Feed aggregator

MIT Human Insight Collaborative launches SHASS Faculty Fellows program

MIT Latest News - Wed, 02/19/2025 - 9:25am

A new initiative will offer faculty in the MIT School of Humanities, Arts, and Social Sciences (SHASS) the opportunity to participate in a semester-long internal fellows program.

The SHASS Faculty Fellows program, administered by the MIT Human Insight Collaborative (MITHIC), will provide faculty with time to focus on their research, writing, or artistic production, and to receive collegial support for the same; to foster social and intellectual community within SHASS, including between faculty and students beyond the classroom; and provide informal opportunities to develop intergenerational professional mentorships.

“SHASS faculty have been eager for a supportive, vibrant internal community for the nearly 35 years I’ve been at MIT,” says Anne McCants, the Ann F. Friedlaender Professor of History, and Faculty Fellows Program committee chair. “By providing participants with UROPs [Undergraduate Research Opportunities Program projects] and other opportunities to interact with students, we’re demonstrating our commitment to fostering an environment in which faculty can recharge and sustain the high-quality teaching and service our community has come to expect and appreciate.”

The creation of the program was one of the recommendations included in a May 2024 SHASS Programming Initiative Report, an effort led by Keeril Makan, SHASS associate dean for strategic initiatives, and the Michael (1949) and Sonja Koerner Music Composition Professor.

The inaugural group of fellows for Spring 2026 includes:

Tenure-line faculty are eligible to apply, with a maximum of 12 members selected per year, or roughly six participants per term.

Selected faculty will spend a semester outside the classroom while still holding time for sustained interaction with a small cohort of colleagues. Fellows can work with the dedicated students in UROP to advance their research projects while investing in a unique, cross-disciplinary set of conversations.

“I was honored to help design the Fellows Program and to serve on the review committee,” says Arthur Bahr, a professor in the Literature Section and a member of the Faculty Fellows Program Selection Committee. “I was fortunate to have wonderful mentors within Literature, but would have loved the opportunity to get to know and learn from colleagues in other fields, which the Fellows Program will offer.”

“What excites me about the Faculty Fellows Program — beyond the opportunity for faculty to connect with each other across disciplines and units — is that it will spotlight the excellence and centrality of the humanities, arts, and social sciences at MIT,” says Heather Paxson, SHASS associate dean for faculty, and the William R. Kenan, Jr. Professor of Anthropology. “I look forward to hearing about new ideas sparked, and new friendships made, through participation in the program.”

Organizers say the program signals that MIT takes its investment in the humanities, arts and social sciences as seriously as its peer institutions, most of which have internal fellows programs.

“Given the strong demand for something like this, getting the program up and running is an important signal to SHASS faculty that Dean [Agustín] Rayo hears their concerns and is committed to supporting this type of community development,” McCants notes.

Saving the Internet in Europe: Defending Privacy and Fighting Surveillance

EFF: Updates - Wed, 02/19/2025 - 7:19am

This post is part three in a series of posts about EFF’s work in Europe. Read about how and why we work in Europe here

EFF’s mission is to ensure that technology supports freedom, justice, and innovation for all people of the world. While our work has taken us to far corners of the globe, in recent years we have worked to expand our efforts in Europe, building up a policy team with key expertise in the region, and bringing our experience in advocacy and technology to the European fight for digital rights.  

In this blog post series, we will introduce you to the various players involved in that fight, share how we work in Europe, and discuss how what happens in Europe can affect digital rights across the globe. 

Implementing a Privacy First Approach to Fighting Online Harms

Infringements on privacy are commonplace across the world, and Europe is no exemption. Governments and regulators across the region are increasingly focused on a range of risks associated with the design and use of online platforms, such as addictive design, the effects of social media consumption on children’s and teenagers’ mental health, and dark patterns limiting consumer choices. Many of these issues share a common root: the excessive collection and processing of our most private and sensitive information by corporations for their own financial gain. 

One necessary approach to solving this pervasive problem is to reduce the amount of data that these entities can collect, analyze, and sell. The European General Data Protection Regulation (GDPR) is central to protecting users’ data protection rights in Europe, but the impact of the GDPR ultimately depends on how well it is enforced. Strengthening the enforcement of the GDPR in areas where data can be used to target, discriminate, and undermine fundamental rights is therefore a cornerstone in our work. 

Beyond the GDPR, we also bring our privacy first approach to fighting online harms to discussions on online safety and digital fairness. The Digital Services Act (DSA) makes some important steps to limit the use of some data categories to target users with ads, and bans targeteds ads for minors completely. This is the right approach, which we will build on as we contribute to the debate around the upcoming Digital Fairness Act

Age Verification Tools Are No Silver Bullet

As in many other jurisdictions around the world, age verification has become a hotly debated topic in the EU, with governments across Europe seeking to introduce them. In the United Kingdom, legislation like the Online Safety Act (OSA) was introduced to make the UK “the safest place” in the world to be online. The OSA requires platforms to prevent individuals from encountering certain illegal content, which will likely mandate the use of intrusive scanning systems. Even worse, it empowers the British government, in certain situations, to demand that online platforms use government-approved software to scan for illegal content. And they are not alone in seeking to do so. Last year, France banned social media access for children under 15 without parental consent, and Norway also pledged to follow a similar ban. 

Children’s safety is important, but there is little evidence that online age verification tools can help achieve this goal. EFF has long fought against mandatory age verification laws, from the U.S. to Australia, and we’ll continue to stand up against these types of laws in Europe. Not just for the sake of free expression, but to protect the free flow of information that is essential to a free society. 

