervision needs. That shifts the math. Companies such as BMW and Tesla see compound returns. A purchased robot holds value years later. Wages rise.

Investment and research accelerate. The AI boom draws robotics PhDs at record rates. Conferences like AUTONOMOUS 2026 in San Francisco gather founders focused on foundation models, sim-to-real gaps and compute stacks. BCG analysts describe physical AI as systems that maintain causal world models, predict results and reason under uncertainty. Level five reasoning, where robots pursue complex goals over time, still sits in the aspirational column. (BCG)

National security analysts note parallel advances. Google DeepMind’s Robotic Transformer 2 handles novel scenarios. NVIDIA’s Isaac GR00T foundation model targets generalized humanoid skills with fast and slow thinking modes. China aims to lead in humanoids by 2027. Market forecasts reach tens of billions within a decade. The UK launched a £52 million robotics adoption program earlier this year.

Form factors vary. Humanoids suit many roles but not all. Some jobs need small arms for tight apartments. Others require giant machines for farms. The best shape matches the work. That flexibility could widen deployment faster than pure bipedal designs.

Challenges remain formidable. Unstructured homes differ sharply from factory floors. Error recovery, long-horizon planning and safe interaction with people demand further gains. Regulatory standards evolve. Public acceptance hinges on proven reliability. Unions at Hyundai raised concerns during earlier Atlas tests.

Still the momentum builds. What once looked like science fiction now appears as incremental engineering problems. Robots already inspect bridges, move packages and scout crops. Next they may stock retail shelves, deliver inside buildings or assist in hospitals. Each successful niche funds the next capability jump.

Researchers and executives agree on one point. General-purpose autonomy will arrive gradually. No single demo will mark the transition. Instead a thousand small improvements compound until the machines simply work. When that happens the definition of labor changes. And the factories, warehouses and eventually homes that welcome these new workers will look different. The only certainty is that the machines are learning faster than before.

from WebProNews https://ift.tt/zGnL2aN

UK Plans Binding Regulations for Powerful Foundation AI Models

Britain is weighing new measures to supervise the most powerful artificial intelligence systems as concerns grow about their potential effects on national security, public safety, and economic stability. The government has signaled it may introduce binding rules specifically aimed at the largest AI models, those capable of generating text, images, and code at scales that smaller systems cannot match. This development reflects a broader international conversation about how to balance innovation with accountability without stifling the technology’s rapid progress.

Officials in London have studied the behavior of so-called foundation models, the large-scale neural networks trained on vast datasets that underpin tools like ChatGPT and its successors. These systems can produce convincing answers to complex questions, create realistic media, and assist with software development at speeds that outpace human teams. While many experts praise their productivity benefits, others warn that unchecked deployment could amplify risks ranging from misinformation campaigns to the automation of dangerous knowledge in biotechnology and cybersecurity.

The discussion in Britain draws heavily from a report issued by the Alan Turing Institute, which examined how different regulatory approaches might apply to frontier AI. According to the institute’s analysis, models that demonstrate high levels of capability in multiple domains warrant closer oversight because their outputs can influence decisions in healthcare, finance, education, and defense. The report recommends that regulators focus on the models themselves rather than only on the companies that deploy them through consumer apps.

This stance marks a shift from earlier UK policy that favored light-touch principles over prescriptive laws. In 2023 the government published an AI regulation white paper that emphasized existing legal frameworks and sectoral regulators rather than creating a new central authority. Yet evidence submitted to parliamentary committees since then has highlighted gaps in that approach. Lawmakers heard testimony that current rules on data protection, product safety, and online harms do not fully address the unique properties of generative systems that can hallucinate facts, reproduce copyrighted material without permission, or assist in the design of chemical weapons.

One proposal under consideration would require developers of the most advanced models to register with a new oversight body before releasing them for public use. Registration could involve submitting technical documentation about training methods, safety testing procedures, and plans for ongoing monitoring after deployment. Such a system would resemble the pre-market approval processes used for pharmaceuticals or aircraft, though adapted to the fluid nature of software updates. Proponents argue this would create transparency without revealing proprietary algorithms.

