You most likely get paid in one of two ways: a salary (a fixed amount of compensation paid out in regular intervals) or hourly (a wage per hour). About 55.7% of all workers in this country are paid hourly, meaning they qualify for overtime pay if they work more than 40 hours per week (salaried employees are “exempt” from this rule and don’t get overtime pay if they work more hours).

Still, many folks prefer salaried positions, which are usually seen as more secure, and which usually come with more benefits and advancement opportunities. But there are legal limits when it comes to classifying employees: If you make less than $43,888 a year, you’re legally non-exempt according to the federal government and get overtime pay (this is going up to $58,656 starting January 1^st, 2025—note that states may have their own laws, so a little research is necessary here). For some companies, it makes more sense to re-classify their employees as non-exempt and pay them hourly than to give them a pay bump in order to keep them exempt.

Generally speaking, your employer can change how they pay you (and how much they pay you) any time they like, as long as they give you notice and aren’t being discriminatory about it. So if your boss tells you that starting next week you’re an hourly instead of a salaried employee, they’re probably allowed to do that. And while you have limited options in this scenario, there are a few things you can—and should—do.

Document everything

Keep a copy of the notice you received about the change, and record or take notes at every meeting or phone call you engage in discussing your new pay and benefits. If it all works out you might not need any of this, but if you enter a dispute over pay or begin to suspect you were singled out in retaliatory fashion for the change (e.g., no one else in your group was changed to hourly), you’re going to want a record of everything you were told.

Calculate the difference

Figure out if the switch to hourly work is a stealth pay cut. Will you still be working at least 40 hours a week? Will you actually work overtime? If you currently work 40 hours a week, you can divide your former annual salary by 2,080 (40 hours X 52 weeks) to see what your hourly rate was (e.g., if you made $60,000 a year and worked 40 hours a week, your hourly rate was 60,000/2080 = $28.85). If you worked 35 hours, divide by 1,820 (35 X 52).

If your new hourly rate is lower and there’s no overtime pay involved, you just received a pay cut, and you should ask your employer to raise it.

You also need to check your benefits. When an employee is switched to hourly pay, their employer can opt to keep them at the same level of benefits as before, but it’s worth making certain of this. If the change in status means you’re no longer eligible for employee health plans or retirement plans, or if your benefits options change drastically as a result of the change, you may have just lost a big chunk of your compensation even if your annual pay remains the same. Calculate how much your benefits package was worth before and compare it to your new situation. If you’ve lost out, see if you can go back to your previous package, or if you can be compensated for the loss.

Check overtime

On the other hand, if you’re a non-exempt employee now, you can work overtime—and if you do, your overall income might actually go up. If you routinely worked extra hours as a salaried employee, speak with your supervisor to find out if you’ll be expected/allowed to continue to do so. If your hourly rate matches what you were making while working as an exempt employee and your benefits are comparable, you basically just got a raise—assuming your overtime continues.

When to quit

If your new compensation represents a pay cut and/or a loss of benefits, you might consider quitting. While your employer can probably change your pay any time they want, they can’t do so retroactively, and they can’t force you to accept a new pay rate. Any work you’ve already done must be paid at your old rates. Quitting might be a good idea if you’re reasonably sure you can get a comparable job, because you can base your salary request on your previous salary and not your new, lower pay.

from LifeHacker https://ift.tt/FW2keI0

With its stylishly minimalist look and low-maintenance style, the Tenways CGO600 Pro is an e-bike you could fall in love with. It’s a city bike; the kind of bike you use—for popping down to the store or commuting to work at a non-profit—not the kind of bike that becomes your lifestyle. It's not for off-road adventure, but if you need to get from point A to point B, and you want to do it on a smooth-riding, stylish e-bike with as little maintenance as possible, the CGO600 Pro hits the bullseye. This thing is so practical it's downright sexy.

A quick look at the Tenways CGO600 Pro

Pros

• Low maintenance belt drive

• Solid handling

• Light weight

Cons

• Gears are actually good sometimes

Specs

• Classification: Class 1

• Price: $1,899

• Colors: Avocado Green, Sky Blue, Midnight Black, Pebble Grey

• Weight: 37 lbs. without battery

• Rider’s height: three frame sizes accommodate riders between 5’0-6’2″

• Motor: 350 Watt rear hub motor with 45 Nm of torque

• Battery range: Up to 53 miles

• Pedal assist: 3 levels, Torque Sensor

• Top assist speed: 20 mph

• Frame: 6061 aluminum frame

• Tires: CST 700x45C urban tires

• Brakes: Tektro dual-piston hydraulic disc brakes

• Drive: Gates carbon belt drive

E-biking, Northern European style

Credit: Stephen Johnson

From the look, to the ride, to the onboard computer, the CGO600 is all about simplicity and functionality. A crowd-funded product of the Netherlands, the CGO600 embodies the understated style of Dutch urban bicycles. It's not one of those e-bikes that looks or drives like a motorcycle. It's very much a bike both in looks and power. It's a class-1 e-bike, so there's no throttle, and the assist speed tops out at 20mph. The motor is very quiet and the removable battery is discretely tucked into the down tube, so it easily passes as a non-electric bike; you won't feel out-of-place on a mellow, mixed-use bike path. Subjectively, it's a pretty machine, in a low-key way: It has a classic bike look, with an aluminum frame that come in four matte finished colors and a dual LED headlight built in to the top tube to give it a little panache.