Challenging Creeping Surveillance Powers

For years, we’ve observed a worrying tendency of technologies designed to protect people's privacy and data being re-framed as security concerns. And recent developments in Europe, like Germany’s rush to introduce biometric surveillance, signal a dangerous move towards expanding surveillance powers, justified by narratives framing complex digital policy issues as primarily security concerns. These approaches invite tradeoffs that risk undermining the privacy and free expression of individuals in the EU and beyond.

Even though their access to data has never been broader, law enforcement authorities across Europe continue to peddle the tale of the world “going dark.” With EDRi, we criticized the EU high level group “going dark” and sent a joint letter warning against granting law enforcement unfettered capacities that may lead to mass surveillance and violate fundamental rights. We have also been involved in Pegasus spyware investigations, with EFF’s Executive Director Cindy Cohn participating in an expert hearing on the matter. The issue of spyware is pervasive and intersects with many components of EU law, such as the anti-spyware provisions contained within the EU Media Freedom Act. Intrusive surveillance has a global dimension, and our work has combined advocacy at the UN with the EU, for example, by urging the EU Parliament to reject the UN Cybercrime Treaty.

Rather than increasing surveillance, countries across Europe must also make use of their prerogatives to ban biometric surveillance, ensuring that the use of this technology is not permitted in sensitive contexts such as Europe’s borders. Face recognition, for example, presents an inherent threat to individual privacy, free expression, information security, and social justice. In the UK, we’ve been working with national groups to ban government use of face recognition technology, which is currently administered by local police forces. Given the proliferation of state surveillance across Europe, government use of this technology must be banned.

Protecting the Right to Secure and Private Communications

EFF works closely on issues like encryption to defend the right to private communications in Europe. For years, EFF fought hard against an EU proposal that, if it became law, would have pressured online services to abandon end-to-end encryption. We joined together with EU allies and urged people to sign the “Don’t Scan Me” petition. We lobbied EU lawmakers and urged them to protect their constituents’ human right to have a private conversation—backed up by strong encryption. Our message broke through, and a key EU committee adopted a position that bars the mass scanning of messages and protects end-to-end encryption. It also bars mandatory age verification whereby users would have had to show ID to get online. As Member States are still debating their position on the proposal, this fight is not over yet. But we are encouraged by the recent European Court of Human Rights ruling which confirmed that undermining encryption violates fundamental rights to privacy. EFF will continue to advocate for this to governments, and the corporations providing our messaging services.

As we’ve said many times, both in Europe and the U.S., there is no middle ground to content scanning and no “safe backdoor” if the internet is to remain free and private. Either all content is scanned and all actors—including authoritarian governments and rogue criminals—have access, or no one does. EFF will continue to advocate for the right to a private conversation, and hold the EU accountable to the international and European human rights protections that they are signatories to. 

Looking Forward

EU legislation and international treaties should contain concrete human rights safeguards, robust data privacy standards, and sharp limits on intrusive surveillance powers, including in the context of global cooperation. 

Much work remains to be done. And we are ready for it. Late last year, we put forward comprehensive policy recommendations to European lawmakers and we will continue fighting for an internet where everyone can make their voice heard. In the next—and final—post in this series, you will learn more about how we work in Europe to ensure that digital markets are fair, offer users choice and respect fundamental rights.

FEMA email: Firings will affect ‘majority of our staff’

ClimateWire News - Wed, 02/19/2025 - 6:11am
After firing 200 probationary employees this weekend, FEMA was directed "to make a list" of anyone who worked on climate or equity.

‘You screwed people’: Inside NSF’s firing of 168 workers

ClimateWire News - Wed, 02/19/2025 - 6:09am
At an emotional meeting, National Science Foundation officials announced layoffs for about 10 percent of their workforce and warned of more firings to come.

EPA deadline on endangerment finding is here

ClimateWire News - Wed, 02/19/2025 - 6:08am
The agency is supposed to tell President Donald Trump on Wednesday whether it plans to challenge the landmark finding that underpins its climate rules.

DOE chief: Zero emissions is a ‘sinister goal’

ClimateWire News - Wed, 02/19/2025 - 6:07am
Energy Secretary Chris Wright told a conservative conference that the net-zero effort is “impoverishing citizens in pursuit of a delusion.”

Trump’s pick to lead BLM has fought the agency in court

ClimateWire News - Wed, 02/19/2025 - 6:06am
Kathleen Sgamma has led the Western Energy Alliance in litigation to push for more fossil fuel production on public lands.

Minnesota notches a legal win against Exxon

ClimateWire News - Wed, 02/19/2025 - 6:06am
A judge sided with the state in a climate case, breaking a spate of rulings that have tossed out efforts to hold the industry responsible for rising temperatures.

Kiley says he’ll invite Congress to roll back California vehicle emissions rules

ClimateWire News - Wed, 02/19/2025 - 6:05am
The California Republican said he plans to introduce a measure Friday to review the state’s electrification rules.

Germany set to scale down climate ambitions

ClimateWire News - Wed, 02/19/2025 - 6:04am
With the U.S. retreating from global climate efforts, countries across the world are looking to Germany to help close the gap. That may be wishful thinking.

Japan sets new carbon reduction target, pushing renewables and nuclear

ClimateWire News - Wed, 02/19/2025 - 6:03am
It marks an end to Japan's nuclear energy phaseout policy adopted after the 2011 meltdown crisis at the Fukushima Daiichi power plant.

