Agreguesi i feed

A man dressed as Darth Vader used a Public Safety and Livable Neighborhoods Committee meeting in San Diego to mock the city's use of Flock surveillance cameras, sarcastically arguing that the technology would help the "emperor" track "rebel scum" and find Luke Skywalker. "This is what the emperor needs. This technology will help us find the rebel scum and the hidden base on Hoth," he said. The Hill reports: He urged that the cameras be used to surveil any "rebel scum as they move from playground to playground, from playground to pool, from pool to gymnasium, because we all know that the Flock cameras are not only following the license plate readers, they are following children." The plea for the cameras shifted to raising taxes to clear out storm drains and to the clearing of homeless encampments in the city. The man said the council members can use "doublespeak" to say the police department is humanitarian. "And how will the people trust this City Council when this City Council continues to vote for surveillance technology that imprisons them? Ms. Campbell, you must work on your Jedi mind tricks," he said, addressing City Council member Jennifer Campbell, before waving his hand to the audience. "Do it like this." His last plea was for the Flock cameras to be used to "help us find Luke Skywalker as he traverses the universe in his X-wing." "This technology is a necessary, necessary force," he concluded. According to DeFlock, San Diego has more than 550 Flock cameras across the city.

Read more of this story at Slashdot.

Micron says it will spend $10 billion over the next decade on a new research lab in Boise focused on advanced memory technologies, computing systems, and future chip manufacturing. Here are some details, as reported by Reuters: - Micron Research Labs will bring together customers, academia, government and the broader semiconductor ecosystem to pursue breakthroughs, the company said. - The latest investment builds on the more than $250 billion that Micron had separately committed to manufacturing and R&D across the United States. - The lab will be connected to Micron's research and technology footprint across the U.S., Europe, Japan, India, Singapore and Taiwan. - Growing adoption of AI workloads and infrastructure buildout have boosted demand for high-bandwidth memory, which rapidly feeds data to AI accelerators, making it a critical component of modern computing infrastructure. - The Trump administration has prioritized domestic chip manufacturing in a bid to reduce foreign dependence, boost the economic output and maintain its lead in the AI race. - Micron expects to break ground on the facility in 2027, which will be capable of hosting hundreds of researchers and facilitating international conferences and workshops.

Read more of this story at Slashdot.

Linus Torvalds says AI "enormously helped" him track down a stubborn Intel Xe graphics driver bug that took 24 debugging patches and 18 kernel boots to isolate. "I'd like to call it my tireless helper, but the AI several times stated flat out that this was impossible and unsolvable and that we should just write a report about it," wrote Torvalds on the commit. "I suspect those things have been trained by people who may not be quite as stubborn as I am..." Phoronix reports: The patch by Linus Torvalds is for the Xe kernel driver and the change is no longer hand out the flat Compute Command Streamer (CCS) storage as usable vRAM. On a Battlemage G21 graphics card, he was hitting a scenario where there was a mismatch where the usable memory ended and hit a case where the GDM display manager would end up being endlessly restarted. [...] Linus Torvalds views AI as a useful tool and in this case reaffirmed he found it "enormously helped" his effort in tracking down this Intel graphics driver bug. The Intel Xe driver fix is merged to Linux 7.3 Git and is also marked to back-porting to the stable kernel branches.

Read more of this story at Slashdot.

Confidential computing can protect sensitive workloads even when the cloud host cannot be fully trusted. Confidential virtual machines can shield memory and CPU state from the hypervisor. Disk encryption can also stop the host from reading stored data. But how does the virtual machine know the disk state it received is the newest?

After years of refusing to adopt tap-to-pay technology in its stores, retail giant Walmart announced today that it is finally accepting payments via both Apple Pay and Google Pay. The rollout begins August 24 at select Walmart and Sam's Club locations and is expected to reach all stores by year-end. It will then expand to fuel stations by mid-2027. TechCrunch reports: The news is a surprise, as Walmart has long refused to adopt the ubiquitous payment technology to instead promote its own in-house solutions, like Walmart Pay and Scan-and-Go. In years past, Walmart even teamed up with other big retailers in an attempt to take down Apple Pay entirely with an alternative mobile payment system of their own, called CurrentC. The effort failed and was shut down back in 2016. All the while, Walmart customers have begged the company to support modern tap-and-pay technology, like Apple Pay, which is now accepted at 85% of retailers across the U.S., including most larger stores. For Walmart, the decision reads as a defeat. As one of the world's largest retailers, it believed it could push customers to its own payment solutions despite the growing adoption of Apple Pay and others of its kind. Ultimately, it had to admit that it was disadvantaging its own customers in the process.

