chicksdaddy shares a report from The Security Ledger: Millions of Android smart television sets from the Chinese vendor TCL Technology Group Corporation contained gaping software security holes that researchers say could have allowed remote attackers to take control of the devices, steal data or even control cameras and microphones to surveil the set's owners. The security holes appear to have been patched by the manufacturer in early November. However the manner in which the holes were closed is raising further alarm among the researchers about whether the China-based firm is able to access and control deployed television sets without the owner's knowledge or permission, according to a report published on Monday by two security researchers.

The report describes two serious software security holes affecting TCL brand television sets. First, a vulnerability in the software that runs TCL Android Smart TVs allowed an attacker on the adjacent network to browse and download sensitive files over an insecure web server running on port 7989. That flaw, CVE-2020-27403, would allow an unprivileged remote attacker on the adjacent network to download most system files from the TV set up to and including images, personal data and security tokens for connected applications. The flaw could lead to serious critical information disclosure, the researchers warned. Second, the researchers found a vulnerability in the TCL software that allowed a local unprivileged attacker to read from and write to critical vendor resource directories within the TV's Android file system, including the vendor upgrades folder. That flaw was assigned the identifier CVE-2020-28055.

The researchers, John Jackson, an application security engineer for Shutter Stock, and the independent researcher known by the handle "Sick Codes," said the flaws amount to a "back door" on any TCL Android smart television. "Anybody on an adjacent network can browse the TV's file system and download any file they want," said Sick Codes in an interview via the Signal platform. That would include everything from image files to small databases associated with installed applications, location data or security tokens for smart TV apps like Gmail. If the TCL TV set was exposed to the public Internet, anyone on the Internet could connect to it remotely, he said, noting that he had located a handful of such TCL Android smart TVs using the Shodan search engine.

Disney+, the streaming service that launched one year ago today, grew to 73.7 million paid subscribers as of early October. TechCrunch reports: That's according to The Walt Disney Company's fourth-quarter earnings report, which covers the company's finances through October 3. The company previously said Disney+ had 60.5 million subscribers as of August 3. The release also includes subscriber numbers for Disney's other streaming services -- Hulu had 36.6 million (including 4.1 million subscribers to Hulu + Live TV), while ESPN had 10.3 million (more than doubling from 3.5 million a year earlier).

Overall, Disney's direct-to-consumer segment saw revenue grow 41% year-over-year to $4.9 billion, while its operating loss fell from $751 million in Q4 2019 to $580 million this year. Disney attributed the shrinking losses to "improved results at Hulu and ESPN+, partially offset by higher costs at Disney+, driven by the ongoing rollout." It was a tough quarter for Disney overall, with the pandemic forcing the company to keep some parks closed and the rest operating at reduced capacity. Disney's revenue fell to $14.7 billion (compared to $19.1 billion during Q4 2019), with a loss of $0.39 per share.

An anonymous reader shares a column: Google Music is dead, and with it one of the few remaining connections I have to the company that doesn't feel like a gun to my head. The service, now merged haphazardly with YouTube Music, recalled the early days of Google, when they sometimes just made cool internet things. It made it nearly a decade, though -- pretty impressive for a one of their products. I'll just say it up front: I'm a lifelong music pirate. Oh yes, I've reformed in recent years, but I've got a huge library of tracks that I've cultivated for decades and don't plan to abandon any time soon (likewise you can pry Winamp from my cold, dead hands). So when Google announced back in 2011 I could stream it all to myself for free, it sounded too good to be true. And indeed it was a relic of the old Google, which was quite simply all about taking things that are difficult to do yourself (find things online, set up a new email address, collaborate on a spreadsheet) and make them easier. Google Music -- as we'll call it despite it having gone through several branding changes before the final indignity of being merged into another, worse service as a presumably short-lived tab -- was not first to the music-streaming or downloading world by a long shot, but its promise of being able to upload your old music files and access them anywhere as if they were emails or documents was a surprisingly generous one. Generous not just in that it was providing server space for 20,000 songs (!) for free and the infrastructure for serving those songs where you went, but in its acknowledgement of other models of owning media. It didn't judge you for having 20,000 MP3s -- they weren't subjected to some kind of legitimacy check, and they didn't report you to the RIAA for having them, though they certainly could have. No, Google Music's free media locker was the company, or at least a quorum of the product team, announcing that they get it: not everyone does everything the same way, and not everyone is ready to embrace whatever business model tech companies decide makes sense. (Notably it has shifted several times more since then.)