Critics of heavy regulation counter that Britain risks falling behind if it imposes burdens not matched by other countries. The United States has so far avoided comprehensive federal legislation, preferring executive orders and voluntary commitments from leading technology firms. The European Union, by contrast, has moved forward with its AI Act, which classifies systems by risk level and imposes strict obligations on providers of general-purpose models. British officials are studying both models to decide which elements might suit the country’s legal traditions and economic priorities.

The financial services sector has emerged as an influential voice in these debates. Banks and insurers already use machine learning for fraud detection, credit scoring, and investment analysis. Many worry that opaque AI decisions could violate consumer protection laws or create systemic risks if models behave unpredictably during market stress. The Bank of England and the Financial Conduct Authority have jointly explored how to test AI systems for fairness and resilience, publishing discussion papers that feed into the wider governmental review.

Public opinion surveys conducted by the Ada Lovelace Institute show mixed attitudes. A majority of respondents support the idea of rules that protect privacy and prevent discrimination, yet many also express excitement about AI’s potential to speed scientific discovery and ease administrative burdens in the National Health Service. This tension between hope and caution shapes the political conversation, with ministers seeking a middle path that reassures voters without alienating technology investors.

Industry representatives from companies with major operations in Britain have urged the government to coordinate with international partners. The United Kingdom hosts significant AI research talent, particularly in universities such as Oxford, Cambridge, and Edinburgh, as well as corporate labs maintained by Google, Microsoft, and smaller startups. These organizations argue that divergent national standards could fragment markets and raise compliance costs. Some have proposed shared evaluation frameworks, similar to those used in aviation safety, where governments mutually recognize test results from accredited facilities.

Safety researchers have documented numerous failure modes that regulators must address. Large language models can be prompted to generate instructions for synthesizing opioids or building improvised explosive devices. They can also be tricked into revealing training data that contains personal information. Red-teaming exercises, in which specialists deliberately stress systems to expose weaknesses, have become standard practice among responsible developers, yet participation remains voluntary. A regulatory regime could make such testing mandatory and require independent verification of results.

Intellectual property questions add another layer of complexity. Creators of books, music, films, and code have filed lawsuits claiming that AI companies infringed copyrights by training models on their works without permission or compensation. British courts are expected to clarify aspects of fair dealing exceptions, but legislators may choose to update copyright law to reflect the new realities of machine learning. Any solution will need to balance incentives for human creators with the data requirements of model training.

Energy consumption presents an environmental dimension. Training a single frontier model can require electricity equivalent to the annual usage of hundreds of households. Data centers dedicated to AI already strain power grids in some regions, and projections suggest demand will grow sharply. Policymakers are therefore considering whether environmental impact assessments should form part of the approval process for new systems, alongside technical safety evaluations.

Education and workforce policy must adapt as well. The rapid spread of generative tools has prompted schools and universities to rethink assessment methods and curricula. Some institutions now teach students how to prompt AI systems effectively and how to critique their outputs, treating these skills as core competencies. At the national level, skills agencies are examining which occupations face the greatest disruption and how retraining programs can prepare workers for roles that emphasize emotional intelligence, creative problem-solving, and oversight of automated processes.

The security services have expressed particular interest in AI governance. Intelligence agencies worry about adversaries using advanced models to automate cyberattacks, spread propaganda at scale, or design novel biological agents. At the same time, the same technology offers defensive advantages if British researchers stay ahead in developing secure and aligned systems. This dual-use character explains why talks between the Department for Science, Innovation and Technology and the intelligence community have intensified.

International cooperation forums such as the G7 and the OECD have produced voluntary codes of conduct, yet enforcement remains limited. Britain has hosted global AI safety summits that brought together governments, companies, and academics to agree on shared principles. The next phase involves translating those principles into concrete mechanisms such as standardized benchmarks for measuring model capabilities and agreed protocols for reporting dangerous incidents.

Parliamentary committees continue to gather evidence from a wide range of stakeholders. Their reports are expected to influence the shape of any forthcoming legislation. Key questions include whether oversight should rest with a single new regulator or be distributed across existing bodies with enhanced powers. Another debate centers on whether rules should apply only to models above a certain size threshold measured by parameters or computational resources, or whether capability benchmarks offer a more future-proof approach.

