Kategorie

Security vulnerabilities uncovered in cloud-based pinyin keyboard apps could be exploited to reveal users' keystrokes to nefarious actors. The findings come from the Citizen Lab, which discovered weaknesses in eight of nine apps from vendors like Baidu, Honor, iFlytek, OPPO, Samsung, Tencent, Vivo, and Xiaomi. The only vendor whose keyboard app did not have any security

Security vulnerabilities uncovered in cloud-based pinyin keyboard apps could be exploited to reveal users' keystrokes to nefarious actors. The findings come from the Citizen Lab, which discovered weaknesses in eight of nine apps from vendors like Baidu, Honor, iFlytek, OPPO, Samsung, Tencent, Vivo, and Xiaomi. The only vendor whose keyboard app did not have any security Newsroomhttp://www.blogger.com/profile/[email protected]

Compliance requirements are meant to increase cybersecurity transparency and accountability. As cyber threats increase, so do the number of compliance frameworks and the specificity of the security controls, policies, and activities they include. For CISOs and their teams, that means compliance is a time-consuming, high-stakes process that demands strong organizational and

Compliance requirements are meant to increase cybersecurity transparency and accountability. As cyber threats increase, so do the number of compliance frameworks and the specificity of the security controls, policies, and activities they include. For CISOs and their teams, that means compliance is a time-consuming, high-stakes process that demands strong organizational and The Hacker Newshttp://www.blogger.com/profile/[email protected]

A new malware campaign has been exploiting the updating mechanism of the eScan antivirus software to distribute backdoors and cryptocurrency miners like XMRig through a long-standing threat codenamed GuptiMiner targeting large corporate networks. Cybersecurity firm Avast said the activity is the work of a threat actor with possible connections to a North Korean hacking group dubbed 

A new malware campaign has been exploiting the updating mechanism of the eScan antivirus software to distribute backdoors and cryptocurrency miners like XMRig through a long-standing threat codenamed GuptiMiner targeting large corporate networks. Cybersecurity firm Avast said the activity is the work of a threat actor with possible connections to a North Korean hacking group dubbed Newsroomhttp://www.blogger.com/profile/[email protected]

A new ongoing malware campaign has been observed distributing three different stealers, such as CryptBot, LummaC2, and Rhadamanthys hosted on Content Delivery Network (CDN) cache domains since at least February 2024. Cisco Talos has attributed the activity with moderate confidence to a threat actor tracked as CoralRaider, a suspected Vietnamese-origin

A new ongoing malware campaign has been observed distributing three different stealers, such as CryptBot, LummaC2, and Rhadamanthys hosted on Content Delivery Network (CDN) cache domains since at least February 2024. Cisco Talos has attributed the activity with moderate confidence to a threat actor tracked as CoralRaider, a suspected Vietnamese-origin Newsroomhttp://www.blogger.com/profile/[email protected]

What is iCloud Drive?

In the simplest terms, iCloud Drive is Apple’s cross-platform cloud storage system that allows users to sync and store files, photos, videos, calendar events, contacts and other important data. iCloud Drive has been around since 2014, and while the platform is much more robust that it was in the early days, sometimes devices that rely on it don’t sync properly.

What is iCloud sync?

iCloud sync allows all of your devices to access the same updated data (or photos, videos, contacts, etc.), regardless of device. It’s usually reliable, but sometimes you’ll find content fails to sync between devices in the few seconds it should take. If this seems to be happening to you, these simple tricks can help get things running smoothly again.

Is iCloud sync on by default?

Yes, iCloud should be syncing your data automatically. But if there are some things you don’t want synced across devices, you can specify what gets shared via iCloud in System Settings (macOS) and Settings (iOS). You can even turn it off completely if for some reason you don’t want your data to sync.

Is everything up-to-date?

First, check to make sure you are running the latest version of macOS on your Mac, iOS on your iPad or iPhone, or Windows on a PC.

Check that iCloud is working

It also makes sense to double-check that iCloud services are working correctly before running through any other changes. You can visit Apple’s System Status page to make sure things are indeed up and running.