In a lengthy blog post, Twitch told streamers that they must stop playing recorded music on their streams (unless it's officially licensed) and that "if you haven't already, you should review your historical VODs and Clips that may have music in them and delete any archives that might." Variety reports: The Amazon-owned live-streaming platform also claimed that it is "actively speaking with the major record labels about potential approaches to additional licenses that would be appropriate for the Twitch service." However, the company also said that the "current constructs for licenses" that record labels have with other services (which typically take a cut of revenue from creators for payment to record labels) "make less sense for Twitch." "We're open-minded to new structures that could work for Twitch's unique service, but we must be clear that they may take some time to materialize or may never happen at all," the company said in the blog.

Twitch's music-copyright communique comes after several major U.S. music organizations -- including the RIAA, the Recording Academy, the National Music Publishers Association, the Music Managers Forum, the American Association of Independent Music and SAG-AFTRA -- sent a letter last month to Amazon CEO Jeff Bezos (copying Twitch CEO Emmet Shear). The letter, among other things, accused Twitch of "allowing and enabling its streamers to use our respective members' music without authorization, in violation of Twitch's music guidelines." Twitch said it was caught off guard by the music industry's crackdown on unlicensed music on its service. According to the company, starting this May, reps for music companies began sending thousands of Digital Millennium Copyright Act (DMCA) copyright-takedown notices targeted at users' archived content, "mostly for snippets of tracks in years-old clips." Before then, Twitch said, it received fewer than 50 music-related DMCA notifications per year.

Twitch said it analyzed DMCA notifications received from the end of May through mid-October and found that more than 99% of them were for tracks that streamers were playing in the background of their stream. Twitch apologized to creators for the angst the DMCA takedowns have caused, noting that a warning email it sent to many last month about the videos deleted from their accounts "didn't include all the information that you'd typically get in a DMCA notification." "We could have developed more sophisticated, user-friendly tools a while ago. That we didn't is on us," it said. "And we could have provided creators with a longer time period to address their VOD and Clip libraries -- that was a miss as well. We're truly sorry for these mistakes, and we'll do better."

Ticketmaster is planning to check the coronavirus vaccination status of concert-goers prior to shows once a treatment is approved. The New York Post reports: The ticketing giant plans to have customers use their cellphones to verify their inoculation or whether they've tested negative for the virus within a 24- to 72-hour window, according to the exclusive report. The plan, which is still being ironed out, will utilize three separate components, including the California-based company's digital ticketing app, third-party health information firms like CLEAR Health Pass and testing/vaccination distributors like Labcorp or CVS Minute Clinic.

Ticketmaster will reportedly not store or access medical records under the plan. If approved, fans would need to verify that they've either already been vaccinated or have tested negative as recently as 24 hours prior to the show. Concert-goers would then instruct a lab to send over test results to companies like CLEAR Health Pass or IBM's Digital Health Pass, which would verify the fan's status to Ticketmaster. Anyone who tests positive or doesn't get screened won't be granted access to the event venue, Billboard reported. The digital ticketing app will also eliminate the need for paper tickets and can be prohibited from being resold, according to the report. Further reading: Billboard

Dish Network announced that it will permanently shut down all of Sling Media's Slingbox services and end support for the devices in two years, at which point they'll no longer work. Variety reports: On Monday, Dish's Sling Media unit announced that Slingbox servers will be permanently taken offline 24 months from Nov. 9, 2020. "Until then, most Slingbox models will continue to work normally, but the number of supported devices for viewing will steadily decrease as versions of the SlingPlayer apps become outdated and/or lose compatibility," the company said in a message posted Monday.

