Uncategorized – Page 56

December 6, 2023

Nearly Every Windows and Linux Device Vulnerable To New LogoFAIL Firmware Attack

"Researchers have identified a large number of bugs to do with the processing of images at boot time," writes longtime Slashdot reader jd. "This allows malicious code to be installed undetectably (since the image doesn’t have to pass any validation checks) by appending it to the image. None of the current secure boot mechanisms are capable of blocking the attack." Ars Technica reports: LogoFAIL is a constellation of two dozen newly discovered vulnerabilities that have lurked for years, if not decades, in Unified Extensible Firmware Interfaces responsible for booting modern devices that run Windows or Linux. The vulnerabilities are the product of almost a year’s worth of work by Binarly, a firm that helps customers identify and secure vulnerable firmware. The vulnerabilities are the subject of a coordinated mass disclosure released Wednesday. The participating companies comprise nearly the entirety of the x64 and ARM CPU ecosystem, starting with UEFI suppliers AMI, Insyde, and Phoenix (sometimes still called IBVs or independent BIOS vendors); device manufacturers such as Lenovo, Dell, and HP; and the makers of the CPUs that go inside the devices, usually Intel, AMD or designers of ARM CPUs. The researchers unveiled the attack on Wednesday at the Black Hat Security Conference in London.
As its name suggests, LogoFAIL involves logos, specifically those of the hardware seller that are displayed on the device screen early in the boot process, while the UEFI is still running. Image parsers in UEFIs from all three major IBVs are riddled with roughly a dozen critical vulnerabilities that have gone unnoticed until now. By replacing the legitimate logo images with identical-looking ones that have been specially crafted to exploit these bugs, LogoFAIL makes it possible to execute malicious code at the most sensitive stage of the boot process, which is known as DXE, short for Driver Execution Environment. "Once arbitrary code execution is achieved during the DXE phase, it’s game over for platform security," researchers from Binarly, the security firm that discovered the vulnerabilities, wrote in a whitepaper. "From this stage, we have full control over the memory and the disk of the target device, thus including the operating system that will be started." From there, LogoFAIL can deliver a second-stage payload that drops an executable onto the hard drive before the main OS has even started. The following video demonstrates a proof-of-concept exploit created by the researchers. The infected device — a Gen 2 Lenovo ThinkCentre M70s running an 11th-Gen Intel Core with a UEFI released in June — runs standard firmware defenses, including Secure Boot and Intel Boot Guard. LogoFAIL vulnerabilities are tracked under the following designations: CVE-2023-5058, CVE-2023-39538, CVE-2023-39539, and CVE-2023-40238. However, this list is currently incomplete.
"A non-exhaustive list of companies releasing advisories includes AMI (PDF), Insyde, Phoenix, and Lenovo," reports Ars. "People who want to know if a specific device is vulnerable should check with the manufacturer."
"The best way to prevent LogoFAIL attacks is to install the UEFI security updates that are being released as part of Wednesday’s coordinated disclosure process. Those patches will be distributed by the manufacturer of the device or the motherboard running inside the device. It’s also a good idea, when possible, to configure UEFIs to use multiple layers of defenses. Besides Secure Boot, this includes both Intel Boot Guard and, when available, Intel BIOS Guard. There are similar additional defenses available for devices running AMD or ARM CPUs."

Meta’s new AI image generator was trained on 1.1 billion Instagram and Facebook photos

https://cdn.arstechnica.net/wp-content/uploads/2023/12/meta_emu_hero_1-760×380.jpg

Enlarge / Three images generated by "Imagine with Meta AI" using the Emu AI model.

Meta | Benj Edwards

On Wednesday, Meta released a free standalone AI image generator website, "Imagine with Meta AI," based on its Emu image synthesis model. Meta used 1.1 billion publicly visible Facebook and Instagram images to train the AI model, which can render a novel image from a written prompt. Previously, Meta’s version of this technology—using the same data—was only available in messaging and social networking apps such as Instagram.

If you’re on Facebook or Instagram, it’s quite possible a picture of you (or that you took) helped train Emu. In a way, the old saying, "If you’re not paying for it, you are the product" has taken on a whole new meaning. Although, as of 2016, Instagram users uploaded over 95 million photos a day, so the dataset Meta used to train its AI model was a small subset of its overall photo library.

Since Meta says it only uses publicly available photos for training, setting your photos private on Instagram or Facebook should prevent their inclusion in the company’s future AI model training (unless it changes that policy, of course).

Imagine with Meta AI

AI-generated images of "a muscular barbarian with weapons beside a CRT television set, cinematic, 8K, studio lighting" created by Meta Emu on the "Imagine with Meta AI" website.