One of the first things to do is check Apple’s system status page for any outages.

Make sure you are properly logged in

Step two is to ensure you are logged into iCloud using the same Apple ID on all your devices. Go to icloud.com, login with your Apple ID and then tap iCloud Settings (either the gear-shaped box icon or by selecting it in the drop-down menu underneath your name at the top right of the iCloud browser window).

In the next window, you should see your storage space status and a row called My Devices. Are all the devices you want to sync included on the list? If not, it is possible they are not using the same Apple ID. (You can do quite a lot of useful things through iCloud’s online service).

Check dates and time

Next, check all the devices that should be syncing. You must ensure these are configured to set time and date automatically and have iCloud Drive/Documents & Data enabled. Follow these steps:

iOS: Settings>Apple ID>iCloud>iCloud Drive. Toggle to On

Mac: System Preferences>iCloud>ensure all the iCloud services you want to sync are checked.

Make sure iCloud is enabled for specific apps

If you have a particularly balky app that isn’t syncing as it should, you’ll want to check System Settings (in macOS) or Settings (in iOS). Click on your Apple ID account, scroll down to iCloud, and check there to see which apps are using iCloud. If your iCloud access for the app isn’t on, you’ll want to enable it. If it’s there, toggle iCloud access off, then on again to (hopefully) get things in sync again.

Check that cellular access is enabled

If everything is syncing okay while you’re using Wi-Fi networks, but you run into problems while on a cellular network, you’ll want to make sure cellular access is turned on. You can check this in Settings (in iOS); scroll down to Cellular and check to make sure it’s enabled for the apps you use. Also, scroll all the way down to make sure iCloud Drive is enabled over cellular.

Force Sync

Once you know your system(s) are set up correctly, you can use this simple trick to force iCloud Contacts and Calendars to sync:

To refresh your iCloud Calendars, launch the app on your iOS device and tap the “Calendars” button at the bottom of the page. When you get to the next page just tap and hold your finger on the screen and drag the list down until the activity icon appears and release the page. The activity icon will spin briefly, and you should find iCloud has synced your calendars for you.

This also works with Contacts. Launch the app and select “Groups” on the All Contacts page. Once you are in Groups, just tap and hold your finger and drag the page down as you did for Calendars. The activity icon will appear, and your Contacts will be synced.

Log out of iCloud and log in again

If you regularly experience sync problems with your iOS device(s) and you know your network is stable, then you should try logging out of your iCloud account on your iOS device or Mac, then log back in.

IMPORTANT: Before doing this, be certain to follow Apple’s extensive instructions to back up your iCloud data.

Sometimes, logging out of iCloud and then logging back in will clear up syncing problems.

Jonny Evans

At icloud.com you can see all of your devices in one place.

To log out, go to iCloud Settings/System Preferences and click Sign Out. You’ll have to respond to a series of prompts before this completes.

Restart your device, return to iCloud’s controls and sign back in. (Please make certain to use the same email address for your Apple ID across all your systems.)

Now you should re-enable all the iCloud features you want to use.

This process usually solves any sync problems you may have, though you may find it necessary to repeat this sequence on all your devices.

Restart your device(s)

If problems persist then close and restart the relevant iCloud-enabled app: Contacts or Calendar, for example. Double-click the Home button (or swipe up to about halfway up the screen and hold for a second or so on iPhone X), swipe through your active apps and swipe up to close the app. (You can long press the app icon and then tap the X that appears on iPhone X.) Return to the Home screen and wait a few moments before launching the app again.

Another approach that sometimes works is to turn off iCloud Contacts and turn it on again. Go to Settings>Apple ID>iCloud, then turn off Contacts.  Unless you have a copy of your contacts stored elsewhere, you should then choose Keep on My iPhone/iPad.

Wait a few moments and turn Contacts on again in Settings.

Reset your device(s)

Never underestimate the power of a hard reset to resolve many iOS problems. To achieve a hard reset on iOS devices simply hold down the Power and Home buttons until the device turns off and the Apple logo appears. The device will restart and system processes will be refreshed, which sometimes fixes iCloud sync problems.