Candymaking giant joins initiative to cut New Zealand farm emissions

ClimateWire News - Wed, 02/19/2025 - 6:03am
The program includes funding to get tools and technology onto farms that will help to cut emissions, as well as cash rewards for high achievers.

The role of cross- and interdisciplinary climate research centres

Nature Climate Change - Wed, 02/19/2025 - 12:00am

Nature Climate Change, Published online: 19 February 2025; doi:10.1038/s41558-025-02249-6

Climate research centres provide valuable support to scholars wanting to engage with interdisciplinary research. Fully leveraging this support requires strategic individual efforts. We outline how scholars can achieve collaborative synergy at the intersection of top-down institutional support and bottom-up individual action.

Like human brains, large language models reason about diverse data in a general way

MIT Latest News - Wed, 02/19/2025 - 12:00am

While early language models could only process text, contemporary large language models now perform highly diverse tasks on different types of data. For instance, LLMs can understand many languages, generate computer code, solve math problems, or answer questions about images and audio.   

MIT researchers probed the inner workings of LLMs to better understand how they process such assorted data, and found evidence that they share some similarities with the human brain.

Neuroscientists believe the human brain has a “semantic hub” in the anterior temporal lobe that integrates semantic information from various modalities, like visual data and tactile inputs. This semantic hub is connected to modality-specific “spokes” that route information to the hub. The MIT researchers found that LLMs use a similar mechanism by abstractly processing data from diverse modalities in a central, generalized way. For instance, a model that has English as its dominant language would rely on English as a central medium to process inputs in Japanese or reason about arithmetic, computer code, etc. Furthermore, the researchers demonstrate that they can intervene in a model’s semantic hub by using text in the model’s dominant language to change its outputs, even when the model is processing data in other languages.

These findings could help scientists train future LLMs that are better able to handle diverse data.

“LLMs are big black boxes. They have achieved very impressive performance, but we have very little knowledge about their internal working mechanisms. I hope this can be an early step to better understand how they work so we can improve upon them and better control them when needed,” says Zhaofeng Wu, an electrical engineering and computer science (EECS) graduate student and lead author of a paper on this research.

His co-authors include Xinyan Velocity Yu, a graduate student at the University of Southern California (USC); Dani Yogatama, an associate professor at USC; Jiasen Lu, a research scientist at Apple; and senior author Yoon Kim, an assistant professor of EECS at MIT and a member of the Computer Science and Artificial Intelligence Laboratory (CSAIL). The research will be presented at the International Conference on Learning Representations.

Integrating diverse data

The researchers based the new study upon prior work which hinted that English-centric LLMs use English to perform reasoning processes on various languages.

Wu and his collaborators expanded this idea, launching an in-depth study into the mechanisms LLMs use to process diverse data.

An LLM, which is composed of many interconnected layers, splits input text into words or sub-words called tokens. The model assigns a representation to each token, which enables it to explore the relationships between tokens and generate the next word in a sequence. In the case of images or audio, these tokens correspond to particular regions of an image or sections of an audio clip.

The researchers found that the model’s initial layers process data in its specific language or modality, like the modality-specific spokes in the human brain. Then, the LLM converts tokens into modality-agnostic representations as it reasons about them throughout its internal layers, akin to how the brain’s semantic hub integrates diverse information.

The model assigns similar representations to inputs with similar meanings, despite their data type, including images, audio, computer code, and arithmetic problems. Even though an image and its text caption are distinct data types, because they share the same meaning, the LLM would assign them similar representations.

For instance, an English-dominant LLM “thinks” about a Chinese-text input in English before generating an output in Chinese. The model has a similar reasoning tendency for non-text inputs like computer code, math problems, or even multimodal data.

To test this hypothesis, the researchers passed a pair of sentences with the same meaning but written in two different languages through the model. They measured how similar the model’s representations were for each sentence.

Then they conducted a second set of experiments where they fed an English-dominant model text in a different language, like Chinese, and measured how similar its internal representation was to English versus Chinese. The researchers conducted similar experiments for other data types.

They consistently found that the model’s representations were similar for sentences with similar meanings. In addition, across many data types, the tokens the model processed in its internal layers were more like English-centric tokens than the input data type.

“A lot of these input data types seem extremely different from language, so we were very surprised that we can probe out English-tokens when the model processes, for example, mathematic or coding expressions,” Wu says.

Leveraging the semantic hub

The researchers think LLMs may learn this semantic hub strategy during training because it is an economical way to process varied data.

“There are thousands of languages out there, but a lot of the knowledge is shared, like commonsense knowledge or factual knowledge. The model doesn’t need to duplicate that knowledge across languages,” Wu says.

The researchers also tried intervening in the model’s internal layers using English text when it was processing other languages. They found that they could predictably change the model outputs, even though those outputs were in other languages.

Scientists could leverage this phenomenon to encourage the model to share as much information as possible across diverse data types, potentially boosting efficiency.

But on the other hand, there could be concepts or knowledge that are not translatable across languages or data types, like culturally specific knowledge. Scientists might want LLMs to have some language-specific processing mechanisms in those cases.

“How do you maximally share whenever possible but also allow languages to have some language-specific processing mechanisms? That could be explored in future work on model architectures,” Wu says.

In addition, researchers could use these insights to improve multilingual models. Often, an English-dominant model that learns to speak another language will lose some of its accuracy in English. A better understanding of an LLM’s semantic hub could help researchers prevent this language interference, he says.