Meta | Benj Edwards
AI-generated images of "a cat in a car holding a can of beer" created by Meta Emu on the "Imagine with Meta AI" website.

Meta | Benj Edwards
AI-generated images of "a flaming cheeseburger" created by Meta Emu on the "Imagine with Meta AI" website.

Meta | Benj Edwards
AI-generated images of "a photorealistic Mickey Mouse on the moon in a spacesuit" created by Meta Emu on the "Imagine with Meta AI" website.

Meta | Benj Edwards
AI-generated images of "a handsome man" created by Meta Emu on the "Imagine with Meta AI" website.

Meta | Benj Edwards
AI-generated images of "the ultimate gaming PC with 1,000 RGB lights" created by Meta Emu on the "Imagine with Meta AI" website.

Meta | Benj Edwards
AI-generated images of "a man holding a sign that says ‘Ars Technica’" created by Meta Emu on the "Imagine with Meta AI" website.

Meta | Benj Edwards
AI-generated images of a complex prompt involving Christmas stockings and a cave created by Meta Emu on the "Imagine with Meta AI" website.

Meta | Benj Edwards
AI-generated images of "photorealistic vintage computer collector nerd in a computer lab, bright psychedelic technicolor swirls" created by Meta Emu on the "Imagine with Meta AI" website.

Meta | Benj Edwards
AI-generated images of "an embroidered Santa Claus" created by Meta Emu on the "Imagine with Meta AI" website.

Meta | Benj Edwards
AI-generated images of "A teddy bear on a skateboard" created by Meta Emu on the "Imagine with Meta AI" website.

Meta | Benj Edwards
AI-generated images of "a beautiful queen of the universe" created by Meta Emu on the "Imagine with Meta AI" website.

Meta | Benj Edwards

Similar to Stable Diffusion, DALL-E 3, and Midjourney, Imagine with Meta AI generates new images based on what the AI model "knows" about visual concepts learned from the training data. Creating images using the new website requires a Meta account, which can be imported from an existing Facebook or Instagram account. Each generation creates four 1280×1280 pixel images that can be saved in JPEG format. Images include a small "Imagined with AI" watermark logo in the lower left-hand corner.

"We’ve enjoyed hearing from people about how they’re using imagine, Meta AI’s text-to-image generation feature, to make fun and creative content in chats," Meta says in its news release. "Today, we’re expanding access to imagine outside of chats, making it available in the US to start at imagine.meta.com. This standalone experience for creative hobbyists lets you create images with technology from Emu, our image foundation model."

We put Meta’s new AI image generator through a battery of low-stakes informal tests using our "Barbarian with a CRT" and "Cat with a beer" image synthesis protocol and found aesthetically novel results, as you can see above. (As an aside, when generating images of people with Emu, we noticed many looked like typical Instagram fashion posts.)

We also tried our hand at adversarial testing. The generator appears to filter out most violence, curse words, sexual topics, and the names of celebrities and historical figures (no Abraham Lincoln, sadly), but it allows commercial characters like Elmo (yes, even "with a knife") and Mickey Mouse (though not with a machine gun).

Meta’s model generally creates photorealistic images well, but not as well as Midjourney. It can handle complex prompts better than Stable Diffusion XL, but perhaps not as well as DALL-E 3. It doesn’t seem to do text rendering well at all, and it handles different media outputs like watercolors, embroidery, and pen-and-ink with mixed results. Its images of people seem to include diversity in ethnic backgrounds. Overall, it seems about average these days in terms of AI image synthesis.

Ars Technica – All content

December 5, 2023

Weird Airplane Experiments

https://theawesomer.com/photos/2023/12/weird_airplanes_peter_sripol_t.jpg

Link

Peter Sripol is no stranger to making unusual aircraft. In this video, he builds and tests out three weird designs for airworthiness, including a plane with a fuselage made from springs, a propeller that works like a tank tread, and a ridiculous set of wings that resemble Venetian blinds.

The Awesomer

December 5, 2023

How have I never seen this video of the worst Christmas orchestra of all time? ????

https://media.notthebee.com/articles/656f7d638aa28656f7d638aa29.jpg

I hate to tell you, but you guys aren’t doing your job.