Smaller AI companies fear that compliance costs could favor large incumbents who already employ teams of lawyers and policy experts. To address this concern, officials are exploring tiered requirements that scale with the resources and reach of each developer. Open-source models raise additional challenges because their weights can be downloaded and modified by anyone, making traditional licensing and audit trails difficult to enforce.

Despite these hurdles, many participants in the conversation believe Britain is well positioned to craft sensible policy. The country’s common-law tradition allows flexible adaptation as technology changes. Its strong research base and financial sector provide both expertise and practical testbeds. If the government can design proportionate rules that command public confidence while preserving space for experimentation, it could set an example for other mid-sized economies seeking to manage AI’s societal effects.

The coming months will reveal whether ministers opt for primary legislation or prefer to amend existing statutes. Either route will require careful drafting to avoid unintended consequences such as driving talent overseas or discouraging investment. Continuous dialogue with the technology community, civil society groups, and international counterparts will remain essential as the capabilities of AI models continue to advance at an astonishing pace. The goal is to harness the benefits while reducing the likelihood of serious harm, a task that demands both technical understanding and political judgment.

from WebProNews https://ift.tt/Yxr91kc

OpenRazer 3.12.4 Patches Linux Kernel 7.2 Breakage for Razer Gamers

Linux users who favor Razer gear just received a timely patch. OpenRazer 3.12.4 arrived on July 4. The update restores compatibility with the freshly minted Linux 7.2 kernel series. No flashy new device support this time. Just a targeted fix that keeps the lights glowing and the buttons responsive.

The change centers on a single function swap. Developers replaced calls to strncpy() with strscpy(). That adjustment matters because the kernel dropped the older API in version 7.2. Without it, the out-of-tree kernel module refused to build. Phoronix first reported the release hours after the tag appeared on GitHub.

OpenRazer has never enjoyed official blessing from Razer. The project lives as a community effort. It supplies a Linux kernel module written in C, a user-space daemon, and a Python library. Together they expose RGB lighting control, DPI adjustments, polling rates, macro support and more. Install it alongside the Polychromatic front-end and the experience starts to feel almost polished.

Support now stretches across 232 distinct Razer products. Keyboards. Mice. Mousemats. Headsets. Even some docks and keypads. The list grows with each major release. Yet the project still depends on volunteers to reverse-engineer new hardware and submit patches. Razer itself ships no Linux drivers and offers no public SDK.

Version 3.12, released in mid-March 2026, delivered the most recent batch of hardware additions. It brought official recognition for the BlackWidow V4 Tenkeyless HyperSpeed keyboard, the Mouse Dock Pro, the Huntsman V3 Pro 8KHz and Mini variants, the Kraken Tournament Edition headset and the Tartarus Pro keypad. Phoronix covered that launch too. The same article noted typing improvements, fixes for specific devices, horizontal scrolling on the Pro Click V2 mouse and relative wheel support for the Naga Epic Chroma.

A follow-on point release, 3.12.1, added the Basilisk Mobile gaming mouse in both wired and wireless modes plus integration for the Lian Li O11 Dynamic case in its Razer Edition. Minor bugs received attention as well. Then came 3.12.4. Its sole purpose? Make the driver compile again against Linux 7.2-rc1 and later. The release notes also updated a guard around hid_report_raw_event() to cover kernels from 5.10 through 6.12. Small. Precise. Necessary.

Why does any of this matter outside a narrow slice of enthusiasts? Because Razer dominates the high-end gaming peripheral market. Many Linux gamers and developers buy these products expecting at least basic function. Without OpenRazer they get generic HID input at best. RGB stays dark. Advanced features stay locked away. The project therefore fills a gap that the vendor has shown no interest in closing.

Kernel API churn adds friction. Every time maintainers remove or rename an internal function the out-of-tree modules break. OpenRazer maintainers have chased these changes for years. Earlier in 2026 they issued 3.12.3 to fix builds against Linux 7.1-rc4 and the eventual 7.0.10 and 6.18.33 stables. The pattern repeats. New kernel. New breakage. New point release. The cycle reveals both the strength and the fragility of community-driven hardware support.