“Understanding how language models process inputs across languages and modalities is a key question in artificial intelligence. This paper makes an interesting connection to neuroscience and shows that the proposed ‘semantic hub hypothesis’ holds in modern language models, where semantically similar representations of different data types are created in the model’s intermediate layers,” says Mor Geva Pipek, an assistant professor in the School of Computer Science at Tel Aviv University, who was not involved with this work. “The hypothesis and experiments nicely tie and extend findings from previous works and could be influential for future research on creating better multimodal models and studying links between them and brain function and cognition in humans.”

This research is funded, in part, by the MIT-IBM Watson AI Lab.

MIT spinout maps the body’s metabolites to uncover the hidden drivers of disease

MIT Latest News - Wed, 02/19/2025 - 12:00am

Biology is never simple. As researchers make strides in reading and editing genes to treat disease, for instance, a growing body of evidence suggests that the proteins and metabolites surrounding those genes can’t be ignored.

The MIT spinout ReviveMed has created a platform for measuring metabolites — products of metabolism like lipids, cholesterol, sugar, and carbs — at scale. The company is using those measurements to uncover why some patients respond to treatments when others don’t and to better understand the drivers of disease.

“Historically, we’ve been able to measure a few hundred metabolites with high accuracy, but that’s a fraction of the metabolites that exist in our bodies,” says ReviveMed CEO Leila Pirhaji PhD ’16, who founded the company with Professor Ernest Fraenkel. “There’s a massive gap between what we’re accurately measuring and what exists in our body, and that’s what we want to tackle. We want to tap into the powerful insights from underutilized metabolite data.”

ReviveMed’s progress comes as the broader medical community is increasingly linking dysregulated metabolites to diseases like cancer, Alzheimer’s, and cardiovascular disease. ReviveMed is using its platform to help some of the largest pharmaceutical companies in the world find patients that stand to benefit from their treatments. It’s also offering software to academic researchers for free to help gain insights from untapped metabolite data.

“With the field of AI booming, we think we can overcome data problems that have limited the study of metabolites,” Pirhaji says. “There’s no foundation model for metabolomics, but we see how these models are changing various fields such as genomics, so we’re starting to pioneer their development.”

Finding a challenge

Pirhaji was born and raised in Iran before coming to MIT in 2010 to pursue her PhD in biological engineering. She had previously read Fraenkel’s research papers and was excited to contribute to the network models he was building, which integrated data from sources like genomes, proteomes, and other molecules.

“We were thinking about the big picture in terms of what you can do when you can measure everything — the genes, the RNA, the proteins, and small molecules like metabolites and lipids,” says Fraenkel, who currently serves on ReviveMed’s board of directors. “We’re probably only able to measure something like 0.1 percent of small molecules in the body. We thought there had to be a way to get as comprehensive a view of those molecules as we have for the other ones. That would allow us to map out all of the changes occurring in the cell, whether it's in the context of cancer or development or degenerative diseases.”

About halfway through her PhD, Pirhaji sent some samples to a collaborator at Harvard University to collect data on the metabolome — the small molecules that are the products of metabolic processes. The collaborator sent Pirhaji back a huge excel sheet with thousands of lines of data — but they told her she’s better off ignoring everything beyond the top 100 rows because they had no idea what the other data meant. She took that as a challenge.

“I started thinking maybe we could use our network models to solve this problem,” Pirhaji recalls. “There was a lot of ambiguity in the data, and it was very interesting to me because no one had tried this before. It seemed like a big gap in the field.”

Pirhaji developed a huge knowledge graph that included millions of interactions between proteins and metabolites. The data was rich but messy — Pirhaji called it a “hair ball” that couldn’t tell researchers anything about disease. To make it more useful, she created a new way to characterize metabolic pathways and features. In a 2016 paper in Nature Methods, she described the system and used it to analyze metabolic changes in a model of Huntington’s disease.

Initially, Pirhaji had no intention of starting a company, but she started realizing the technology’s commercial potential in the final years of her PhD.

“There’s no entrepreneurial culture in Iran,” Pirhaji says. “I didn’t know how to start a company or turn science into a startup, so I leveraged everything MIT offered.”

Pirhaji began taking classes at the MIT Sloan School of Management, including Course 15.371 (Innovation Teams), where she teamed up with classmates to think about how to apply her technology. She also used the MIT Venture Mentoring Service and MIT Sandbox, and took part in the Martin Trust Center for MIT Entrepreneurship’s delta v startup accelerator.

When Pirhaji and Fraenkel officially founded ReviveMed, they worked with MIT’s Technology Licensing Office to access the patents around their work. Pirhaji has since further developed the platform to solve other problems she discovered from talks with hundreds of leaders in pharmaceutical companies.

ReviveMed began by working with hospitals to uncover how lipids are dysregulated in a disease known as metabolic dysfunction-associated steatohepatitis. In 2020, ReviveMed worked with Bristol Myers Squibb to predict how subsets of cancer patients would respond to the company’s immunotherapies.

Since then, ReviveMed has worked with several companies, including four of the top 10 global pharmaceutical companies, to help them understand the metabolic mechanisms behind their treatments. Those insights help identify the patients that stand to benefit the most from different therapies more quickly.

“If we know which patients will benefit from every drug, it would really decrease the complexity and time associated with clinical trials,” Pirhaji says. “Patients will get the right treatments faster.”

Generative models for metabolomics

Earlier this year, ReviveMed collected a dataset based on 20,000 patient blood samples that it used to create digital twins of patients and generative AI models for metabolomics research. ReviveMed is making its generative models available to nonprofit academic researchers, which could accelerate our understanding of how metabolites influence a range of diseases.