Google+? If you use social media and happen to be a Google+ user, why not join AppleHolic’s Kool Aid Corner community and join the conversation as we pursue the spirit of the New Model Apple?

Got a story? Drop me a line via Twitter or in comments below and let me know. I’d like it if you chose to follow me on Twitter so I can let you know when fresh items are published here first on Computerworld.

Apple, Cloud Storage, iCloud

Toxic work environments and a lack of internal upward mobility are adding to employee dissatisfaction, and many workers believe a primary cause of the problem stems from the behavior of their managers, according to a new study by career development and outplacement firm Intoo.

The survey, conducted in partnership with research firm Workplace Intelligence, also found Gen Z employees are engaging more in “AI Career Coaching” and claim to get their best career advice from ChatGPT. Around 47% of Gen Zers say they get better advice from a chatbot than from their manager. More broadly, 77% of employees and 79% of human resource leaders said they’d experienced at least one characteristic of a toxic workplace in their jobs.

Lydia Frank, vice president of marketing at Chronus, a career development platform, said because Gen Zers were the first generation to grow up with the internet as a part of daily life, they’are accustomed to everything being a click away. “Which is why we’ve seen them heavily adopt and make use of generative AI for everything and anything. Career advice is no exception,” she said.

“Often, Gen Zers are turning to ChatGPT for career advice because they are not satisfied with their current company’s learning and development programs or lack the professional networks earlier generations were able to build when hybrid workplaces were the exception, not the rule,” she said. “We’re seeing a lot of Gen Zers that lack mentorship — especially when working remotely — which is why they’re either trying to learn a new skill or navigate a workplace situation through consulting ChatGPT,” Frank said.

Poor treatment at work and a lack of career advancement have also led to a growing number of workers to actively seeking employment elsewhere, according to the Intoo survey of 800 employees and 800 human resource leaders. The survey data, collected between Nov. 19 and Dec. 2, 2023, was originally published in February, then updated and re-released Tuesday. 

The survey focused on what makes a workplace toxic and what would create a positive work environment that leads to greater job satisfaction, better performance, and higher retention.

The top factor contributing to toxic workplaces is managers showing favoritism towards certain employees, according to 46% of employees surveyed by Intoo and Workplace Intelligence. And 42% cited managers or leaders who ignore employee feedback as contributing to poor work environments.

Adding to the problem: bad advice from managers, according to the survey data. More than a third (39%) of workers said they’d received bad career advice from managers. In fact, employees said they get better career advice from their friends and family (62%), Google (44%), social media (36%), and genAI (34% overall) than they get from their boss.

According to Intoo’s survey, 63% of respondents felt their employer cares more about productivity than career development, and 54% said they feel completely on their own at their organization when it comes to career development. Forty-four percent said their employer does not value their career development.

In tandem with those sentiments, HR leaders in the survey predict that 25% of employees (and 44% of Gen Z employees) are likely to quit their jobs within the next six months due to a lack of support for career development.

Career path confusion

A separate workplace study done by recruitment and outplacement firm LHH found that nearly half of 30,000 full-time employees in 27 countries (46%) want to change careers — but don’t know which path to take. And 72% of workers contemplate future plans — such as their next job, reskilling, and upskilling — at least once a quarter.

A majority of workers (86%) are confident that they could find a new job within six months up, from 61% in 2022, whether it’s through their own networks (74%), independent job search (71%), or a staffing agency (68%), according to the LHH survey. But nearly half (46%) don’t feel their managers would support them in moving to another role within the organization.

Additionally, 47% are keeping up to date with open job opportunities, yet not applying for them, according to LHH data. However, another 18% are actively applying for jobs and 19% indicated they’re interviewing with prospective employers. Only 8% are looking for new opportunities internal to their company.

Among other big takeaway from LHH’s report? Organizations need to invest in their employees in order to attract skilled talent, especially from tech. “Workers in tech are the most confident that their skills can transfer to another industry or to another role within the tech field,” the report said.