Not the Bee

December 5, 2023

Destructive Testing of a 3D-Printed Nylon Suppressor

https://www.thefirearmblog.com/blog/wp-content/uploads/2023/11/intro02-180×180.png

Additive Manufacturing, more commonly known as 3D Printing, is becoming increasingly mainstream in the production of firearms components and accessories. We’ve already seen commercial attempts at manufacturing polymer 3D-printed suppressors and now, thanks to Forerunner 3D Printing, we can see how 3D-printed nylon survives a couple of hundreds of rimfire rounds. More 3D Printed Silencers […]

Announcing Laravel Pulse – A New Performance Monitoring Tool for Laravel Apps

https://picperf.io/https://laravelnews.s3.amazonaws.com/featured-images/pulse.jpg

Laravel Pulse is a brand new free and open source performance monitoring and insights tool for Laravel applications. It was announced at Laracon AU 2023 by Jess Archer from the Laravel core team.

What is Laravel Pulse?

Laravel Pulse gives you an aggregate view of performance data for your Laravel app. It tracks metrics like:

System stats (CPU, memory, storage usage)
Application usage (requests, slow routes, jobs, etc)
Queue throughput
Slow jobs
Slow queries
Exceptions
Cache hits/misses
Outgoing request times

Pulse was designed specifically for Laravel and knows about all the core components like queues, events, mail, notifications, caching, and more.

It collects the minimal amount of data needed to display helpful insights. The data is saved locally so you maintain full control.

Laravel Pulse is self-hosted and works anywhere Laravel runs – VPS, Laravel Forge, Vapor, etc. It has a responsive UI with light and dark modes.

And best of all, it’s completely free and open source! Big thanks to Taylor Otwell for making this possible.

How Pulse Compares to Telescope

Some may be wondering how Pulse compares to Laravel Telescope, another debugging tool for Laravel.

Telescope is great for local development as it records extensive request data like all queries and events. But this high level of detail makes it less ideal for production.

Laravel Pulse provides high level aggregate data so it’s lean and production-ready. It won’t replace error trackers, but augments them nicely.

Interactive Live Demo

At Laracon AU, Jess Archer did an interactive live demo of Laravel Pulse using the audience’s phones!

The audience acted as flight admins for a fictional Acme Airlines app. They could perform actions like:

Sell tickets
Raise prices
Delay flights
Cancel flights

Meanwhile, Jess showed how Laravel Pulse tracked these actions in real-time on a dashboard.

Here’s a recap of some highlights:

Application Usage

The Application Usage card shows:

Top users by requests
Top users by slow endpoints
Top users queuing jobs

This gives insight into who is using your app and any performance issues they face.

Slow Routes

The Slow Routes card shows any application routes that exceed a configured threshold (1 second default).

It displays the route name and action method so you can pinpoint the slow code.

Slow Jobs

The Slow Jobs card is similar, displaying queued jobs exceeding a threshold. It shows the job class name and location.

Failed jobs that retry will increment the count each time so you can spot problem jobs.

Slow Queries

The Slow Queries card reveals queries over a threshold. It only shows the SQL without bindings so it:

Obfuscates PII
Aggregates identical queries into one result
Shows file location the query occurred

You can optionally disable locations to further aggregate results.

Exceptions

The Exceptions card tracks exceptions thrown including location, count, and last occurrence.

You can also sort by most recent exceptions.

Cache

The Cache card tracks cache key usage, along with hits and misses to the cache.

It will make no assumptions about your keys, but allows regrouping and rolling-up of collected data if you need a more generalised view of the data.

Outgoing Requests

Laravel’s HTTP client usage is tracked in Outgoing Requests. You can see slow external requests your app makes.

The demo used a regex in the config file to condense unique URLs into a generalised domain name, similar toe cache data.

Customizing Your Dashboard

The Pulse blade file can be published and customized. For example, you can:

Toggle full width mode
Adjust number of columns
Set card span and position
Break cards into individual sections

You can also create your own custom cards to display business-specific metrics. The demo included a "Flights" card showing tickets sold, revenue, delays, and top sellers.

Performance Considerations

Pulse collects minimal data and can handle heavy production workloads. Larave Forge runs it for 2 million requests/day with no sampling needed.

By default, Pulse saves request data to your database after the response is sent. Some options to scale:

Use a dedicated Pulse database
Redis ingest to queue and saved outside request cycle
Run Pulse on a separate server
Enable sampling for high traffic
Create custom data drivers

When Can We Use Pulse?

Laravel Pulse is expected to launch in the next week or so. It will be a composer require away. Stay tuned for the official release!

Conclusion

Laravel Pulse provides easy insights into your Laravel app’s performance and usage. Its customizability and minimal overhead makes it a great open source addition for any Laravel project.

Big thanks to the entire Laravel team for another amazing free tool for the community!

