The Linkielist

Linking ideas with the world

The Linkielist

EU becomes a little more fascist and starts collecting fingerprints at the border

The new Entry/Exit System (EES) will start operations on 12 October 2025. European countries using the EES will introduce the system gradually at their external borders. This means that data collection will be gradually introduced at border crossing points with full implementation by 10 April 2026.

Source: What is the EES?

You need to provide your personal data each time you reach the external borders of the European countries using the EES. For more information – see What does progressive start of the EES mean? 
The EES collects, records and stores: 

  • data listed in your travel document(s) (e.g. full name, date of birth, etc.)
  • date and place of each entry and exit 
  • facial image and fingerprints (called ‘biometric data’)
  • whether you were refused entry.

On the basis of the collected biometric data, biometric templates will be created and stored in the shared Biometric Matching Service (see footnote).

If you hold a short-stay visa to enter the Schengen area, your fingerprints will already be stored in the Visa Information System (VIS) and will not be stored again in the EES.

Depending on your particular situation, the system also collects your personal information from:

[…]

If you refuse to provide your biometric data, you will be denied entry into the territory of the European countries using the EES.

Who can access your personal data?

  • Border, visa and immigration authorities in the European countries using the EES for the purpose of verifying your identity and understanding whether you should be allowed to enter or stay on the territory.
  • Law enforcement authorities of the countries using the EES and Europol for law enforcement purposes. 
  • Under strict conditions, your data may be transferred to another country (inside or outside the EU) or international organisation (listed in Annex I of Regulation (EU) 2017/2226 – a UN organisation, the International Organisation for Migration, or the International Committee of the Red Cross) for return (Article 41(1) and (2), and Article 42) and/or law enforcement purposes (Article 41(6)).
  • Transport carriers will only be able to verify whether short-stay visa holders have already used the number of entries authorised by their visa and will not be able to access any further personal data.

[…]

Your data cannot be transferred to third parties – whether public or private entities – except in certain cases. See Who can access your personal data

[…]

So lots of data collected, and loads of people who can access this data – exceptions are absolutely everywhere. And for what? To satisfy far right fantasies about migration running rampant.

EU Data Act – get hold of your own data, but govt gets it too?

[…] The Regulation on harmonised rules on fair access to and use of data — also known as the Data Actentered into force on 11 January 2024 and into application on 12 September 2025. The Act is a key pillar of the European data strategy and it will make a significant contribution to the Digital Decade‘s objective of advancing digital transformation. The Data Act explained provides more in depth explanations.

The Data Act is designed to empower users — both consumers and businesses — by giving them greater control over the data generated by their connected devices, such as cars, smart TVs, and industrial machinery.

[…]

he new rules aim to facilitate the seamless transfer of valuable data between data holders and data users while upholding its confidentiality. This will encourage more actors, regardless of their size, to participate in the data economy. The Commission will also develop model contract clauses in order to help market participants draft and negotiate fair data-sharing contracts.

[…]

Public sector access and use of data

Rules enabling public sector bodies to access and use data held by the private sector for specific public interest purposes. For instance, public sector bodies will be able to request data necessary to help them respond quickly and securely to a public emergency, with minimal burden on businesses.

[…]

New rules setting the framework for customers to effectively switch between different providers of data-processing services to unlock the EU cloud market. This will also contribute to an overall framework for efficient data interoperability.

[…]

Users of connected products may choose to share this data with third parties. This will enable aftermarket (e.g. repair) service providers to enhance and innovate their services, fostering fair competition with similar services provided by manufacturers.

[…]

Source: Data Act | Shaping Europe’s digital future

Following the general provisions (Chapter I) which set out the scope of the regulation and define key terms, the Data Act is structured into six main chapters:

Chapter II on business-to-business and business-to-consumer data sharing in the context of IoT: users of IoT objects can access, use and port data that they co-generate through their use of a connected product.

Chapter III on business-to-business data sharing: this clarifies the data-sharing conditions wherever a business is obliged by law, including through the Data Act, to share data with another business.

Chapter IV on unfair contractual terms: these provisions protect all businesses, in particular SMEs, against unfair contractual terms imposed on them.