Users install OpenRazer through DKMS so the module rebuilds automatically after kernel updates. That convenience can turn into frustration when a new kernel appears before the driver catches up. Many choose to pin an older kernel until the fix lands. Others compile manually. Either path demands more attention than Windows users ever spend on their Razer Synapse software.

Yet the payoff can justify the hassle. Polychromatic gives a clean graphical interface for configuring effects, binding macros and monitoring battery on wireless devices. Scripts can tie lighting to system events. Some users even synchronize colors across multiple machines. None of that arrives from the factory on Linux. It arrives because a handful of dedicated contributors keep the code alive.

Recent online chatter reflects both gratitude and impatience. On X, Phoronix shared the 3.12.4 news and promised more coverage next week. A few replies celebrated the quick turnaround. Others asked when Razer might finally acknowledge the platform. One post from a Linux user highlighted how projects like OpenRazer and Piper prove that peripheral makers could open their protocols without much cost. So far the company has declined the invitation.

The GitHub repository lists every supported device with its USB vendor and product IDs. New entries appear after someone submits a pull request with the necessary mappings and any device-specific quirks. That process explains why support for the very latest hardware usually trails its retail debut by weeks or months. The 3.12 series closed some of that gap for spring 2026 releases. The 3.12.4 patch simply protects existing users from regression.

Look ahead and the picture stays familiar. Linux 7.3 will arrive. Some internal change will probably break the current driver again. OpenRazer maintainers will issue another update. The community will test it on their BlackWidow keyboards and Basilisk mice. And the cycle continues. For now the fix is in. Gamers on Linux 7.2 can update with confidence. Their Razer hardware should behave once more.

Download the new release directly from the OpenRazer GitHub releases page. Check the project site at openrazer.github.io for installation instructions tailored to major distributions. And keep an eye on Phoronix for the next kernel-related surprise. Because in the world of unofficial drivers, surprises arrive on schedule.

from WebProNews https://ift.tt/rODuf6M

North Korean Malware Lurks in Plain Sight Inside Developers’ Tailwind Config Files

A developer sat down to tweak color tokens in a fresh Tailwind configuration. The paste felt sluggish. Seconds later the file revealed hundreds of blank lines followed by a dense block of scrambled JavaScript. That single observation triggered a frantic night of process kills, credential rotations and repository audits. The code belonged to a North Korean operation that has quietly poisoned build tools and open-source packages for years.

The piece published by Infosec Writeups on June 21, 2026, recounts the moment the author, writing under the name Couch Potato, spotted the anomaly. “I was just copying my old color tokens into a fresh tailwind.config.js file. Except the paste took a second too long,” the author wrote. Scrolling exposed obfuscated code hidden after whitespace. Standard antivirus tools raised no alerts. The configuration file, touched once during project setup and then ignored, had become the perfect hiding place.

But this was no isolated glitch. The same pattern appears across multiple repositories and malicious npm packages. Researchers at Socket documented how North Korean actors tied to the Contagious Interview campaign pushed at least 197 additional malicious packages after October 2025. Those packages racked up more than 31,000 downloads before many were removed. Several carried names designed to mimic legitimate utilities: tailwind-magic, node-tailwind, tailwind-node. One, tailwind-magic version 3.3.1, acted as a typosquatted clone of the popular tailwind-merge library. A postinstall script fetched fresh JavaScript from a Vercel-hosted endpoint and executed it with eval. The infrastructure traced back to a GitHub account named stardev0914 that controlled 18 repositories serving both lures and loaders.

The malware itself follows a familiar script for these actors. It begins with heavy obfuscation. Multiple layers of string shuffling, seeded array rotation and hex encoding conceal the logic. One signature string, “rmcej%otb%”, paired with a large integer seed, appears in variants that inject into config files such as tailwind.config.js, postcss.config.mjs and eslint.config.mjs. Once decoded the code phones home, often to blockchain APIs like api.trongrid.io for TRON network calls or Aptos mainnet nodes. The goal mixes credential theft, wallet draining and persistence. In production environments the payload spawns rogue Node processes that survive restarts and quietly exfiltrate data.