The post Announcing Laravel Pulse – A New Performance Monitoring Tool for Laravel Apps appeared first on Laravel News.

Join the Laravel Newsletter to get all the latest Laravel articles like this directly in your inbox.

Laravel News

December 4, 2023

Full-text search with Laravel and Meilisearch

https://blog.meilisearch.com/content/images/size/w1200/2023/11/laravel_meili_test.jpg

In this guide, we will see how to use the search functionality in Laravel 10. We’ll start with by introducing the benefits of full-text search. Then, we’ll walk you through setting up full-text search in your Laravel application.

Why use full-text search?

In traditional SQL or NoSQL databases, queries find results exactly matching given criteria. Conversely, full-text search queries can match some or all of a text query with the database’s content. So essentially, full-text search can provide results even in case of partial matches.

When building user-facing search interfaces, full-text search is empowering for users. Tolerance to typos, prefix search, and synonyms help them get results more quickly. It improves discoverability when users do not know what they’re looking for.

How to use search functionality in Laravel 10?

Installing Laravel Scout

Laravel comes with out-of-the-box full-text search capabilities via Laravel Scout.

To enable it, navigate to your Laravel application directory and install Scout via the Composer package manager:

composer require laravel/scout

After installing Scout, you should publish the Scout configuration file. You can do this by running the following artisan command:

php artisan vendor:publish --provider="Laravel\Scout\ScoutServiceProvider"

This command should create a new configuration file in your application directory: config/scout.php.

Configuring the Laravel Scout driver

Let’s configure Laravel Scout to use the Meilisearch driver. Meilisearch is an open-source search engine built in Rust. This will allow to get the best full-text search performance. Indeed, the database driver comes with limitations inherent to SQL databases.

First, install the dependencies required to use Scout with Meilisearch via Composer:

composer require meilisearch/meilisearch-php http-interop/http-factory-guzzle

Then, update the environment variables in your .env file:

SCOUT_DRIVER=meilisearch
# Use the host below if you're running Meilisearch via Laravel Sail
MEILISEARCH_HOST=http://meilisearch:7700
MEILISEARCH_KEY=masterKey

Laravel’s official Docker development environment, Laravel Sail, comes with a Meilisearch service out-of-the-box. Please note that when running Meilisearch via Sail, Meilisearch’s host is http://meilisearch:7700.

For production use cases, we recommend using a managed Meilisearch via Meilisearch Cloud. On Meilisearch Cloud, you can find your host URL in your project settings.

Making Eloquent models searchable

With Scout installed and configured, just add the Laravel\Scout\Searchable trait to your Eloquent models to make them searchable. This trait will use Laravel’s model observers to keep the data in your model in sync with Meilisearch.

Here’s an example model:

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Model;
use Laravel\Scout\Searchable;

class Contact extends Model
{
	use Searchable;
}

You can use the toSearchableArray method to configure which fields to store in Meilisearch. This notably enables storing a model and its relationships’ data in the same document.

The example below shows how to store a model’s relationships data in Meilisearch:

<?php

namespace App\Models;

use App\Models\Company;
use Laravel\Scout\Searchable;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Relations\BelongsTo;

class Contact extends Model
{
    use Searchable;

    public function company(): BelongsTo
    {
        return $this->belongsTo(Company::class);
    }

    public function toSearchableArray(): array
    {
	    // All model attributes are made searchable
        $array = $this->toArray();

		// Then we add some additional fields
        $array['organization_id'] = $this->company->organization->id;
        $array['company_name'] = $this->company->name;
        $array['company_url'] = $this->company->url;

        return $array;
    }
}

Configuring filterable and sortable attributes

Meilisearch allows you to perform advanced filtering and sorting on your search results. Choose which attributes are filterable and sortable via your Meilisearch index settings.

Configure your Meilisearch index settings via the config/scout.php file:

<?php

use App\Models\Contact;

return [
	// additional configuration...
	
    'meilisearch' => [
        'host' => env('MEILISEARCH_HOST', 'http://localhost:7700'),
        'key' => env('MEILISEARCH_KEY'),
        'index-settings' => [
            Contact::class => [
                'filterableAttributes' => ['organization_id'],
                'sortableAttributes' => ['name', 'company_name']
            ],
        ],
    ],

The example above updates Meilisearch index settings for the Contact model:

it makes the organization_id field filterable
it makes the name and company_name fields sortable

Update your Meilisearch index settings by running the following Artisan command:

php artisan scout:sync-index-settings

Laravel full-text search example

We built a demo application to give you a feel of what full-text search looks like in a Laravel application. This demo showcases an app-wide search in a CRM (Customer Relationship Management) application.