“We’re democratizing the use of metabolomic data,” Pirhaji says. “It’s impossible for us to have data from every single patient in the world, but our digital twins can be used to find patients that could benefit from treatments based on their demographics, for instance, by finding patients that could be at risk of cardiovascular disease.”

The work is part of ReviveMed’s mission to create metabolic foundation models that researchers and pharmaceutical companies can use to understand how diseases and treatments change the metabolites of patients.

“Leila solved a lot of really hard problems you face when you’re trying to take an idea out of the lab and turn it into something that’s robust and reproducible enough to be deployed in biomedicine,” Fraenkel says. “Along the way, she also realized the software that she’s developed is incredibly powerful by itself and could be transformational.”

Crimson Memo: Analyzing the Privacy Impact of Xianghongshu AKA Red Note

EFF: Updates - Tue, 02/18/2025 - 7:29pm

Early in January 2025 it seemed like TikTok was on the verge of being banned by the U.S. government. In reaction to this imminent ban, several million people in the United States signed up for a different China-based social network known in the U.S. as RedNote, and in China as Xianghongshu (小红书/ 小紅書; which translates to Little Red Book). 

RedNote is an application and social network created in 2013 that currently has over 300 million users. Feature-wise, it is most comparable to Instagram and is primarily used for sharing pictures, videos, and shopping. The vast majority of its users live in China, are born after 1990, and are women. Even before the influx of new users in January, RedNote has historically had many users outside of China, primarily people from the Chinese diaspora who have friends and relatives on the network. RedNote is largely funded by two major Chinese tech corporations: Tencent and Alibaba. 

When millions of U.S. based users started flocking to the application, the traditional rounds of pearl clutching and concern trolling began. Many people raised the alarm about U.S. users entrusting their data with a Chinese company, and it is implied, the Chinese Communist Party. The reaction from U.S. users was an understandable, if unfortunate, bit of privacy nihilism. People responded that they, “didn’t care if someone in China was getting their data since US companies such as Meta and Google had already stolen their data anyway.” “What is the difference,” people argued, “between Meta having my data and someone in China? How does this affect me in any way?”

Even if you don’t care about giving China your data, it is not safe to use any application that doesn’t use encryption by default. 

Last week, The Citizen Lab at The Munk School Of Global Affairs, University of Toronto, released a report authored by Mona Wang, Jeffrey Knockel, and Irene Poetranto which highlights three serious security issues in the RedNote app. The most concerning finding from Citizen Lab is a revelation that RedNote retrieves uploaded user content over plaintext http. This means that anyone else on your network, at your internet service provider, or organizations like the NSA, can see everything you look at and upload to RedNote. Moreover someone could intercept that request and replace it with their own media or even an exploit to install malware on your device. 

In light of this report the EFF Threat Lab decided to confirm the CItizen Lab findings and do some additional privacy investigation of RedNote. We used static analysis techniques for our investigation, including manual static analysis of decompiled source code, and automated scanners including MobSF and Exodus Privacy. We only analyzed Version 8.59.5 of RedNote for Android downloaded from the website APK Pure.

EFF has independently confirmed the finding that Red Note retrieves posted content over plaintext http. Due to this lack of even basic transport layer encryption we don’t think this application is safe for anyone to use. Even if you don’t care about giving China your data, it is not safe to use any application that doesn’t use encryption by default. 

Citizen Lab researchers also found that users’ file contents are readable by network attackers. We were able to confirm that RedNote encrypts several sensitive files with static keys which are present in the app and the same across all installations of the app, meaning anyone who was able to retrieve those keys from a decompiled version of the app could decrypt these sensitive files for any user of the application. The Citizen Lab report also found a vulnerability where an attacker could identify the contents of any file readable by the application. This was out of scope for us to test but we find no reason to doubt this claim. 

The third major finding by Citizen Lab was that RedNote transmits device metadata in a way that can be eavesdropped on by network attackers, sometimes without encryption at all, and sometimes in a way vulnerable to a machine-in-the middle attack. We can confirm that RedNote does not validate HTTPS certificates properly. Testing this vulnerability was out of scope for EFF, but we find no reason to doubt this claim. 

Permissions and Trackers

EFF performed further analysis of the permissions and trackers requested by RedNote. Our findings indicate two other potential privacy issues with the application. 

RedNote requests some very sensitive permissions, including location information, even when the app is not running in the foreground. This permission is not requested by other similar apps such as TikTok, Facebook, or Instagram. 

We also found, using an online scanner for tracking software called Exodus Privacy, that RedNote is not a platform which will protect its users from U.S.-based surveillance capitalism. In addition to sharing userdata with the Chinese companies Tencent and ByteDance, it also shares user data with Facebook and Google. 

Other Issues 

RedNote contains functionality to update its own code after it’s downloaded from the Google Play store using an open source library called APK Patch. This could be used to inject malicious code into the application after it has been downloaded without such code being revealed in automated scans meant to protect against malicious applications being uploaded to official stores, like Google Play. 

Recommendations

Due to the lack of encryption we do not consider it safe for anyone to run this app. If you are going to use RedNote, we recommend doing so with the absolute minimum set of permissions necessary for the app to function (see our guides for iPhone and Android.) At least a part of this blame falls on Google. Android needs to stop allowing apps to make unencrypted requests at all. 

Due to the lack of encryption we do not consider it safe for anyone to run this app.