In an FAQ about the shutdown, Dish said Slingbox is being discontinued because "We've had to make room for new innovative products so that we can continue to serve our customers in the best way possible." Sling will not be releasing any new products; most authorized resellers have been out of stock of the Slingbox devices "for a couple years," according to the company. Sling Media was acquired by EchoStar in 2007 for $380 million, which at the time was Dish's parent company. Years before Netflix became a streaming powerhouse, the Slingbox "place-shifting" devices let customers watch pay-TV channels over the internet. But the products never became a mainstream category in the way streaming-media players like Roku and Amazon's Fire TV have.

Artificial intelligence is being used to create new songs seemingly performed by Frank Sinatra and other dead stars. 'Deepfakes' are cute tricks -- but they could change pop for ever. From a report: "It's Christmas time! It's hot tub time!" sings Frank Sinatra. At least, it sounds like him. With an easy swing, cheery bonhomie, and understated brass and string flourishes, this could just about pass as some long lost Sinatra demo. Even the voice -- that rich tone once described as "all legato and regrets" -- is eerily familiar, even if it does lurch between keys and, at times, sounds as if it was recorded at the bottom of a swimming pool. The song in question not a genuine track, but a convincing fake created by "research and deployment company" OpenAI, whose Jukebox project uses artificial intelligence to generate music, complete with lyrics, in a variety of genres and artist styles. Along with Sinatra, they've done what are known as "deepfakes" of Katy Perry, Elvis, Simon and Garfunkel, 2Pac, Celine Dion and more. Having trained the model using 1.2m songs scraped from the web, complete with the corresponding lyrics and metadata, it can output raw audio several minutes long based on whatever you feed it. Input, say, Queen or Dolly Parton or Mozart, and you'll get an approximation out the other end.

"As a piece of engineering, it's really impressive," says Dr Matthew Yee-King, an electronic musician, researcher and academic at Goldsmiths. (OpenAI declined to be interviewed.) "They break down an audio signal into a set of lexemes of music -- a dictionary if you like -- at three different layers of time, giving you a set of core fragments that is sufficient to reconstruct the music that was fed in. The algorithm can then rearrange these fragments, based on the stimulus you input. So, give it some Ella Fitzgerald for example, and it will find and piece together the relevant bits of the 'dictionary' to create something in her musical space." Admirable as the technical achievement is, there's something horrifying about some of the samples, particularly those of artists who have long since died -- sad ghosts lost in the machine, mumbling banal cliches. "The screams of the damned" reads one comment below that Sinatra sample; "SOUNDS FUCKING DEMONIC" reads another. We're down in the Uncanny Valley. Deepfake music is set to have wide-ranging ramifications for the music industry as more companies apply algorithms to music. Google's Magenta Project -- billed as "exploring machine learning as a tool in the creative process" -- has developed several open source APIs that allow composition using entirely new, machine-generated sounds, or human-AI co-creations. Numerous startups, such as Amper Music, produce custom, AI-generated music for media content, complete with global copyright. Even Spotify is dabbling; its AI research group is led by Francois Pachet, former head of Sony Music's computer science lab.

fahrbot-bot shares a report from CNN: A team of physicists at a university in the Netherlands have 3D-printed a microscopic version of the USS Voyager, an Intrepid-class starship from Star Trek. The miniature Voyager, which measures 15 micrometers (0.015 millimeters) long, is part of a project researchers at Leiden University conducted to understand how shape affects the motion and interactions of microswimmers.

Microswimmers are small particles that can move through liquid on their own by interacting with their environment through chemical reactions. The platinum coating on the microswimmers reacts to a hydrogen peroxide solution they are placed in, and that propels them through the liquid. "By studying synthetic microswimmers, we would like to understand biological microswimmers," Samia Ouhajji, one of the study's authors, told CNN. "This understanding could aid in developing new drug delivery vehicles; for example, microrobots that swim autonomously and deliver drugs at the desired location in the human body." In their project, the physicists also printed shapes like boats, trimers and helices, with each object's shape affecting their swimming behaviors.

