Article URL: https://www.chosun.com/english/industry-en/2026/08/30/SBFXUIJQYZEARKP5T4FBAY25HQ/ Comments URL: https://news.ycombinator.com/item?id=49496292 Points: 101 # Comments: 31
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
A developer tutorial published on DEV Community demonstrates how to build a privacy-preserving fitness AI model using Federated Learning and Edge AI techniques. The approach keeps sensitive health data — such as heart rate, GPS, and sleep metrics — on users' devices rather than uploading it to a central cloud server. Only encrypted mathematical model updates, not raw data, are shared with an aggregation server using the FedAvg algorithm. The tutorial uses open-source tools Flower (flwr) and PySyft to build a collaborative calorie-prediction model across multiple simulated users. The method is presented as a practical path toward HIPAA-compliant, trust-building health applications in community fitness ecosystems.
Developers on Hacker News have been publicly abandoning paid AI coding tools like Claude Pro and Codex, citing usage limits that run out faster than expected and without clear explanation. Multiple users reported exhausting their monthly allowances within minutes or hours of starting complex tasks, prompting mid-project switches to competing services. The core frustration is not the tightness of the limits but their illegibility — subscribers cannot predict how limits are measured or when they will run out, making planning impossible. Some users concluded that paying directly through usage-based APIs is more reliable than flat subscriptions, since per-token billing at least makes costs transparent and predictable. The pattern documented across the week's discussions points to a recurring cycle: a heavy user hits an invisible wall mid-task, and that friction — rather than model quality — is what drives the cancellation.
A threat campaign dubbed Spring Ring uses fraudulent Microsoft 365 external tenants to impersonate corporate IT staff via Microsoft Teams chat and voice calls, according to a Unit 42 report published August 31, 2026. Attackers trick employees into granting remote access through RMM tools like Quick Assist or running malicious executables delivered via customized S3 URLs. In more advanced intrusions, the campaign deploys an obfuscated PowerShell RAT and attempts NTLM Relay attacks against domain controllers using the PetitPotam technique to escalate privileges. The attack chain can result in persistent access, hidden browser instances with sideloaded extensions, and lateral movement across internal networks, though NTLM Relay was blocked in observed cases. Security teams are advised to restrict external Teams communication, enforce RMM tool approvals, enable PowerShell and AMSI controls, and harden NTLM relay defenses including SMB signing.
ServiceNow has released patches for four severe security vulnerabilities affecting its AI Platform and Now Platform, three of which carry the maximum CVSS score of 10.0. The flaws include unauthenticated code injection via the GraphQL Composite Data API (CVE-2026-18885), a privilege escalation bug in configuration image upload processing (CVE-2026-18886), SQL injection in dynamic ORDER BY clauses (CVE-2026-74820), and a sandbox escape vulnerability (CVE-2026-6876). All four can be exploited remotely without authentication or user interaction, potentially allowing attackers to execute arbitrary code, manipulate databases, escalate privileges, and compromise integration credentials. No active exploitation has been confirmed in the wild as of the disclosure date. Organizations are advised to apply the available hotfixes immediately and restrict external access to ServiceNow administration, API, and upload endpoints.
Discussion (0)
Log in to join the discussion and vote.
Log in