RedNote should immediately take steps to encrypt all traffic from their application and remove the permission for background location information. 

Users should also keep in mind that RedNote is not a platform which values free speech. It’s a heavily censored application where topics such as political speech, drugs and addiction, and sexuality are more tightly controlled than similar social networks. 

Since it shares data with Facebook and Google ad networks, RedNote users should also keep in mind that it’s not a platform that protects you from U.S.-based surveillance capitalism.

The willingness of users to so quickly move to RedNote also highlights the fact that people are hungry for platforms that aren't controlled by the same few American tech oligarchs. People will happily jump to another platform even if it presents new, unknown risks; or is controlled by foreign tech oligarchs such as Tencent and Alibaba.

However, federal bans of such applications are not the correct answer. When bans are targeted at specific platforms such as TikTok, Deepseek, and RedNote rather than privacy-invasive practices such as sharing sensitive details with surveillance advertising platforms, users who cannot participate on the banned platform may still have their privacy violated when they flock to other platforms. The real solution to the potential privacy harms of apps like RedNote is to ensure (through technology, regulation, and law) that people’s sensitive information isn’t entered into the surveillance capitalist data stream in the first place.

We need a federal, comprehensive, consumer-focused privacy law. Our government is failing to address the fundamental harms of privacy-invading social media. Implementing xenophobic, free-speech infringing policy is having the unintended consequence of driving folks to platforms with even more aggressive censorship. This outcome was foreseeable. Rather than a knee-jerk reaction banning the latest perceived threat, these issues could have been avoided by addressing privacy harms at the source and enacting strong consumer-protection laws. 

Figure 1. Permissions requested by RedNote



Permission

Description

android.permission.ACCESS_BACKGROUND_LOCATION

This app can access location at any time, even while the app is not in use.

android.permission.ACCESS_COARSE_LOCATION

This app can get your approximate location from location services while the app is in use. Location services for your device must be turned on for the app to get location.

android.permission.ACCESS_FINE_LOCATION

This app can get your precise location from location services while the app is in use. Location services for your device must be turned on for the app to get location. This may increase battery usage.

android.permission.ACCESS_MEDIA_LOCATION

Allows the app to read locations from your media collection.

android.permission.ACCESS_NETWORK_STATE

Allows the app to view information about network connections such as which networks exist and are connected.

android.permission.ACCESS_WIFI_STATE

Allows the app to view information about Wi-Fi networking, such as whether Wi-Fi is enabled and name of connected Wi-Fi devices.

android.permission.AUTHENTICATE_ACCOUNTS

Allows the app to use the account authenticator capabilities of the AccountManager, including creating accounts and getting and setting their passwords.

android.permission.BLUETOOTH

Allows the app to view the configuration of the Bluetooth on the phone, and to make and accept connections with paired devices.

android.permission.BLUETOOTH_ADMIN

Allows the app to configure the local Bluetooth phone, and to discover and pair with remote devices.

android.permission.BLUETOOTH_CONNECT

Allows the app to connect to paired Bluetooth devices

android.permission.CAMERA

This app can take pictures and record videos using the camera while the app is in use.

android.permission.CHANGE_NETWORK_STATE

Allows the app to change the state of network connectivity.

android.permission.CHANGE_WIFI_STATE

Allows the app to connect to and disconnect from Wi-Fi access points and to make changes to device configuration for Wi-Fi networks.

android.permission.EXPAND_STATUS_BAR

Allows the app to expand or collapse the status bar.

android.permission.FLASHLIGHT

Allows the app to control the flashlight.

android.permission.FOREGROUND_SERVICE

Allows the app to make use of foreground services.

android.permission.FOREGROUND_SERVICE_DATA_SYNC

Allows the app to make use of foreground services with the type dataSync

android.permission.FOREGROUND_SERVICE_LOCATION

Allows the app to make use of foreground services with the type location

android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK

Allows the app to make use of foreground services with the type mediaPlayback

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

Allows the app to make use of foreground services with the type mediaProjection

android.permission.FOREGROUND_SERVICE_MICROPHONE

Allows the app to make use of foreground services with the type microphone

android.permission.GET_ACCOUNTS

Allows the app to get the list of accounts known by the phone. This may include any accounts created by applications you have installed.

android.permission.INTERNET

Allows the app to create network sockets and use custom network protocols. The browser and other applications provide means to send data to the internet, so this permission is not required to send data to the internet.

android.permission.MANAGE_ACCOUNTS

Allows the app to perform operations like adding and removing accounts, and deleting their password.

android.permission.MANAGE_MEDIA_PROJECTION

Allows an application to manage media projection sessions. These sessions can provide applications the ability to capture display and audio contents. Should never be needed by normal apps.

android.permission.MODIFY_AUDIO_SETTINGS

Allows the app to modify global audio settings such as volume and which speaker is used for output.

android.permission.POST_NOTIFICATIONS

Allows the app to show notifications

android.permission.READ_CALENDAR

This app can read all calendar events stored on your phone and share or save your calendar data.

android.permission.READ_CONTACTS

Allows the app to read data about your contacts stored on your phone. Apps will also have access to the accounts on your phone that have created contacts. This may include accounts created by apps you have installed. This permission allows apps to save your contact data, and malicious apps may share contact data without your knowledge.

android.permission.READ_EXTERNAL_STORAGE

Allows the app to read the contents of your shared storage.

android.permission.READ_MEDIA_AUDIO

Allows the app to read audio files from your shared storage.

android.permission.READ_MEDIA_IMAGES

Allows the app to read image files from your shared storage.

android.permission.READ_MEDIA_VIDEO

Allows the app to read video files from your shared storage.

android.permission.READ_PHONE_STATE

Allows the app to access the phone features of the device. This permission allows the app to determine the phone number and device IDs, whether a call is active, and the remote number connected by a call.

android.permission.READ_SYNC_SETTINGS

Allows the app to read the sync settings for an account. For example, this can determine whether the People app is synced with an account.

android.permission.RECEIVE_BOOT_COMPLETED

Allows the app to have itself started as soon as the system has finished booting. This can make it take longer to start the phone and allow the app to slow down the overall phone by always running.

android.permission.RECEIVE_USER_PRESENT

Unknown permission from android reference

android.permission.RECORD_AUDIO

This app can record audio using the microphone while the app is in use.