The broader sense of unease is shared across geographies and industries, especially in Australia (65%), China (62%), Turkey (59%), and the US (57%), where workers feel strongest that external factors affect their careers more than they do themselves. In these countries, employees are less likely to quit for salary reasons than because they want to start their own businesses, showing they want to feel empowered.

Many younger employees make career decisions based on their values and want to be able to drive change within their organizations, but feel powerless to do that, according to a recent survey by Deloitte. Over half of respondents (58% of Gen Zs and 55% of millennials) say their organization currently seeks input from employees and incorporates their feedback, but roughly a third (32% of Gen Zs and 35% of millennials) say decisions are still made from the top and employee feedback is not often acted upon.

Careers, IT Leadership, Technology Industry

Posted by Yoshi Yamaguchi, Santiago Díaz, Maud Nalpas, Eiji Kitamura, DevRel team

The Reporting API is an emerging web standard that provides a generic reporting mechanism for issues occurring on the browsers visiting your production website. The reports you receive detail issues such as security violations or soon-to-be-deprecated APIs, from users’ browsers from all over the world.

Collecting reports is often as simple as specifying an endpoint URL in the HTTP header; the browser will automatically start forwarding reports covering the issues you are interested in to those endpoints. However, processing and analyzing these reports is not that simple. For example, you may receive a massive number of reports on your endpoint, and it is possible that not all of them will be helpful in identifying the underlying problem. In such circumstances, distilling and fixing issues can be quite a challenge.

In this blog post, we'll share how the Google security team uses the Reporting API to detect potential issues and identify the actual problems causing them. We'll also introduce an open source solution, so you can easily replicate Google's approach to processing reports and acting on them.

How does the Reporting API work?

Some errors only occur in production, on users’ browsers to which you have no access. You won't see these errors locally or during development because there could be unexpected conditions real users, real networks, and real devices are in. With the Reporting API, you directly leverage the browser to monitor these errors: the browser catches these errors for you, generates an error report, and sends this report to an endpoint you've specified.

How reports are generated and sent.

Errors you can monitor with the Reporting API include:

• Security violations: Content-Security-Policy (CSP), Cross-Origin-Opener-Policy (COOP), Cross-Origin-Embedder-Policy (COEP)
• Deprecated and soon-to-be-deprecated API calls
• Browser interventions
• Permissions policy
• And more

For a full list of error types you can monitor, see use cases and report types.

The Reporting API is activated and configured using HTTP response headers: you need to declare the endpoint(s) you want the browser to send reports to, and which error types you want to monitor. The browser then sends reports to your endpoint in POST requests whose payload is a list of reports.

Example setup:

#  Example setup to receive CSP violations reports, Document-Policy violations reports, and Deprecation reports  

Reporting-Endpoints: main-endpoint="https://reports.example/main", default="https://reports.example/default"

# CSP violations and Document-Policy violations will be sent to `main-endpoint`

Content-Security-Policy: script-src 'self'; object-src 'none'; report-to main-endpoint;

Document-Policy: document-write=?0; report-to=main-endpoint;

# Deprecation reports are generated automatically and don't need an explicit endpoint; they're always sent to the `default` endpoint

Note: Some policies support "report-only" mode. This means the policy sends a report, but doesn't actually enforce the restriction. This can help you gauge if the policy is working effectively.

Chrome users whose browsers generate reports can see them in DevTools in the Application panel:

Example of viewing reports in the Application panel of DevTools.

You can generate various violations and see how they are received on a server in the reporting endpoint demo:

Example violation reports

The Reporting API is supported by Chrome, and partially by Safari as of March 2024. For details, see the browser support table.

Google's approach

Google benefits from being able to uplift security at scale. Web platform mitigations like Content Security Policy, Trusted Types, Fetch Metadata, and the Cross-Origin Opener Policy help us engineer away entire classes of vulnerabilities across hundreds of Google products and thousands of individual services, as described in this blogpost.