Riding the CGO600 Pro

Credit: Stephen Johnson

The CGO may be a simple bike, but Tenways has clearly paid attention to the small details that matter: The handgrips are comfy, the pedals are wide, the seat post and handlebars are easily adjustable so you can dial it in for yourself and/or lend it out to someone else. There's even a little bell attached to the handlebars. It's a single-speed bike, so there are no gears to worry about and/or adjust. There isn't even a chain—the CGO600 has a Gates Carbon belt drive instead, so it's grease-free and won't ruin you trousers. More importantly, Tenways says the belt is "maintenance-free for up to 18,600 miles." I didn't ride it that far, so I'll take their word for it.

The CGO600 is maneuverable and responsive. There's no suspension, but even on bumpy payment, the aluminum frame provides enough flexibility that your teeth won't be chattering.

It's light, too. At only 41 pounds, with battery, it's light enough that riding with no assist is a reasonable option; not an option I chose very often to be honest, because the assist is spot-on.

What's under the hood of a CGO600 Pro?

Credit: Stephen Johnson

The CGO 600's torque-sensing drive system transfers power from the rear hub drive smoothly and quietly, but the 350w motor is surprisingly peppy for being so unobtrusive. Pedaling up to 20 mph on flat ground is effortless and feels natural; there's no sudden surge of torque like you get with less-refined e-bikes, instead of feeling like a motor is pushing your bike, you feel like you have very strong legs. There are only three levels of assist, compared to the usual five that e-bikes offer, but I never felt like a power level was "missing."

The stated range per full battery is "up to 53 miles," but it depends on how much you pedal, assistance level, hills, your weight, and so many other factors; it's impossible to really estimate. That said, the light weight and torque-sensing configuration mean a battery charge lasts a long time, and while it never went 53 miles in my test rides, the battery life is good.

The assist takes you to 20mph, but I topped out at about 35mph on this bike, and at no point did the CGO600 feel wobbly or out-of-control. That 35mph was on a downhill, of course; pedaling up hills takes some effort. Smaller urban inclines are no problem, but larger hills will put you face-to-face with the problem of a single-speed: Bikes have gears for a reason, and a big hill will have you wishing you had a granny gear to switch to.

In keeping with its minimalist aesthetic, the CGO600's onboard OLED display is tiny. It shows how much battery power you have left, your speed, and which of the three levels of assist you're using in a bright, black and white rectangle that's not much larger than a watch face. If you want to get more tech-y with it, there's a companion app that tracks your rides. It also tracks your bike's location, so if someone makes off with it, you can steal it back.

Credit: Stephen Johnson

Bottom line: The CGO600 Pro is a solid, dialed-in bike

Tenway's CGO600 is refreshingly free of gimmicks. It's all about dialed-in simplicity that works perfectly. With its minimalist design, light weight, and quiet motor, the CGO600 Pro offers a smooth and enjoyable ride for short commutes (and rides to your friend Dave's house), and the belt drive and quality components means you'll spend less time repairing and more time riding.

from LifeHacker https://ift.tt/Ca0Kisn

By the time I’m done with fall cleanup and ready to put my tools away for the winter, I’m exhausted. The idea of spending time cleaning those tools feels like an insult, but I do it anyway. You might be tempted to just deal with maintenance in the spring, but by then, the damage may be irreparable. Spend the time now, and springtime will be far more enjoyable when your tools emerge from the shed ready to go. 

Manual tools should be clean and dry

The plethora of hand tools—spades, shovels, rakes, weeding tools and anything else with a handle—should be rinsed off until all the mud is gone, and then dried. Drying is particularly important since this is what will prevent rust. Rust is the enemy and tools stuck in winter lockup with mud on them will deteriorate faster. If there's already some rust, it’s worth using steel wool to remove it. I recommend a steel wool attachment for your power drill. This makes fast work of the problem, and without dirtying your hands.

Examine the wood handles, too. If they’re particularly rough, you might consider taking some sandpaper to them, but usually I find time smooths the wood, not the opposite. The wood should be cleaned and given a quick wipe-down with some wood oil, like linseed. If the wood handle is cracked, it should be replaced. 