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

Allows an app to ask for permission to ignore battery optimizations for that app.

android.permission.REQUEST_INSTALL_PACKAGES

Allows an application to request installation of packages.

android.permission.SCHEDULE_EXACT_ALARM

This app can schedule work to happen at a desired time in the future. This also means that the app can run when youu2019re not actively using the device.

android.permission.SYSTEM_ALERT_WINDOW

This app can appear on top of other apps or other parts of the screen. This may interfere with normal app usage and change the way that other apps appear.

android.permission.USE_CREDENTIALS

Allows the app to request authentication tokens.

android.permission.VIBRATE

Allows the app to control the vibrator.

android.permission.WAKE_LOCK

Allows the app to prevent the phone from going to sleep.

android.permission.WRITE_CALENDAR

This app can add, remove, or change calendar events on your phone. This app can send messages that may appear to come from calendar owners, or change events without notifying their owners.

android.permission.WRITE_CLIPBOARD_SERVICE

Unknown permission from android reference

android.permission.WRITE_EXTERNAL_STORAGE

Allows the app to write the contents of your shared storage.

android.permission.WRITE_SETTINGS

Allows the app to modify the system's settings data. Malicious apps may corrupt your system's configuration.

android.permission.WRITE_SYNC_SETTINGS

Allows an app to modify the sync settings for an account. For example, this can be used to enable sync of the People app with an account.

cn.org.ifaa.permission.USE_IFAA_MANAGER

Unknown permission from android reference

com.android.launcher.permission.INSTALL_SHORTCUT

Allows an application to add Homescreen shortcuts without user intervention.

com.android.launcher.permission.READ_SETTINGS

Unknown permission from android reference

com.asus.msa.SupplementaryDID.ACCESS

Unknown permission from android reference

com.coloros.mcs.permission.RECIEVE_MCS_MESSAGE

Unknown permission from android reference

com.google.android.gms.permission.AD_ID

Unknown permission from android reference

com.hihonor.push.permission.READ_PUSH_NOTIFICATION_INFO

Unknown permission from android reference

com.hihonor.security.permission.ACCESS_THREAT_DETECTION

Unknown permission from android reference

com.huawei.android.launcher.permission.CHANGE_BADGE

Unknown permission from android reference

com.huawei.android.launcher.permission.READ_SETTINGS

Unknown permission from android reference

com.huawei.android.launcher.permission.WRITE_SETTINGS

Unknown permission from android reference

com.huawei.appmarket.service.commondata.permission.GET_COMMON_DATA

Unknown permission from android reference

com.huawei.meetime.CAAS_SHARE_SERVICE

Unknown permission from android reference

com.meizu.c2dm.permission.RECEIVE

Unknown permission from android reference

com.meizu.flyme.push.permission.RECEIVE

Unknown permission from android reference

com.miui.home.launcher.permission.INSTALL_WIDGET

Unknown permission from android reference

com.open.gallery.smart.Provider

Unknown permission from android reference

com.oplus.metis.factdata.permission.DATABASE

Unknown permission from android reference

com.oplus.permission.safe.AI_APP

Unknown permission from android reference

com.vivo.identifier.permission.OAID_STATE_DIALOG

Unknown permission from android reference

com.vivo.notification.permission.BADGE_ICON

Unknown permission from android reference

com.xiaomi.dist.permission.ACCESS_APP_HANDOFF

Unknown permission from android reference

com.xiaomi.dist.permission.ACCESS_APP_META

Unknown permission from android reference

com.xiaomi.security.permission.ACCESS_XSOF

Unknown permission from android reference

com.xingin.xhs.permission.C2D_MESSAGE

Unknown permission from android reference

com.xingin.xhs.permission.JOPERATE_MESSAGE

Unknown permission from android reference

com.xingin.xhs.permission.JPUSH_MESSAGE

Unknown permission from android reference

com.xingin.xhs.permission.MIPUSH_RECEIVE

Unknown permission from android reference

com.xingin.xhs.permission.PROCESS_PUSH_MSG

Unknown permission from android reference

com.xingin.xhs.permission.PUSH_PROVIDER

Unknown permission from android reference

com.xingin.xhs.push.permission.MESSAGE

Unknown permission from android reference

freemme.permission.msa

Unknown permission from android reference

freemme.permission.msa.SECURITY_ACCESS

Unknown permission from android reference

getui.permission.GetuiService.com.xingin.xhs

Unknown permission from android reference

ohos.permission.ACCESS_SEARCH_SERVICE

Unknown permission from android reference

oplus.permission.settings.LAUNCH_FOR_EXPORT

Unknown permission from android reference

Unlocking the secrets of fusion’s core with AI-enhanced simulations

MIT Latest News - Tue, 02/18/2025 - 3:45pm

Creating and sustaining fusion reactions — essentially recreating star-like conditions on Earth — is extremely difficult, and Nathan Howard PhD ’12, a principal research scientist at the MIT Plasma Science and Fusion Center (PSFC), thinks it’s one of the most fascinating scientific challenges of our time. “Both the science and the overall promise of fusion as a clean energy source are really interesting. That motivated me to come to grad school [at MIT] and work at the PSFC,” he says.