One of the engineering challenges of deploying security policies at scale is identifying code locations that are incompatible with new restrictions and that would break if those restrictions were enforced. There is a common 4-step process to solve this problem:

1. Roll out policies in report-only mode (CSP report-only mode example). This instructs browsers to execute client-side code as usual, but gather information on any events where the policy would be violated if it were enforced. This information is packaged in violation reports that are sent to a reporting endpoint.
2. The violation reports must be triaged to link them to locations in code that are incompatible with the policy. For example, some code bases may be incompatible with security policies because they use a dangerous API or use patterns that mix user data and code.
3. The identified code locations are refactored to make them compatible, for example by using safe versions of dangerous APIs or changing the way user input is mixed with code. These refactorings uplift the security posture of the code base by helping reduce the usage of dangerous coding patterns.
4. When all code locations have been identified and refactored, the policy can be removed from report-only mode and fully enforced. Note that in a typical roll out, we iterate steps 1 through 3 to ensure that we have triaged all violation reports.

With the Reporting API, we have the ability to run this cycle using a unified reporting endpoint and a single schema for several security features. This allows us to gather reports for a variety of features across different browsers, code paths, and types of users in a centralized way.

Note: A violation report is generated when an entity is attempting an action that one of your policies forbids. For example, you've set CSP on one of your pages, but the page is trying to load a script that's not allowed by your CSP. Most reports generated via the Reporting API are violation reports, but not all — other types include deprecation reports and crash reports. For details, see Use cases and report types.

Unfortunately, it is common for noise to creep into streams of violation reports, which can make finding incompatible code locations difficult. For example, many browser extensions, malware, antivirus software, and devtools users inject third-party code into the DOM or use forbidden APIs. If the injected code is incompatible with the policy, this can lead to violation reports that cannot be linked to our code base and are therefore not actionable. This makes triaging reports difficult and makes it hard to be confident that all code locations have been addressed before enforcing new policies.

Over the years, Google has developed a number of techniques to collect, digest, and summarize violation reports into root causes. Here is a summary of the most useful techniques we believe developers can use to filter out noise in reported violations:

Focus on root causes

It is often the case that a piece of code that is incompatible with the policy executes several times throughout the lifetime of a browser tab. Each time this happens, a new violation report is created and queued to be sent to the reporting endpoint. This can quickly lead to a large volume of individual reports, many of which contain redundant information. Because of this, grouping violation reports into clusters enables developers to abstract away individual violations and think in terms of root causes. Root causes are simpler to understand and can speed up the process of identifying useful refactorings.

Let's take a look at an example to understand how violations may be grouped. For instance, a report-only CSP that forbids the use of inline JavaScript event handlers is deployed. Violation reports are created on every instance of those handlers and have the following fields set:

• The blockedURL field is set to inline, which describes the type of violation.
• The scriptSample field is set to the first few bytes of the contents of the event handler in the field.
• The documentURL field is set to the URL of the current browser tab.

Most of the time, these three fields uniquely identify the inline handlers in a given URL, even if the values of other fields differ. This is common when there are tokens, timestamps, or other random values across page loads. Depending on your application or framework, the values of these fields can differ in subtle ways, so being able to do fuzzy matches on reporting values can go a long way in grouping violations into actionable clusters. In some cases, we can group violations whose URL fields have known prefixes, for example all violations with URLs that start with chrome-extension, moz-extension, or safari-extension can be grouped together to set root causes in browser extensions aside from those in our codebase with a high degree of confidence.

Developing your own grouping strategies helps you stay focused on root causes and can significantly reduce the number of violation reports you need to triage. In general, it should always be possible to select fields that uniquely identify interesting types of violations and use those fields to prioritize the most important root causes.