If the tool in question requires sharpening, like an ax, address that now. Your local knife sharpener can sharpen your ax, but there are tools and tutorials for learning to do so yourself. Don’t underestimate the value of sharpening the tips of your spade, too. Doing so will make it slice through turf and dirt next spring. Your shears and loppers and other pruning tools should all get sharpened now, before they go into storage. 

To store these long-handled tools, the best solution is keeping them off the ground in a covered and secured area like a shed. Hanging racks make easy work of this. 

Repeat all these steps with your hand tools: the trowels, scoops, weeding tools, etc. Make sure the metal is clean and dry, the handles in good condition. These tools should be kept off the ground as well, I simply place them in a box for the winter. 

Don’t store your electric tools with batteries

Most people now have a collection of electric tools: power drills, hedge trimmers, chainsaws, blowers, and string trimmers. First, ensure all the tools are clean. Make sure there’s no grass or other organic debris on any of the tools. In the case of tools with many connecting parts, like string trimmers, take them apart and clean them—otherwise you’ll have a hell of a time replacing your string reel next spring. Empty the blower bag and make sure it’s dry so it doesn’t develop mold over the winter (I go to the trouble of washing and drying it). If the tool in question, such as a chainsaw, has any bar oil in it, drain it for winter so it doesn’t leak. Remove all the batteries from the tools and store them separately, off the chargers. These tools should also be stored off the ground; I use a collection of large utility hooks to do so. This works very well, but make sure they’re anchored well into studs. 

Gas tools require the most work

If you’re still hanging onto a gas mower, chainsaw, trimmer or blower, maybe the maintenance will cause you to consider changing over.

The game is the same: Clean everything. This means turning the lawnmower over and actually getting all the grass off. It will rust otherwise. Now is a fine time to sharpen the blade, too. Ensure your trimmer or blower is also clean, and then it's time to drain all the gas. You don’t want it to sit full over winter. As an alternative, you can add a fuel stabilizer, but I never risk it. Cover all your tools with their respective covers or a tarp, and place them in a dry, safe space in the shed or garage. 

Smart tools need a little care, too

On top of everything else, we now have smart tools in our yards, whether that’s birdhouses, weather stations or temperature sensors. You should check the product website for temperature tolerances of the device; if you think the weather will exceed the tolerance, bring it inside for winter. Otherwise, clean the solar panels for each, and ensure the screws or other attachments are tight enough to withstand strong winds.

from LifeHacker https://ift.tt/Xcb9uP1

Interesting research: “Hacking Back the AI-Hacker: Prompt Injection as a Defense Against LLM-driven Cyberattacks“:

Large language models (LLMs) are increasingly being harnessed to automate cyberattacks, making sophisticated exploits more accessible and scalable. In response, we propose a new defense strategy tailored to counter LLM-driven cyberattacks. We introduce Mantis, a defensive framework that exploits LLMs’ susceptibility to adversarial inputs to undermine malicious operations. Upon detecting an automated cyberattack, Mantis plants carefully crafted inputs into system responses, leading the attacker’s LLM to disrupt their own operations (passive defense) or even compromise the attacker’s machine (active defense). By deploying purposefully vulnerable decoy services to attract the attacker and using dynamic prompt injections for the attacker’s LLM, Mantis can autonomously hack back the attacker. In our experiments, Mantis consistently achieved over 95% effectiveness against automated LLM-driven attacks. To foster further research and collaboration, Mantis is available as an open-source tool: this https URL.

This isn’t the solution, of course. But this sort of thing could be part of a solution.

from Schneier on Security https://ift.tt/jT7HDEY

Malwarebytes announced the acquisition of AzireVPN, a renowned privacy-focused VPN provider.

Malwarebytes has long been a defender of user privacy through its portfolio of consumer solutions, including Malwarebytes Privacy VPN and its free ad and scam blocker web extension Malwarebytes Browser Guard. This acquisition further supports the company’s mission to reimagine consumer cybersecurity to protect devices and data, no matter where users are located, how they work and play, or the size of their wallet.

By integrating AzireVPN’s advanced VPN technologies and intellectual property into its platform, Malwarebytes will deliver increased flexibility and enhanced security for customers. AzireVPN developed Blind Operator, a unique privacy feature implemented to completely disable both remote and local access to its servers. This creates a barrier against unauthorized modifications and traffic interception, making it virtually impossible for anyone to modify or tap the traffic on its servers and share any information about a user.

“Malwarebytes is a fierce advocate for privacy, and this acquisition reinforces our dedication to driving innovation that protects a free and open internet,” said Marcin Kleczynski, CEO, Malwarebytes. “As threats to individuals’ digital autonomy and security grow, we plan to build on AzireVPN’s legacy to deliver cutting-edge solutions.”