CRM demo application build with Laravel — Laravel SaaS search demo

This demo application uses the following search features:

The code is open-sourced on Github. ????

???? Check out the repository: https://github.com/meilisearch/saas-demo

We hope this guide helped to understand the importance of full-text search and how to implement it with Laravel. For more information, read the Laravel Scout and Meilisearch docs.

Meilisearch is an open-source search engine with intuitive developer experience to build user-facing search. You can self-host it or get a premium experience with Meilisearch Cloud.

For more things Meilisearch, you can join the community on Discord or subscribe to the newsletter. You can learn more about the product by checking out the roadmap and participating in product discussions.

Laravel News Links

November 30, 2023

DC Wasteland Update: Watch these genius carjackers fail to boost a Porsche cuz they don’t know how to drive stick ????

https://media.notthebee.com/articles/6568ab08cfa946568ab08cfa95.jpg

Why didn’t the fathers of these stunning and brave citizens teach them how to drive a manual?

Not the Bee

November 29, 2023

Chicken McNuggets Training Video

https://theawesomer.com/photos/2023/11/1980s_mcnuggets_training_video_t.jpg

Link

There was lots to love about the 1980s, like Max Headroom, VHS tape boxes, and this McDonald’s training video, created to familiarize the crew with Chicken McNuggets and their sauces. What we got was a hilariously surreal short film with googly-eyed Big Macs and french fries welcoming their new friends to the menu. Brought to you by Tony Pepperoni.

The Awesomer

November 28, 2023

Smith & Wesson Releases New Performance Center M&P9 Metal M2.0 Spec Series

https://www.ammoland.com/wp-content/uploads/2023/11/Smith-Wesson-MP-9-500×472.jpg

Smith & Wesson Brands, Inc.(NASDAQ Global Select: SWBI), a leader in firearm manufacturing and design, today announces the release of its latest Spec Series Kit with the new Performance Center M&P9 Metal M2.0.

True to its design, this pistol not only sets a new benchmark for the Spec Series line but also places a heightened focus on performance, ensuring users encounter the pinnacle of what Smith & Wesson’s Performance Center models have to offer.

Live Inventory Price Checker

Smith & Wesson M&P9 M2.0 Compact 9mm	Brownells.com	$ 629.99 $ 499.99
SMITH & WESSON M&P9 M2.0 METAL COMPETITOR	Guns.com	$ 949.00
SMITH & WESSON M&P9 M2.0 9mm 5" 17rd Ported Pistol w/ Crimson Trace Red Dot – Black	KYGUNCO	$ 845.24
Smith & Wesson M&P9 M2.0 Metal 9MM Optic Ready Pistol – 4.25"	Rainier Arms	$ 849.95

Upgraded features integrated into this Spec Series pistol include a built-in Faxon compensator to mitigate felt recoil and muzzle rise, custom lightening cuts in the slide to reduce weight and improve reliability while being compensated, an enhanced sear for a lighter, crisp trigger let-off, suppressor height sights, and a sharp OD Green Cerakote© finish. Within its sleek new look lies a testament to durability – a robust all-metal frame that can withstand the elements while still maintaining a well-balanced feel in the hand.

“Our M&P polymer handguns have long been recognized for their reliability and ergonomic design. By combining these trusted attributes with the durability of the Metal M2.0 platform and adding modern performance upgrades, we were able to elevate the Spec Series to next level. This design is a bridge between tradition and progress, and offers a distinct edge across today’s dynamic shooting environments,” said Corey Beaudreau, Product Manager.

The PC M&P9 Metal M2.0 Spec Series ships in a custom hardcase and includes two 23-round magazines, two 17-round magazines, C.O.R.ETM plate system for mounting optics, a karambit style knife, and custom M&P Spec Series Challenge Coin. The MSRP for this kit is $999.

For more information on the Performance Center M&P9 Metal M2.0 Spec Series, visit https://www.smith-wesson.com/.

Smith & Wesson Releases New Performance Center M&P9 Metal M2.0 Spec Series by AmmoLand Shooting Sports News on Scribd

About Smith & Wesson Brands, Inc.

Smith & Wesson Brands, Inc. (NASDAQ Global Select: SWBI) is a U.S.-based leader in firearm manufacturing and design, delivering a broad portfolio of quality handgun, long gun, and suppressor products to the global consumer and professional markets under the iconic Smith & Wesson® and Gemtech® brands. The company also provides manufacturing services including forging, machining, and precision plastic injection molding services. For more information call (844) 363-5386 or visit smithwesson.com.

AmmoLand Shooting Sports News