Leverage ambient information

Another way of distinguishing non-actionable from actionable violation reports is ambient information. This is data that is contained in requests to our reporting endpoint, but that is not included in the violation reports themselves. Ambient information can hint at sources of noise in a client's set up that can help with triage:

• User Agent or User Agent client hints: User agents are a great tell-tale sign of non-actionable violations. For example, crawlers, bots, and some mobile applications use custom user agents whose behavior differs from well-supported browser engines and that can trigger unique violations. In other cases, some violations may only trigger in a specific browser or be caused by changes in nightly builds or newer versions of browsers. Without user agent information, these violations would be significantly more difficult to investigate.
  
• Trusted users: Browsers will attach any available cookies to requests made to a reporting endpoint by the Reporting API, if the endpoint is same-site with the document where the violation occurs. Capturing cookies is useful for identifying the type of user that caused a violation. Often, the most actionable violations come from trusted users that are not likely to have invasive extensions or malware, like company employees or website administrators. If you are not able to capture authentication information through your reporting endpoint, consider rolling out report-only policies to trusted users first. Doing so allows you to build a baseline of actionable violations before rolling out your policies to the general public.
  
• Number of unique users: As a general principle, users of typical features or code paths should generate roughly the same violations. This allows us to flag violations seen by a small number of users as potentially suspicious, since they suggest that a user's particular setup might be at fault, rather than our application code. One way of 'counting users' is to keep note of the number of unique IP addresses that reported a violation. Approximate counting algorithms are simple to use and can help gather this information without tracking specific IP addresses. For example, the HyperLogLog algorithm requires just a few bytes to approximate the number of unique elements in a set with a high degree of confidence.

Map violations to source code (advanced)

Some types of violations have a source_file field or equivalent. This field represents the JavaScript file that triggered the violation and is usually accompanied by a line and column number. These three bits of data are a high-quality signal that can point directly to lines of code that need to be refactored.

Nevertheless, it is often the case that source files fetched by browsers are compiled or minimized and don't map directly to your code base. In this case, we recommend you use JavaScript source maps to map line and column numbers between deployed and authored files. This allows you to translate directly from violation reports to lines of source code, yielding highly actionable report groups and root causes.

Establish your own solution

The Reporting API sends browser-side events, such as security violations, deprecated API calls, and browser interventions, to the specified endpoint on a per-event basis. However, as explained in the previous section, to distill the real issues out of those reports, you need a data processing system on your end.

Fortunately, there are plenty of options in the industry to set up the required architecture, including open source products. The fundamental pieces of the required system are the following:

• API endpoint: A web server that accepts HTTP requests and handles reports in a JSON format
• Storage: A storage server that stores received reports and reports processed by the pipeline
• Data pipeline: A pipeline that filters out noise and extracts and aggregates required metadata into constellations
• Data visualizer: A tool that provides insights on the processed reports

Solutions for each of the components listed above are made available by public cloud platforms, SaaS services, and as open source software. See the Alternative solutions section for details, and the following section outlining a sample application.

Sample application: Reporting API Processor

To help you understand how to receive reports from browsers and how to handle these received reports, we created a small sample application that demonstrates the following processes that are required for distilling web application security issues from reports sent by browsers:

• Report ingestion to the storage
• Noise reduction and data aggregation
• Processed report data visualization

Although this sample is relying on Google Cloud, you can replace each of the components with your preferred technologies. An overview of the sample application is illustrated in the following diagram:

Components described as green boxes are components that you need to implement by yourself. Forwarder is a simple web server that receives reports in the JSON format and converts them to the schema for Bigtable. Beam-collector is a simple Apache Beam pipeline that filters noisy reports, aggregates relevant reports into the shape of constellations, and saves them as CSV files. These two components are the key parts to make better use of reports from the Reporting API.

Try it yourself

Because this is a runnable sample application, you are able to deploy all components to a Google Cloud project and see how it works by yourself. The detailed prerequisites and the instructions to set up the sample system are documented in the README.md file.

Alternative solutions

Aside from the open source solution we shared, there are a number of tools available to assist in your usage of the Reporting API. Some of them include:

• Report-collecting services like report-uri and uriports.
• Application error monitoring platforms like Sentry, Datadog, etc.