Malwarebytes and AzireVPN share a vision of empowering users worldwide to combat censorship and safeguard digital freedom. Known for its robust security standards and privacy-first commitment, AzireVPN physically owns and controls its servers—a practice Malwarebytes is committed to continuing.

“Joining Malwarebytes marks an exciting new chapter for AzireVPN and our privacy-conscious user base,” said William Oling, Co-Founder, AzireVPN. “As pioneers in ultra-private VPN technology, we’ve always set the standard for security and anonymity. Now, with Malwarebytes we’re ready to redefine what it means to stay safe and private online for those who demand the very best in privacy protection.”

This acquisition marks another milestone for Malwarebytes. The company accelerated its growth over the past year, acquiring Cyrus, a disruptive innovator in online privacy solutions, and launching Identity Theft Protection and Personal Data Remover products.

It also enhanced its consumer security portfolio with an improved, integrated user experience from desktop to mobile and the introduction of Trusted Advisor with its easy-to-understand Protection Score. Additionally, it launched a free Digital Footprint scan to help users proactively think about security and their exposed personal data.

Terms of the transaction were not disclosed.

from Help Net Security https://ift.tt/HLjuT2z

Google has announced that, by the end of 2025, multi-factor authentication (MFA) – aka 2-step verification – will become mandatory for all Google Cloud accounts.

“Given the sensitive nature of cloud deployments — and with phishing and stolen credentials remaining a top attack vector observed by our Mandiant Threat Intelligence team — we believe it’s time to require [2-step verification] for all users of Google Cloud,” said Mayank Upadhyay, VP of Engineering and Distinguished Engineer, Google Cloud.

A rollout in three phases

Currently, Google Cloud Administrators can enforce MFA use for some or all of their users, as well as prevent them from using less secure MFA methods.

“For example, some users may only be allowed to use phishing-resistant security keys or passkeys, while others may be allowed to use any method except SMS-based MFA,” Google explained in a recent whitepaper.

“Administrators also have the option of enforcing MFA after a SAML sign-in, offering protection against the scenario where an Identity Provider has been compromised.”

The push to increase the security of all Google Cloud accounts starts this month, with “helpful reminders and information in the Google Cloud console, including resources to help raise awareness, plan your rollout, conduct testing, and smoothly enable MFA for your users.”

By early 2025, all new and existing Google Cloud users who sign in with a password will have to enroll in MFA. If they don’t do it, they won’t be able to access Google Cloud (cloud computing services), Google Firebase (mobile and web app development platform), gCloud (the Google Cloud command line interface) and other platforms.

And, finally, by the end of 2025, MFA will become manadatory for all users who federate authentication into Google Cloud. The will be able to enable MFA with their primary identity provider before accessing Google Cloud or add an extra layer of MFA through their Google account.

The importance of MFA

Hardware-based (i.e., physical) security keys and passkeys are the most secure option for MFA as the authentication factor can’t be phished. Biometrics and time-based one-time passwords or push notifications delivered via authenticator apps are less secure options, but still more secure than static PINs (i.e., backup codes) and SMS-based MFA.

While adding a second authentication factor to one’s account is no universal remedy against account compromise, it makes things harder for attackers.

“The Cybersecurity and Infrastructure Security Agency (CISA) found that MFA makes users 99% less likely to be hacked, a powerful reason to make the switch,” Upadhyay pointed out.

The other big cloud providers – Amazon (AWS) and Microsoft (Azure) – have also started the push towards mandatory MFA for cloud accounts.

from Help Net Security https://ift.tt/9cFsMeG

Atakama announced the latest expansion of its Managed Browser Security Platform, introducing DNS filtering explicitly designed for Managed Service Providers (MSPs).

This new feature enables comprehensive in-browser and network-level filtering, providing a full-spectrum DNS solution that secures browsers and entire network environments.

Atakama’s Managed Browser Security Platform transforms the browser into a secure foundation, empowering MSPs with enhanced visibility and control over client web activity. The platform now includes advanced capabilities such as category-based filtering and DNS over HTTPS (DoH), enabling precise security customization and protection against sophisticated threats.

Atakama’s DNS solution defends against DNS cache poisoning (spoofing), DNS tunneling, and a range of web-based threats.

“Since its initial release, Atakama’s Managed Browser Security Platform has empowered MSPs to block phishing, malware, and other browser-related risks,” said Daniel H. Gallancy, CEO of Atakama.

“We heard our Partners loud and clear, and decided to go system-wide with our advanced DNS feature. With our new custom DNS functionality, we extend our protection beyond the browser, securing entire endpoints and networks. Our mission is to provide MSPs with effective, efficient security tools that protect clients without impacting productivity,” added Gallancy.

Atakama’s latest updates reflect its commitment to innovation and robust security, equipping MSPs with essential resources to safeguard clients in an increasingly complex digital landscape.

from Help Net Security https://ift.tt/3FMELKZ