Advertisers entering the burgeoning medium of streaming TV say they want better measurement and targeting capabilities than they are finding there. But a shadow looms over any efforts to give them what they want: the privacy backlash that has recently put other digital media on the defensive. From a report: That means obtaining viewers' consent to use information on what they watch will be essential for whatever tools emerge as the best way to measure and reach streaming audiences. Online advertising has long relied on technology like tracking cookies and tactics such as retargeting -- following people from website to website to repeatedly show them the same ad for a shirt or a trip they may have briefly considered online. The industry's pervasive monitoring and targeting regime ultimately fueled the rise of ad blockers among consumers, new privacy regulations in Europe and California, and efforts by Apple and Alphabet's Google to weaken some tools on which advertisers, publishers and ad-technology companies have come to rely. Players in streaming TV don't want to provoke the same outcome. "The industry as a whole cannot take the privacy of consumers for granted and make the same mistakes that were made on the internet decades ago," said David Spencer, assistant manager of audience buying strategy for General Motors Co. The risk is growing as more people stream TV over the internet, however, including on television sets that can tell what they are watching.

The iconic host of America's TV quiz show Jeopardy! has died at age 80, after 35 years of reminding contestants to always state their answers in the form of a question. Who was Alex Trebek? CNN calls him "the genial host with all the answers and a reassuring presence in the TV game-show landscape for five decades."

Notable moments include playing host to IBM's Watson computer and a teasingly blunt appraisal of nerdcore hip hop. CNN reports: "Jeopardy! is saddened to share that Alex Trebek passed away peacefully at home early this morning, surrounded by family and friends," said a statement shared on the show's Twitter account Sunday. "Thank you, Alex." The cause of death was not immediately announced. Trebek revealed in March 2019 he had been diagnosed with stage 4 pancreatic cancer, triggering an outpouring of support and well wishes at the time.

Trebek made history in 2014 by hosting his 6,829th "Jeopardy!" episode — the most by a presenter of any single TV game show... In a 2014 interview with the Hollywood Reporter, Trebek downplayed that honor, saying, "I'm just enjoying what I'm doing, I'm happy to have a job. I like the show, I like the contestants and it pays well."

tlhIngan writes: Many years ago, Kojima Productions produced P.T., a "playable teaser" (rumored meaning to P.T.) for a now-cancelled Silent Hill survival-horror reboot. This was a popular teaser but when Kojima and Konami parted ways, it was swiftly removed from the Sony PlayStation Store. People who downloaded the trailer could still re-download it for a period but that was swiftly removed, leading to PS4s preloaded with the game spiking in price. Since the PS5 offers backwards compatibility, reviewers did test the PS5 playing back P.T. to find it still worked. However, this was short lived, as Sony removed the trailer from working in backwards compatible mode, as well as removing the ability to transfer the game to the PS5. Sony's response to the removal was "it was a publisher decision" to remove it from the backwards compatibility list.

Netflix has chosen France to test its first channel offering. From a report: Named Direct, the linear channel -- which is only available to subscribers -- will air French, international and U.S. feature films and TV series that are available on the streaming service. However, the channel will only be accessible via the service's web browser, unlike its streaming service, which is found on set-top boxes thanks to distribution deals with French telco groups such as Orange, Canal Plus and SFR. The initiative marks Netflix's first foray into real-time, scheduled programming. The service previously tested the option Shuffle Play, which wasn't in real time but featured recommended programming to a sample of international users, explained a source at Netflix. The difference this time around is that the test is being localized in one country, rather than a sample of users.

An anonymous reader quotes a report from TorrentFreak: Every week, Netflix sends out thousands of takedown requests, most of which target pirated copies of its movies and TV-shows. Yesterday, however, we spotted a series of copyright infringement notices with a different and rather uncomfortable theme. The streaming giant asked Twitter to remove dozens of tweets that included footage from the French coming-of-age film Cuties. This film hasn't been without controversy and the same can be said about the takedown requests too.

To provide some context, Netflix acquired the global distribution rights for Cuties and started promoting it this summer. This created quite some backlash as many people felt that the young actors had been sexualized after being filmed in all kinds of suggestive poses. We won't go into the various viewpoints on this topic or the lawsuit Netflix faces in Texas over 'lewd visual material.' Opinions from both sides are readily available all over the web, including social media. Netflix didn't cancel Cuties, however, but this week it actively started to pull Cuties clips from Twitter. Not just a handful, but several dozens. Legally the company is allowed to do this of course, as they own the rights. However, it is at least a bit peculiar that the company appears to have targeted only negative tweets. The good news is that the texts of the tweets remain online. We don't know if that is Twitter's decision or if Netflix had a say in it. The takedown requests, which are posted on Lumen, target the full tweet URLs. The flagged tweets, according to TorrentFreak, all condemn Netflix. "The language is quite harsh at times, including terms such as child exploitation, pedophilia, as well as repeated calls to cancel Netflix," it adds.