Besides pricing, consider the following points when selecting alternatives:

• Are you comfortable sharing any of your application's URLs with a third-party report collector? Even if the browser strips sensitive information from these URLs, sensitive information may get leaked this way. If this sounds too risky for your application, operate your own reporting endpoint.
• Does this collector support all report types you need? For example, not all reporting endpoint solutions support COOP/COEP violation reports.

Summary

In this article, we explained how web developers can collect client-side issues by using the Reporting API, and the challenges of distilling the real problems out of the collected reports. We also introduced how Google solves those challenges by filtering and processing reports, and shared an open source project that you can use to replicate a similar solution. We hope this information will motivate more developers to take advantage of the Reporting API and, in consequence, make their website more secure and sustainable.

Learning resources

• Monitor your web application with the Reporting API | Capabilities | Chrome for Developers
• A Recipe for Scaling Security – Google Bug Hunters

Researchers have identified a dependency confusion vulnerability impacting an archived Apache project called Cordova App Harness. Dependency confusion attacks take place owing to the fact that package managers check the public repositories before private registries, thus allowing a threat actor to publish a malicious package with the same name to a public package repository. This&

Researchers have identified a dependency confusion vulnerability impacting an archived Apache project called Cordova App Harness. Dependency confusion attacks take place owing to the fact that package managers check the public repositories before private registries, thus allowing a threat actor to publish a malicious package with the same name to a public package repository. This&Newsroomhttp://www.blogger.com/profile/[email protected]

At its Adobe Max event in London, Adobe on Tuesday unveiled its latest Firefly Image generative AI (genAI) model, promising greater realism and improved controls over generated outputs. The next-generation Firefly model will also be integrated into Photoshop, with several new features coming to the image editor later this year. 

Adobe Firefly is a set of generative AI models used to create and modify content such as photographic style images, illustrations, and fonts. (A Firefly video-generation model is coming to the Premier Pro video editing tool later this year, with a music-generation algorithm also in the works.) It’s accessible as a standalone app, as well as being integrated into Adobe’s Creative Cloud application suite. 

More than a year since launch, Firefly’s Image model is now on its third iteration. Firefly Image 3 improves on the second iteration, which launched at last October, in several ways, said Adobe. 

The company highlighted improvements to image quality, particularly for images that feature people. That means more photo-realistic outputs, better lighting and subject positioning, and a wider variety of expressions. Another quality improvement is involves rendering straight lines and structures that help with image coherence.

Adobe Firefly generated image of an artist in studio.

Adobe

The latest model includes the Structure Reference feature that Adobe announced last month; it lets users apply the structure of a reference image to provide more accurate outputs. The same goes for Style Reference, which helps create a consistent image style.

Users can also expect a broader range of output styles for illustrations, photographic art, and vector art for iconography. Firefly Image 3 will have a better understanding of user prompts, too, Adobe said, more accurately reflecting longer and more complex inputs than the previous versions.

“Firefly Image 3 is a considerable level up from the already high-performing Firefly Image 2 model,” said Matt Arcaro, IDC research director for computer vision and AI, with notable improvements to image quality and coherence with user prompts. 

Firefly Image 3 also gives users greater control over images produce by the AI model, said Liz Miller, vice president and principal analyst at Constellation Research. “If Firefly Image 1 and 2 focused on the ability to generate, Firefly Image 3 is about focusing and controlling generative AI models to extract the idea in a creator’s mind onto the initial canvas,” she said.

Adobe is one of numerous tech firms that offer genAI image models, including  Canva, Midjourney, OpenAI, Stability AI, and others. IDC predicts that global spending on genAI tools (including software and infrastructure) will reach $143 billion in 2027, up from $16 billion in 2023. 

“Firefly Image 3 may be in beta, but feels less experimental compared to some of Adobe’s rivals,” said Miller. The latest Firefly model is more photo realistic and addresses some of the problems creators have experienced with generative AI tools around structure, she said – producing images of arms with two hands, for instance. 

Firefly Image 3 is available now in beta via the Firefly web app.  