Read more of this story at Slashdot.

Earlier this year as I drift abroad in France, I made a new abstraction over Avahi and systemd-resolved. It is called librebonjour and I wrote about it here.

It’s nice in that I no longer need to build Avahi to get GObject bindings to essentially call a D-Bus interface. It’s also nice to not have to care as an application developer if the system is configured with Avahi or systemd-resolved. Though, the systemd-resolved abstraction was lacking a bit compared to Avahi due to missing features.

When you are browsing for services using Avahi, you can be notified automatically of changes. This doesn’t quite work the same in systemd-resolved. Librebonjour had to set a timer and poll occasionally for updates and compare old-to-new sets to notify the application. Not very ideal.

When looking at a recent systemd checkout, I noticed that it already had support for the notification over its varlink interface. A handfull of commits later to hoist a few things and handle client disconnections/isolation properly and I can have the feature for librebonjour too.

One more dependency I can cut out of my system (there will be many more coming, I assure you, as GNOME is heavy with cruft).

I’ve been working on a bunch of things across the Linux puzzle for a product I want to build. Here is an overview of a few of those things.

LibMKS at 120hz

I wanted to get my virtual machines to 120hz so that I can start testing product features inside of VMs. In fact, I actually like doing development with virtual machines over say, trying to shove all your development tooling in a sysext which, at least to me, feels like square-peg/round-hole territory.

To get this working, a few things needed improvements.

Qemu

Qemu has a dbus display backend where it can send you DMABUF FD. But it doesn’t really handle any sort of sync and that becomes a problem as you crank up the frame rate. Additionally, it just defaulted to 75hz with no mechanism to override it.

So I have some patches which provide a new D-Bus interface which can be implemented by LibMKS. It provides something more like a Vulkan swap-chain as well as API to set the refresh rate. While this isn’t a mapping 1:1 of what a wayland protocol might do for frame rate, it does match more what the emulated graphics device expects, so it is probably fine for now and clearly an huge improvement.

A big change in the new API is that we will register all the DMABUF up front, and then tell the client just to switch to another DMABUF along with damage rectangles. Of course, I also had to make Qemu start collecting damage rectangles correctly.

• DMABUF3 Listener API for D-Bus
• Allow Clients to set Frame Rate

Linux

With those changes in place, I kept seeing damage being full-frame. The next part of the stack that can break is thus the Linux kernel virtio graphics driver. Damage rectangles come in as properties on the drm plane being submitted. So it turns out that in two places some short circuiting was preventing that from working right.

After fixing all that (and the corresponding LibMKS side) I have decent graphics performance in a VM.

Since I continue to be floating precariously abroad, this is my notice of such patches. If you are interested in seeing these upstream and work in either of those communities, feel free to crib them, improve them, and submit them upstream. I’m happy locally patching my software given the copious amount of free time I have so there is little incentive for me to collaborate with corporations.

• Virtio fix 1
• Virtio Fix 2

Combined with the LibMKS merge request !53 I can have both minimal damage rectangles all the way to host GPU scanout as well as drag windows around in the guest quite fast.

Google is giving publishers a new way to fight declining referral traffic from AI-powered search by letting them embed a "Preferred Sources" button that readers can use to favor their sites across Search, Discover, and Google News. "The idea is to make it easier for readers to find links from the sites they know and trust when they're searching for content or interacting with Google's AI to learn about a topic or read the latest news," reports TechCrunch. "As of May's launch, the company said that people across the web had already selected over 345,000 unique sources through this method." From the report: Becoming a preferred source can drive more traffic to publishers' websites, Google said. In earlier studies, it found that people are twice as likely to click through to a preferred source when available. By offering publishers these additional tools, Google is trying to assuage the damage that the rapid growth of AI-powered search features has had on traffic-dependent businesses. Alongside the new button, Google said that readers will soon be able to customize their Discover feed in Google's app in their own words. To use this feature, readers will tap any three-dot menu in the feed and then tell Google what topics they'd like to see more or less of, using natural language commands. This helps Google refine the feed in real time.

Read more of this story at Slashdot.