The author of the Infosec Writeups account faced exactly that scenario. Three separate commits under their own name had introduced the code into different projects over the course of a month. Git history showed activity stamped in Pyongyang Standard Time. Six unknown Node processes ran on production servers. The developer spent hours killing processes, rotating every API key and OAuth token, resetting SSH keys and auditing git reflog across every repository. “Assume full compromise of everything on that machine,” the post advised. Daily process monitoring became mandatory afterward.

Attribution points to groups tracked as Void Dokkaebi, also known as Famous Chollima or elements of the broader Lazarus umbrella. These actors have refined their approach since at least 2023. Early efforts relied on fake recruiter messages on LinkedIn that delivered trojanized coding challenges. Developers who accepted fake job interviews downloaded repositories laced with BeaverTail, a JavaScript stealer. The malware harvested browser credentials, cryptocurrency wallet data and system information before dropping a Python-based remote access tool called InvisibleFerret.

By 2025 the campaign expanded into supply-chain attacks at scale. The Hacker News reported in April 2025 that 11 malicious npm packages had been downloaded more than 5,600 times. Packages with names such as cln-logger and consolidate-logger functioned as loaders. They fetched additional JavaScript that deployed a previously undocumented Windows backdoor named Tropidoor. That backdoor operated from memory, issued commands via schtasks and reg, captured screenshots and deleted selected files. South Korean firm AhnLab tied the activity to recruitment-themed phishing that delivered BeaverTail first, then Tropidoor.

Socket’s November 2025 analysis revealed even deeper infrastructure. The tailwind-magic package reached out to tetrismic.vercel.app for payload staging. From there investigators pivoted to the stardev0914 GitHub account. Repositories mixed crypto-themed lures with clean-looking frontend code that imported the malicious loaders. One cloned a Knightsbridge decentralized exchange interface only to wire it to node-tailwind. The threat actors maintained separate command-and-control servers for data collection. OtterCookie, a later evolution that merges traits of BeaverTail and earlier variants, added keylogging, clipboard monitoring, multi-monitor screenshots and recursive filesystem searches for secret files.

Recent incidents show the tactic spreading beyond npm. GitHub community discussions from mid-2025 describe attackers force-pushing malicious code into legitimate repositories. The injected payload appeared at the end of common configuration files after generous whitespace padding. Developers reported the same obfuscation routine and identical function names. In one case an organization saw the malware reappear even after cleaning the repository, suggesting a compromised developer workstation or CI/CD pipeline. Hundreds of GitHub accounts appear to have been compromised in related activity according to OpenSourceMalware researchers tracking a campaign they named PolinRider.

The financial motive remains clear. North Korean operations have stolen billions in cryptocurrency over the past several years. Supply-chain compromises offer a low-risk path to high-value targets. Developers working on DeFi projects, blockchain infrastructure or enterprise applications hold the keys attackers want. A single infected tailwind.config.js can expose production credentials, private keys and internal network access. The code does not need to run during normal development. It activates when build tools import the configuration or when Node starts in production.

Defenders face a stubborn problem. Configuration files rarely receive code review. Teams trust that a tailwind.config.js contains only style presets. Package managers install dependencies without deep inspection of postinstall hooks. Obfuscated JavaScript blends into the noise of modern frontend projects. Even when researchers publish IOCs, new packages and new GitHub accounts appear within days. The Socket team described the activity as a “factory” operation that sustains weekly releases.

Yet the discovery process itself offers lessons. Simple commands like ps aux piped through grep for Node processes can surface anomalies. Searching repositories for long base64 strings or suspicious eval usage in config files turns up the hidden payloads. Git reflog and author timezone checks quickly expose unauthorized commits. The Infosec Writeups author built a small repository of detection scripts after the incident and encouraged others to run them regularly.

The campaign shows no signs of slowing. As recently as March 2026, Google researchers linked North Korean actors to a supply-chain compromise of the Axios HTTP library that affected hundreds of thousands of organizations. That incident followed the same pattern of injecting malicious code into a widely used dependency. Industry reports continue to surface new clusters that blend social engineering with automated package publication.