New Firefly features in Photoshop

Another strong point for Adobe’s generative AI capabilities is integration across its products, said Arcaro. “Adobe is all-in on bringing genAI capabilities to users across its product portfolio,” he said. 

Adobe said the Firefly Image model and new genAI features will arrive for Photoshop later this year, building on Generative Fill (the mostly quickly adopted feature in ever in Photoshop, according to Adobe) and the Generative Expand tools added to Photoshop a year ago.  

The idea is to improve workflow when accessing genAI features in Photoshop. 

For example, Reference Image lets users tailor Generative Fill images to a particular style by uploading a reference document. This lets users guide the Firefly’s outputs more accurately and saves time typing out text prompts to create a desired image. 

Adobe Firefly makes it easier to manipulate and use reference images with genAI.

Adobe

Another feature, Generate Image, lets users create entire images from scratch in Photoshop documents using text prompts. The intention is to make the image editor more accessible to users of any skill level, said Adobe. The Generate Image tool provides options for content type, effects, and allows users to upload a reference image. 

Generate Background makes it easier to replace or create background visuals in an image using natural language prompts. While it’s already possible to generate background images in Photoshop, the new feature is more streamlined and requires fewer clicks, Adobe said.

Generate Background allows users to create background visuals  using natural language prompts.

Adobe

Generate Similar provides variations of objects within an image from which users can select, such as the amount or type of fruit in a fruit bowl, allowing for greater fine tuning of results. 

Generate Similar using Firefly offers variations of objects within an image.

Adobe

Finally, Enhance Detail lets users increase the sharpness and clarity of generated images.

The features are available in the beta Photoshop app — a separate application that  showcases new capabilities — before general availabilty later this year, said Adobe. It will be possible to run the AI processing either on Adobe’s servers or locally on a user’s device, with cloud computation the default. 

“These tools are all about efficiency and shifting monotonous work off a creator’s plate,” said Miller. Getting from a brief to a sketch to a draft can be a painful, time-consuming, and costly process, she said.

“The traditional pace of creation takes a toll, especially when the language of creativity can get lost in translation…,” Miller said. “With these tools native in Photoshop, creators can ideate and iterate quickly, collaborating on color tones, shape and structure in a rapid flow.”

Adobe Systems, Generative AI, Productivity Software

In the high-stakes world of cybersecurity, the battleground has shifted. Supply chain attacks have emerged as a potent threat, exploiting the intricate web of interconnected systems and third-party dependencies to breach even the most formidable defenses. But what if you could turn the tables and proactively hunt these threats before they wreak havoc? We invite you to join us for an

In the high-stakes world of cybersecurity, the battleground has shifted. Supply chain attacks have emerged as a potent threat, exploiting the intricate web of interconnected systems and third-party dependencies to breach even the most formidable defenses. But what if you could turn the tables and proactively hunt these threats before they wreak havoc? We invite you to join us for an The Hacker Newshttp://www.blogger.com/profile/[email protected]

AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a reliable server operating system, it can also function effectively as a desktop OS. Security, stability, and long-term support are key advantages of choosing AlmaLinux 9.4 beta as your desktop OS.

European Police Chiefs said that the complementary partnership between law enforcement agencies and the technology industry is at risk due to end-to-end encryption (E2EE). They called on the industry and governments to take urgent action to ensure public safety across social media platforms. "Privacy measures currently being rolled out, such as end-to-end encryption, will stop tech companies

European Police Chiefs said that the complementary partnership between law enforcement agencies and the technology industry is at risk due to end-to-end encryption (E2EE). They called on the industry and governments to take urgent action to ensure public safety across social media platforms. "Privacy measures currently being rolled out, such as end-to-end encryption, will stop tech companies Newsroomhttp://www.blogger.com/profile/[email protected]

Cybersecurity breaches can be devastating for both individuals and businesses alike. While many people tend to focus on understanding how and why they were targeted by such breaches, there's a larger, more pressing question: What is the true financial impact of a cyberattack? According to research by Cybersecurity Ventures, the global cost of cybercrime is projected to reach