Howard is member of the Magnetic Fusion Experiments Integrated Modeling (MFE-IM) group at the PSFC. Along with MFE-IM group leader Pablo Rodriguez-Fernandez, Howard and the team use simulations and machine learning to predict how plasma will behave in a fusion device. MFE-IM and Howard’s research aims to forecast a given technology or configuration’s performance before it’s piloted in an actual fusion environment, allowing for smarter design choices. To ensure their accuracy, these models are continuously validated using data from previous experiments, keeping their simulations grounded in reality.

In a recent open-access paper titled “Prediction of Performance and Turbulence in ITER Burning Plasmas via Nonlinear Gyrokinetic Profile Prediction,” published in the January issue of Nuclear Fusion, Howard explains how he used high-resolution simulations of the swirling structures present in plasma, called turbulence, to confirm that the world’s largest experimental fusion device, currently under construction in Southern France, will perform as expected when switched on. He also demonstrates how a different operating setup could produce nearly the same amount of energy output but with less energy input, a discovery that could positively affect the efficiency of fusion devices in general.

The biggest and best of what’s never been built

Forty years ago, the United States and six other member nations came together to build ITER (Latin for “the way”), a fusion device that, once operational, would yield 500 megawatts of fusion power, and a plasma able to generate 10 times more energy than it absorbs from external heating. The plasma setup designed to achieve these goals — the most ambitious of any fusion experiment — is called the ITER baseline scenario, and as fusion science and plasma physics have progressed, ways to achieve this plasma have been refined using increasingly more powerful simulations like the modeling framework Howard used.

In his work to verify the baseline scenario, Howard used CGYRO, a computer code developed by Howard’s collaborators at General Atomics. CGYRO applies a complex plasma physics model to a set of defined fusion operating conditions. Although it is time-intensive, CGYRO generates very detailed simulations on how plasma behaves at different locations within a fusion device.

The comprehensive CGYRO simulations were then run through the PORTALS framework, a collection of tools originally developed at MIT by Rodriguez-Fernandez. “PORTALS takes the high-fidelity [CGYRO] runs and uses machine learning to build a quick model called a ‘surrogate’ that can mimic the results of the more complex runs, but much faster,” Rodriguez-Fernandez explains. “Only high-fidelity modeling tools like PORTALS give us a glimpse into the plasma core before it even forms. This predict-first approach allows us to create more efficient plasmas in a device like ITER.”

After the first pass, the surrogates’ accuracy was checked against the high-fidelity runs, and if a surrogate wasn’t producing results in line with CGYRO’s, PORTALS was run again to refine the surrogate until it better mimicked CGYRO’s results. “The nice thing is, once you have built a well-trained [surrogate] model, you can use it to predict conditions that are different, with a very much reduced need for the full complex runs.” Once they were fully trained, the surrogates were used to explore how different combinations of inputs might affect ITER’s predicted performance and how it achieved the baseline scenario. Notably, the surrogate runs took a fraction of the time, and they could be used in conjunction with CGYRO to give it a boost and produce detailed results more quickly.

“Just dropped in to see what condition my condition was in”

Howard’s work with CGYRO, PORTALS, and surrogates examined a specific combination of operating conditions that had been predicted to achieve the baseline scenario. Those conditions included the magnetic field used, the methods used to control plasma shape, the external heating applied, and many other variables. Using 14 iterations of CGYRO, Howard was able to confirm that the current baseline scenario configuration could achieve 10 times more power output than input into the plasma. Howard says of the results, “The modeling we performed is maybe the highest fidelity possible at this time, and almost certainly the highest fidelity published.”

The 14 iterations of CGYRO used to confirm the plasma performance included running PORTALS to build surrogate models for the input parameters and then tying the surrogates to CGYRO to work more efficiently. It only took three additional iterations of CGYRO to explore an alternate scenario that predicted ITER could produce almost the same amount of energy with about half the input power. The surrogate-enhanced CGYRO model revealed that the temperature of the plasma core — and thus the fusion reactions — wasn’t overly affected by less power input; less power input equals more efficient operation. Howard’s results are also a reminder that there may be other ways to improve ITER’s performance; they just haven’t been discovered yet.

Howard reflects, “The fact that we can use the results of this modeling to influence the planning of experiments like ITER is exciting. For years, I’ve been saying that this was the goal of our research, and now that we actually do it — it’s an amazing arc, and really fulfilling.” 

Story About Medical Device Security

Schneier on Security - Tue, 02/18/2025 - 7:06am

Ben Rothke relates a story about me working with a medical device firm back when I was with BT. I don’t remember the story at all, or who the company was. But it sounds about right.

Trump takes ’giant wrecking ball’ to US research

ClimateWire News - Tue, 02/18/2025 - 6:14am
America's status as a global science leader is in doubt as the administration freezes funding and targets research that references climate or diversity.

Researchers pull plug on project to save sea ice

ClimateWire News - Tue, 02/18/2025 - 6:12am
The geoengineering experiment sought to use tiny silica beads to reflect sunlight away from Earth.

Pages