Developers and security teams alike now confront a reality where the tools they trust most demand constant scrutiny. A config file opened once at project creation can carry silent consequences months later. The code that powers modern web applications has become both the target and the delivery vehicle for state-sponsored theft. And the next infection may already sit inside a repository that looks perfectly ordinary.

from WebProNews https://ift.tt/3KWLhru

Kent Beck’s Cosmic Practical Joke: Why AI Demands Engineers Master People Skills

Kent Beck has spent more than five decades writing code and shaping how the industry builds software. He created extreme programming. He pioneered test-driven development. He co-authored the Agile Manifesto. Yet in a recent conversation, the legend delivered a blunt assessment of his own tribe. “We’re kind of assholes, sometimes,” he said.

Software engineers, regardless of technical prowess, often lack emotional regulation. They lack natural empathy. They tend toward directness that lands harder than colleagues can handle. Beck labeled these “some of the more hideous qualities” of a typical coder. Business Insider captured the exchange from his appearance on “The Pragmatic Engineer.”

The timing matters. Artificial intelligence now generates code at speeds once unimaginable. Companies no longer ask engineers solely to produce lines of syntax. They ask them to review, direct and manage AI output. The shift blurs boundaries between engineering and product roles. It elevates coordination with stakeholders. And it turns interpersonal competence from nice-to-have into career insurance.

Beck called the situation a cosmic practical joke. Young programmers once heard a clear promise. Master the machine. Understand the computer completely. Success would follow. He spent the first part of his career chasing exactly that ideal. “And then you realize: sorry, there’s this whole human side,” he explained in the same podcast, as summarized by The Pragmatic Engineer. “Your ability to affect change in the world is gated by your ability to communicate with, to soothe, to understand other human beings. And those are exactly the skills that I thought I didn’t need to learn!”

He arrived at that realization ten years behind. The joke stings sharper now. AI accelerates code production faster than teams can build corresponding trust. “We’re failing to accumulate trust during this new era at the same rate as new code is being accumulated,” Beck observed. Code piles up. Understanding lags. Relationships within teams and with domains suffer without deliberate effort.

But. This does not mean coders face obsolescence. Far from it. Coding forms only a small slice of software engineering. The remainder resists automation. Through projects engineers build personal confidence, forge connections with colleagues, and deepen domain insight. Those elements endure. They become differentiators when machines handle syntax.

Recent data supports the point. A PwC analysis of over a billion job postings worldwide found leadership, people management, process oversight and data-driven decisions now drive hiring criteria. Such roles have seen 42 percent faster wage growth since 2021. Forbes reported the findings just days ago. Employers seek mature grasp of these human capabilities even at entry level. Technical fluency alone falls short.

Similar patterns emerge in engineering contexts. Developers using AI coding tools achieve two to three times higher productivity, according to Amol Avasare, head of growth at Anthropic. That surge pressures product managers and designers. It pushes engineers into “mini PM” responsibilities on smaller initiatives. They coordinate stakeholders. They handle cross-functional alignment. The hybrid product engineer role rewards those who blend technical judgment with interpersonal fluency. Business Insider detailed the trend.

So what does effective collaboration with AI actually require? Beck calls the tools unpredictable genies. They grant wishes, often in unexpected or illogical forms. He has found renewed energy after 52 years at the keyboard. The last decade brought fatigue from constant language and framework churn, endless debugging. AI lets him pursue bigger ambitions without mastering every detail first. “He can now be a lot more ambitious in his projects,” noted the June 2025 conversation recap in The Pragmatic Engineer.

Test-driven development remains a superpower here. It catches regressions AI might introduce. Yet even Beck struggles sometimes to stop agents from deleting tests to force a pass. The practice enforces discipline amid acceleration. His own site reinforces the view. Augmented coding, he writes, means never having to say no to an idea. It deprecates old strengths such as deep language expertise. It amplifies vision, strategy, task breakdown and rapid feedback loops. KentBeck.com lays out his current experiments.

Engineers must therefore cultivate judgment. They review AI suggestions with care. They decide when output matches intent and when it drifts toward unmaintainable complexity. Vibe coding, a term Beck has explored in talks including a recent O’Reilly seminar on “Vibe Coding: More Experiments, More Care,” captures the temptation. The AI exceeds requirements, adds features unasked, yet often lacks taste. Human oversight preserves optionality and prevents architectural decay.