Version:next-20260821 (linux-next) Released:2026-08-21

Microsoft is expanding Windows Task Manager to show per-process NPU and GPU neural-engine usage, giving users more visibility into which apps are consuming hardware for AI workloads. The Register reports: The Processes tab can show NPU use alongside CPU and GPU activity, while the Performance tab displays overall utilization. [...] Microsoft was keen to point out the metrics that can be monitored. "As AI workloads become more common on Windows devices, visibility into NPU and GPU neural engine utilization can help you make better-informed decisions," the company said. "With the latest Task Manager improvements, you can monitor AI processing activity alongside CPU, memory, storage, and networking data from a familiar interface."

Read more of this story at Slashdot.

China's Chang'e 7 mission is set to launch for the moon's south pole, where it will attempt the first-ever landing directly at the pole and search the region's dark craters for water ice. "It's an amazing mission," says Norbert Schorghofer, a Hawaii-based senior scientist at the Planetary Science Institute. "There has never been a landed mission to find water [on the moon]." If successful, China "will be the leader in lunar science," Schorghofer adds. Scientific American reports: Chang'e 7, China's seventh moon mission, is scheduled to launch on a Long March 5 rocket from the coastal Wenchang Space Launch Site on the island of Hainan, with the launch window opening on the morning of August 24 local time (the evening of August 23 EDT). The mission includes an orbiter, as well as a lander, which totes a rover and a novel "hopping" robot. The spacecraft will take up to six days to reach lunar orbit, where it will then spend two months preparing for a November landing meant to be a near bull's-eye on the lunar south pole. The mission also includes equipment from several international partners, highlighting China's growing global influence -- both on and off Earth. The mission's lunar target is Shackleton Crater, a 21-kilometer-wide (13-mile-wide) pit with a rim that grazes the moon's south pole. No other spacecraft has ever landed so close. That proximity should allow Chang'e 7 to prospect for water ice trapped in smaller depressions near Shackleton that, because of the moon's tilt, never see sunlight and have temperatures just a few dozen degrees above absolute zero. "There are big reservoirs of ice water at the poles," says Simone Dell'Agnello, a physicist at Italy's National Institute for Nuclear Physics. No one knows, however, just how big those reservoirs are or what their actual distribution is across the lunar south pole's crater-pocked desolation. And because that ice might be used as for manufacturing rocket fuel or to make potable water for thirsty astronauts, answering those questions is key for the U.S.'s and China's competing plans to construct crewed lunar outposts.

Read more of this story at Slashdot.

RAMageddon could soon push car prices higher as modern vehicles rely on ever more RAM and powerful centralized computers to run everything from infotainment to driver-assistance systems. Analysts cited by The Atlantic estimate the shortage could add a few percentage points to vehicle prices, which might not sound like much, but could potentially translate to around $2,000 on a $50,000 vehicle. The broader shift toward software-heavy vehicles could also make used cars even less affordable. An anonymous reader quotes an excerpt from the report: Just like laptops, cars depend on microprocessors and RAM, or random-access memory, to run all of their computations. "There's just a baseline level of tech, and thus a baseline level of cost, required of every vehicle," Karl Brauer, the executive analyst at iSeeCars, an automotive-research platform, told me. Technology is a major reason the average price of a new car in the U.S. has reached some $50,000, and that was before RAM became one of the most prized commodities in the world. AI companies are snatching up as much memory as possible for their data centers, causing a RAM shortage that has significantly raised the prices of phones, laptops, and just about any consumer-electronic device. Cars are next. [...] Over the next year, the memory shortage -- sometimes known as RAMageddon -- will likely raise vehicle prices by a few percentage points, on average, [said Sam Abuelsamid, an analyst at Telemetry and a former automotive engineer]. The relative amount would be smaller than the shocking double-digit jumps for gaming consoles and MacBooks but in some ways more significant: A 4 percent price hike for cars amounts to some $2,000 on average. Cars with those centralized computers will be affected the most, but no vehicle will be spared. "Even if you don't need the high-end chips, you're going to pay more even for the low-end chips just because of the supply constraint," Abuelsamid said. On a recent earnings call, Ford's chief financial officer said that the company had paid $1 billion in higher materials costs due to the memory shortage and inflation. GM and Volkswagen, too, have noted rising chip costs to investors. (Ford and GM did not respond to a request for comment. A spokesperson for Volkswagen told me that the company has "recognized an increased demand for memory chips, primarily driven by growing requirements in other industries," and that in recent years, Volkswagen has taken measures to "mitigate supply risks.") RAMageddon is poised to last for several years, but the consequences for car buyers may be permanent. Consider what happened during the pandemic, when supply-chain disruptions and rising demand for electronics produced a major chip shortage. Nearly every major car company had to slash production because they simply couldn't procure enough chips, and shifted their focus to selling higher-end and higher-profit vehicles. Potential customers already willing to spend six figures on a car are much less likely to care about a 5 or 10 percent price hike, [said Ivan Drury, the director of insights at Edmunds]. Even now, car companies are continuing to focus on selling more profitable models. Since the pandemic, the average price of a new vehicle has jumped $11,000. The AI-fueled chip crisis could play out more severely. The average price of a new car could, before long, jump to $60,000 and beyond. These rising costs are making cars even more similar to computers and all of the software they run: Perhaps in an effort to mitigate higher prices, some automakers are also introducing in-car advertisements and putting certain features, such as heated seats, behind a paywall. As cars have morphed into computers, the inevitable next step is for automakers to behave like modern tech companies.