The company hasn't said why it's suddenly going after Cuties clips on Twitter. "The easy conclusion would be that Netflix is trying to shove these under the carpet," reports TorrentFreak. "However, there are still thousands of similar comments online, so that wouldn't be very effective."

An anonymous reader quotes a report from TorrentFreak: Documents obtained by TorrentFreak dated September reveal the MPA, acting through legal representatives, attempting to pressure individuals who they believe are important at [anime site Nyaa] and could have the ability to shut the site down. Information suggests that several people in North America, Europe, and Australia have all received similar correspondence. The letters allege massive copyright infringement via the Nyaa site and include a sample of copyrighted works, to which the MPA's members hold the rights, that were allegedly infringed via the platform.

The MPA clearly states that none of its cited members (Disney, Paramount, Universal, Columbia, Warner Bros, and Netflix, in addition to Amazon) have granted their permission for the works to be made available via Nyaa or the BitTorrent network(s) that underpin it. As a result, "significant, irreparable damage" has already been caused to the copyright owners by the site's activities. While emailed threats are still a common anti-piracy strategy, we are informed that at least two of the individuals were personally served with legal documents at their homes. Others were served with similar documents via regular mail. We are currently unable to determine exactly how many people were served in total. At the moment the suggestion is around five but that may not be the full picture. What we do know is that some or all stand accused of being part of the mysterious 'Anime Cartel' supposedly behind Nyaa. "With immediate effect, recipients have been told to take all necessary steps to ensure that Nyaa is completely shut down," the report adds. "The MPA also wants to take control of the site's domain -- Nyaa.si -- a common tactic in other anti-piracy actions. Overall, recipients are warned that they must cease-and-desist any and all of their activities related to the site, including making available the copyrighted works of the MPA's members."

"In addition to receiving settlements, it appears that the MPA also wants information on the Nyaa service and its operations. The MPA also wants the rights to the Nyaa site and any technologies connected to it, wherever the recipient has the ability to transfer those rights. The MPA also demands that those entering into a settlement agreement should never infringe its members' rights again."

Two weeks ago the RIAA asked GitHub to remove the open-source stream-ripper software youtube-dl. This request wasn't well-received by developers, many of whom retaliated by posting copies of the code. Yesterday, things went from bad to worse when a user with the name 'FuckTheRIAA' uploaded three MP3s of the songs the RIAA mentioned in its takedown notice. TorrentFreak reports: A few hours ago we spotted a new GitHub user named 'FuckTheRIAA' who uploaded a copy of youtube-dl as well as a 'FuckTheRIAA' repository that includes three songs. These songs from Taylor Swift, Justin Timberlake, and Icona Pop, were not chosen randomly. The same tracks were mentioned in the RIAA's original takedown request, as the YouTube videos were highlighted in the youtube-dl code.

This is yet another example that shows how the RIAA's takedown request has actually made things worse for the music group, at least for now. After nearly a day the three MP3 files are still available on GitHub. [I]t seems likely that it will send another DMCA takedown request to remove the tracks from GitHub. Whether the RIAA will also file takedown notices to remove all of the new youtube-dl forks has yet to be seen. For now, its takedown efforts have only made things worse, so they may let things cool down for a while first while exploring other options.

On Monday, Spotify announced a new initiative that offers artists the chance to pay their way into automated recommendations. Gizmodo reports: In a carefully worded blog post, Spotify is framing its latest move as a test that will give artists more "input" into the recommendation algorithms that populate personalized playlists with fresh tracks. The company writes that its algorithms take "into account thousands of types of signals: what you're listening to and when, which songs you're adding to your playlists, the listening habits of people who have similar tastes, and much more." Today, Spotify is adding a new signal to the mix: $$$.