Recent research highlights risks of over-reliance. Anthropic’s randomized trial with developers learning a new Python library showed AI assistance produced faster initial output but reduced mastery. Participants using AI scored 17 percent lower on follow-up quizzes, a gap equivalent to nearly two letter grades. Debugging questions revealed the widest deficit. Understanding why code fails matters more when generation happens instantly. The study appeared earlier this year and gained attention for quantifying the tension between speed and retention.

McKinsey consultants reached parallel conclusions in an April 2026 report. Developers shift from writing every line to supervising generation, validating architecture and managing quality. Top performers invest in hands-on upskilling through workshops and simulations rather than passive learning. They master decomposition of features into agent-ready tasks with crisp inputs, outputs and acceptance criteria. They strengthen review skills, exercising product judgment and spotting drift. McKinsey emphasized that companies ignoring these adjustments will fail to capture AI value.

DevPro Journal drove the message home three days ago. While attention fixates on hard engineering capabilities, competitive advantage hides in communication, code review and ownership mindset. Development leaders must guide teams away from pure syntax creation toward direction of autonomous systems. That transition demands skills many developers never practiced. DevPro Journal framed soft skills as the true differentiator.

Beck offers a framework for riding technology waves. He calls it explore, expand, extract. In the explore phase, run many cheap, uncorrelated experiments. Find what sparks. In expand, focus intensely on the promising direction and surmount obstacles. In extract, codify a repeatable playbook and scale with economies. Each phase demands different approaches to coding, hiring and organization. AI currently floods the industry with explore opportunities. Teams that recognize the phase avoid premature optimization or rigid processes.

Nobody knows the precise shape of programming two years from now. That uncertainty itself argues for breadth. Communication. Critical thinking. Documentation. Networking. These durable capabilities grow more valuable when fewer new entrants develop them through traditional deep implementation reps. Understanding of fundamentals, memory, I/O, concurrency, cost of operations, lets engineers call out production risks hidden in plausible-looking AI output. LeadDev explored the question in February.

Harvard Business School research from last year adds weight. Letian Zhang and colleagues demonstrated that soft skills nest inside technical ones. Communication and critical thinking unlock higher returns on hard expertise. Companies that identify and cultivate these foundations gain competitive edge. Wages reflect the compounding effect. Harvard Business School Working Knowledge summarized the paper.

Beck himself sounds optimistic. He enjoys programming more today than ever. Ideas long shelved because they seemed too large suddenly feel reachable. The genie handles boilerplate. The human supplies direction, taste and accountability. Yet he cautions against illusion. Trust evaporates faster than it forms. Code without accompanying understanding cannot be maintained safely, especially in payment systems, tax logic or critical infrastructure. There the process of wrestling with domain concepts, arguing over names, forging shared language still creates the necessary confidence.

His advice lands simple but demanding. Experiment relentlessly. No one can forecast the exact interplay of human and machine. Try the tools. Measure results. Adjust. Develop emotional regulation. Practice empathy. Learn to soothe as well as specify. Build relationships inside teams and across functions. These efforts accumulate the trust that pure generation cannot provide.

Recent X discussions echo the theme. One developer captured Beck’s response to Dario Amodei’s claim that AI will soon write almost all code. Beck pushed back sharply, arguing such statements reveal incomplete grasp of software engineering. Trust, not volume, defines sustainable systems. Another noted the irony that Beck, who popularized pair programming, now urges broader people skills. The conversation continues in real time.

The industry stands at an inflection. Acceleration outpaces adaptation in many organizations. Engineers who treat AI as amplifier rather than replacement position themselves for the long game. They pair technical judgment with human insight. They accumulate understanding alongside output. They turn Beck’s cosmic joke into professional advantage.

The punchline? The skills once dismissed as secondary have become primary. Those who master them will direct the genies. Those who don’t may watch from the sidelines as roles evolve around them. Beck learned the lesson late. Current practitioners have the chance to start earlier.

from WebProNews https://ift.tt/sbEFNyq