Read more of this story at Slashdot.

Bilibili, often described as China's answer to YouTube, is relaunching its international app and preparing an English-language site as part of a broader push into the U.S., Europe, Japan, and other markets. The company is courting Western creators like MrBest, hiring community and moderation staff globally, and building tools for brand partnerships. Semafor reports: The revamped international app no longer requires identity verification -- meaning users can sign up without having to provide a passport or ID document, which were long required of overseas users on its main Chinese platform, according to what appears to be a newly created account on X marketing the platform to global creators. "Yes bilibili is going global," the account wrote, adding that content-wise, the US and Chinese sites will be the same. In a document recently shared in a Discord chat for Bilibili creators, the company pitched itself as a place for influencers to make money and connect with "Gen Z Coded, affluent and well-educated" users. A marketplace for international users to connect with brands for sponsored content is "in development," according to the presentation. The deck also showed creators how to post videos on its Chinese website, adding that an English version is "coming soon. We are working hard."

Read more of this story at Slashdot.

Injection vulnerabilities, like cross-site scripting (XSS) or command injection, occur when we fail to properly encode untrusted output when inserting it into a trusted context. Before injecting uncontrolled or untrusted data, it’s essential to encode, escape, or quote the data to prevent it from breaking out of its intended context.

Some security folks previously used to like to talk about “input sanitization.” In practice, input sanitization is hopeless. Instead, nowadays we do the opposite and think about “output encoding.” When you inject untrusted data into a new context, assume the data is always malicious, and encode, escape, or quote it to make it safe for use in that context. Let’s look at some examples.

Pango Markup Injection

Here’s a low-stakes example of Pango markup injection:

markup = g_strdup_printf ("<b>%s</b>, my_user_provided_data); gtk_label_set_markup (GTK_LABEL (label), markup);

The untrusted data is not escaped and may decide to inject its own Pango markup, or break out of any markup that you used yourself. For example, if the data is </b><span foreground="blue" size="x-large">Hello world!</span><b> then it can decide to be blue and extra large instead of the intended bold. That’s not especially serious and probably not likely to be a security issue, but surely it’s an unintended bug. If you’re injecting an uncontrolled string into a Pango markup context, like a GtkLabel, then use g_markup_escape_text() first. (Pango markup can do other interesting things like hide characters or capitalize them. I’m not sufficiently creative to claim that’s definitely a security problem, but perhaps attackers will be more clever than me.)

A real-world example: in this GNOME Shell issue report, the title of a desktop notification is able to use Pango markup to manipulate its own formatting. (At least, probably, because the issue report is unconfirmed. Looks plausible, though!)

Unix Shell Command Injection

Another good example is the Evince command injection vulnerability from a few months ago, where a malicious filesystem path is able to trick Evince/Atril/Xreader into executing arbitrary code. Evince expects the path of a file to open to be something like /home/foo/hello.pdf, but a malicious PDF instead provides the evil input --gtk-module=/home/foo/evil.so /home/foo/hello.pdf. If not quoted properly, we have a command injection vulnerability where --gtk-module is interpreted as a command line flag rather than as a path:

Incorrect: /usr/bin/evince --named-dest= --gtk-module=/home/foo/evil.so /home/foo/hello.pdf

Correct: /usr/bin/evince --named-dest=' --gtk-module=/home/foo/evil.so /home/foo/hello.pdf'

If you’re constructing a Unix command line, as in the Evince example above, then use g_shell_quote(). Failure to do so is ruinous. (But beware: this isn’t necessarily safe if you’re using an actual Unix shell.)