Artists uploading new tracks to Spotify will be able to choose "music that's a priority for them" and in exchange for accepting a "promotional recording royalty rate," Spotify's algorithms might just bless them with exposure. The company isn't making promises, it's only offering an opportunity. There's no guarantee of placement in playlists and the reduced royalty rate is only applied to songs that end up being served through the new recommendation system. What is a "promotional recording royalty rate," exactly? [A] spokesperson for the service told the Verge that they aren't making the rate public while it's in testing and Spotify will "calibrate to make sure that the widest group of artists and labels can find success."

An anonymous reader quotes a report from The Register: Trey Parker and Matt Stone, best known for their cartoon South Park, have created a new comedy deepfake series called Sassy Justice. The star of the show, Fred Sassy, is a local news reporter from Cheyenne, Wyoming, with the face of US President Donald Trump. Other notable characters include, erm, "Dialysis King" Mark Zuckerberg. Politicians like former vice president Al Gore and White House family members Ivanka Trump and her husband Jared Kushner also appear. Kushner is portrayed as a man child.

If that sounds completely bonkers, that's because it is. They're all actually deepfakes generated using machine learning algorithms. Their faces have all been superimposed onto the bodies of actors. Not only is it pretty funny, the quality of the technology is shockingly good. The transitions and subtle facial expressions are smooth, apart from Zuckerberg who appears as robotic as ever, making it all the more realistic really. You can watch the first episode here.

In 1962 Sean Connery became the first actor to appear in movies as secret agent James Bond, and according to long-time Slashdot reader schwit1 was "The best of the many Bonds, by far."

An anonymous reader writes: Connery influenced the character deeply. The Huffington Post once wrote that James Bond wasn't Scottish until Sean Connery played the role. Ian Fleming was still writing his series of James Bond novels, and "After seeing Connery in Dr. No and thinking the actor did a superb job, Fleming wrote Connery's heritage into the character. In the book You Only Live Twice, Fleming wrote that James Bond's father was Scottish and was from the town of Glencoe. Coincidentally, Connery would film Highlander in Glencoe decades later."

Sir Sean Connery — he was also knighted in the year 2000 — performed many other iconic roles throught his long career, even playing the father of Harrison Ford's character in Indiana Jones and the Last Crusade. Leaving Bond behind, Connery appeared in many historical dramas, including the World War II movies The Longest Day and A Bridge Too Far, as well as The Man Who Would Be King, The Name of the Rose, and (in 2003) The League of Extraordinary Gentlemen. But throughout his life he was always in demand for high-quality action films, from The Hunt for Red October to The Rock, even co-starring with Catherine Zeta-Jones in the romantic caper film Entrapment at the age of 69.

And in Terry Gilliam's movie Time Bandits, Connery appears as more than one character, hinting that beneath the individual roles lay some timeless embodiment of strength and goodness itself.

Apple said on Friday that it's replacing AirPods Pro headphones that have sound problems. CNBC reports: These problems include a static or crackling sound that increases in loud environments and issues with active noise cancellation. Apple said AirPods Pro made after October 2020 don't have the problems. Owners who experience problems can contact Apple online or make an appointment at an Apple store to get their AirPods Pro replaced for free. Only devices that are confirmed to have the issue will be replaced. The replacement applies only to the buds, not the charging case. Apple's not offering a similar program for other AirPod models.

According to Nikkei, Sony is close to acquiring U.S. anime-streaming service Crunchyroll for more than $957 million. From the report: Sony has its own popular anime, titles like "Demon Slayer" and "Kimetsu no Yaiba," but has been licensing it to streaming services. Sony's Aniplex, the studio behind "Kimetsu no Yaiba," has a variety of content, including movies and music, that is mainly distributed by overseas companies. If the acquisition is realized, global competition for content among companies like Netflix and Hulu will intensify.

Crunchyroll was founded in 2006 and has its headquarters in San Francisco. In 2018, AT&T, the U.S. telecommunications giant, became its parent company. Sony recently obtained the exclusive right to negotiate for Crunchyroll. Crunchyroll has 70 million free members and 3 million paying subscribers in more than 200 countries and regions, including the U.S and Europe. Crunchyroll would also give Sony more than 1,000 titles that it can use to vary its offerings.