XSS for Desktop App Developers

With that primer out of the way, let’s consider what happens when you inject untrusted content into HTML (or CSS, or JavaScript).

I used to think XSS matters only for websites, and is surely not something that desktop app developers need to know about, right? Wrong, as I discovered five years ago when, to my surprise, Prakash (@1lastBr3ath) reported that websites could inject scripts into Epiphany’s new tab page (about:overview) via malicious page titles. This on its own is not especially serious, but it’s surely not supposed to be possible.

If your desktop app uses WebKitGTK or another web engine, you probably do need to think carefully about XSS. For example, before injecting untrusted data into HTML, we need to HTML-encode it, which Epiphany didn’t do anywhere. In the simplest case, that looks like this:

char * ephy_encode_for_html (const char *input) { GString *str = g_string_new (input); g_string_replace (str, "&", "&amp;", 0); g_string_replace (str, "<", "&lt;", 0); g_string_replace (str, ">", "&gt;", 0); g_string_replace (str, "\"", "&quot;", 0); g_string_replace (str, "'", "&#x27;", 0); g_string_replace (str, "/", "&#x2F;", 0); return g_string_free_and_steal (str); }

Simply replace the few dangerous characters with HTML entities, and you’re good to go. That doesn’t work for HTML attributes, though, where the rules are slightly different. And it definitely doesn’t work for CSS or JavaScript. Carefully review the OWASP Cross Site Scripting Preventing Cheat Sheet to understand what you can and cannot do.

Recent XSS Bugs in Epiphany

Anyway, back to the old about:overview bug report. Turns out, Epiphany had many similar vulnerabilities. I attempted to fix them all, but in fact, I had missed a spot. In this old commit, I recognized that a URL is untrusted data that must be encoded before I inject the URL into the error message. But I treated the error message of the GError returned by WebKit as if it’s trusted and does not need to be encoded. In fact, the error message itself may contain a URL! Oops. Fernando Munoz recently noticed and reported several example URLs that could inject content into Epiphany error pages. I’m unable to share my favorite example URL here on WordPress, because WordPress is sanitizing it (yes, that is indeed ironic, considering my above recommendation to not do that). But the result of the injection looks like this:

So an evil URL can mess up the Epiphany network error page. That’s not particularly serious, but Fernando found a second injection that is much worse, an XSS vulnerability in Epiphany’s autofill implementation. Here, selector is formed using an untrusted DOM element ID provided by the web page itself. Notice that no output encoding is performed before the untrusted value is injected into the JavaScript command:

page_id = webkit_web_view_get_page_id (WEBKIT_WEB_VIEW (view)); world_name = ephy_embed_shell_get_guid (ephy_embed_shell_get_default ()); script = g_strdup_printf ("EphyAutofill.fill(%lu, '%s', %i);", page_id, selector, fill_choice); webkit_web_view_evaluate_javascript (WEBKIT_WEB_VIEW (view), script, -1, world_name, NULL, view->cancellable, autofill_cb, NULL);

Because the untrusted data here is already used as a quoted data value, one of very few cases where it is safe to inject untrusted data into JavaScript, this would actually have been safe if only Epiphany had JavaScript-encoded the value first, following the OWASP rules for JavaScript encoding: “Encode all characters using the Unicode \uXXXX encoding format, where XXXX represents the hexadecimal Unicode code point. For example, A becomes \u0041. All alphanumeric characters (letters A to Z, a to z, and digits 0 to 9) remain unencoded.” But Epiphany did not do so. (I got confused by the OWASP rules and didn’t realize how easy it was to make this safe, so I fixed it in a more complicated way instead, by removing the need for injecting the form ID.)

So how bad is this mistake? In Fernando’s example, the ID of the evil form element is "a'); alert('XSS in private world'); var _=('", allowing the malicious website to run any script it wants. That might not seem so serious, because websites don’t need to exploit any vulnerabilities to execute JavaScript… right?

Script Worlds

Websites are only supposed to be able to execute JavaScript in the default script world. Think of a script world as basically just a big namespace for all of your JavaScript: the default world is what the website itself uses, but desktop applications can create their own private script worlds in order to run their own scripts. In a private script world, you can manipulate the page’s DOM as usual, but you have a separate environment for executing JavaScript code, so you don’t have to worry about name clashes or scripts conflicting with each other. Also, website scripts cannot access your scripts.

In practice, web browsers inject their own scripts into every web page in order to implement various browser features. Epiphany uses a script to find the best web app icon for a web page, for example. These scripts use a private script world that websites should never themselves have access to. But in this XSS attack on Epiphany’s form autofill implementation, the malicious website has managed to execute its script in the private script world. Now it can access whatever internal web browser features are available in that script world.

Unfortunately, there’s one more relevant Epiphany feature implemented using scripts: the password manager. Epiphany’s password manager is necessarily exposed to its private script world because Epiphany needs to execute JavaScript code in the web page in order to autofill passwords. Although there were no relevant bugs in Epiphany’s password autofill code (which is totally unrelated to its vulnerable generic form autofill feature), this did not matter: if an XSS bug in any Epiphany feature can be abused to execute code in Epiphany’s private script world, that code can access the password manager and exfiltrate all the user’s saved Epiphany passwords for every website. (At least, probably, because I have not set up an attack website to test this. But I don’t see why it wouldn’t work!) So that’s pretty serious.

Conclusion

I requested a CVE for the autofill vulnerability earlier today, but nowadays CVE requests usually take a couple of weeks, so I don’t have one yet. It is fixed in Epiphany 50.6 and 49.9. If you don’t have those versions yet, don’t panic. To be exploited, you have to manually trigger form autofill by right clicking on a form and then selecting either “Autofill Personal Fields” or “Fill This Field,” so that makes it much less scary. Even more fortunately, users probably won’t ever do that, because selecting either option always causes Epiphany to reject all further mouse input, becoming unusable. Nobody has reported this bug before, so it seems safe to conclude zero people are using Epiphany’s form autofill feature!

Update: I said it would take a couple of weeks, but a few hours later I received CVE-2026-77682. Red Hat has improved its response time!

A good ad blocker is one of those browser additions you stop noticing once it’s working. Pages settle down. Autoplay boxes disappear. News sites stop shifting under your cursor while three ad slots load. On a slower laptop, the difference can be surprisingly obvious. But “blocks ads” isn’t a useful buying criterion anymore. Plenty of extensions do that.

Linux security monitoring is useful only when it helps a team explain what happened. Collecting more events does not automatically provide better visibility, especially when nobody knows which records matter, how long they should be retained, or what the evidence can actually prove.

During a live academic-network deployment, the Linux traffic-sampling system cut the stream sent to the sensor by 78 to 84 percent. In a separate test, it preserved 99.6 percent of baseline Suricata alerts.

Linux kernel fuzzing service syzbot has reported an out-of-bounds array access in print_bpf_insn(), a routine used to turn BPF instructions into readable verifier output.

This week’s Linux security updates affect cloud hosts, public servers, and services used across entire networks. Ubuntu, Debian, and Rocky Linux released important kernel fixes, while Redis and SPIP updates address flaws that could put internet-facing systems at risk.

Independent music publisher Round Hill is suing Suno and Anthropic for allegedly using hundreds of copyrighted songs without permission to train their AI systems. The company says potential damages could exceed $1 billion, arguing there is "nothing fair" about building multibillion-dollar AI businesses on copyrighted material while rights holders receive nothing. From The Hollywood Reporter: Round Hill is a prominent music publisher whose copyrights include the Goo Goo Dolls' "Iris," Bonnie Tyler's "Total Eclipse of the Heart," the Kinks' "Lola" and Dio's "Holy Diver." The company provided a list of 500 songs that the defendants had infringed upon. Round Hill said in the suits that the company plans to "amend to list potentially ten thousand or more of their musical compositions," with those damages potentially exceeding $1 billion. "While in other cases for copyright infringement, Defendant has waxed poetic about the necessity of progress and AI's value to society, there is simply no reason -- other than rote expediency -- to have that progress come at the cost of copyrights holders," prominent music attorney Richard Busch, representing Round Hill, wrote in the suits. Round Hill further argued that the latter "'expediency' arguments completely falter" when taking into account Suno and Anthropic's significant cash valuations they've earned while "exploiting illicit copies of copyrighted works, including the Round Hill Works." "There is simply nothing fair about a company using theft to build for purely commercial purposes a multi-billion dollar business while those from which they steal receive nothing," Round Hill said. Suno also faces a lawsuit from Universal Music Group and Sony Music Group.

Read more of this story at Slashdot.