Chapter V on business-to-government data sharing: public sector bodies will be able to make more evidence-based decisions in certain situations of exceptional need through measures to access certain data held by the private sector.

Chapter VI on switching between data processing services: providers of cloud and edge computing services must meet minimum requirements to facilitate interoperability and enable switching.

Chapter VII on unlawful third country government access to data: non-personal data stored in the EU is protected against unlawful foreign government access requests.

Chapter VIII on interoperability: participants in data spaces must fulfil criteria to allow data to flow within and between data spaces. An EU repository will lay down relevant standards and specifications for cloud interoperability.

Chapter IX on enforcement: Member States must designate one or more competent authority(ies) to monitor and enforce the Data Act. Where more than one authority is designated, a ‘data coordinator’ must be appointed to act as the single point of contact at the national level.

[…]

Chapter V of the Data Act on business-to-government data sharing differentiates between two scenarios:

  • In order to respond to a public emergency, a public sector body should request non-personal data. However, if this is insufficient to respond to the situation, personal data may be requested. Where possible, this data should be anonymised by the data holder.    

  • In non-emergency situations, public sector bodies may only request non-personal data.

[…]

The Data Act will also entirely remove switching charges, including charges for data egress (i.e. charges for data transit), from 12 January 2027. This means that providers won’t be able to charge their customers for the operations that are necessary to facilitate switching or for data egress. However, as a transitional measure during the first 3 years after the Data Act’s entry into force (from 11 January 2024 to 12 January 2027), providers may still charge their customers for the costs incurred in relation to switching and data egress.

Source: Data Act explained

This is all great stuff, but the wording where public sector bodies can request personal data for unexplained emergencies (so… does a peaceful protest constitute an emergency, for example?) is pretty scary. Especially within the context of Chat Control Blanket Surveillance that the Danish presidency is keen to push through.

LaLiga’s Anti-Piracy Tactics Disrupt Major Sites in Spain. Again. Allowing company dragnets with no recourse, warning or anything is insanely stupid.

LaLiga, Spain’s top football league, is facing a firestorm of criticism after boasting about a staggering 142% increase in anti-piracy takedown notices in early 2025 while simultaneously causing extensive collateral damage across the internet.

As the 2025/2026 season began on August 15, LaLiga ramped up its enforcement strategy, triggering widespread outages for entirely lawful websites, services, and platforms.

These disruptions are tied to a controversial anti-piracy scheme operated in partnership with telecom giant Telefónica.

The initiative, which enjoys judicial backing in Spain, allows LaLiga to instruct major internet service providers, including Movistar, Vodafone, Orange, and DIGI, to block IP addresses suspected of hosting unauthorized streams.

The fallout is that entire chunks of the internet go dark for Spanish users, often during match broadcasts.

LaLiga doesn’t target specific infringing content. Instead, it flags entire IP ranges, many of which are shared by thousands of unrelated domains.

When one site is accused of hosting pirated material, everyone else sharing that IP address gets swept up in the block.

The result is a digital dragnet that has ensnared companies as diverse as Amazon, Cloudflare, GitHub, Twitch, and even Google Fonts.

TorrentFreak has documented repeated weekly blocks of platforms like Vercel since early 2025, while Catalonia’s own .cat domain registry has also reported service disruptions.

The issue became so disruptive that iXsystems, the team behind TrueNAS, a widely used open-source NAS operating system, was forced to shift its distribution model entirely. After its CDN IPs were repeatedly blocked in Spain, making critical security updates inaccessible to users, the developers resorted to distributing their software via BitTorrent.

[…]

LaLiga, meanwhile, continues to tout its enforcement record. A self-published report revealed that over 26 million takedown notices were sent in the first half of 2025 alone, more than doubling the total from all of 2024.

Source: LaLiga’s Anti-Piracy Tactics Disrupt Major Sites in Spain

Related: Massive expansion of Italy’s Piracy Shield underway despite growing criticism of its flaws and EU illegality

As site blocks pile up, European Commission issues subtle slapdown to Italy’s Piracy Shield

Why Italy’s Piracy Shield destroys huge internet companies and small businesses with no recourse (unless you are rich) and can lay out the entire internet in Italy to… protect against football streaming?!

Italy is losing its mind because of copyright: it just made its awful Piracy Shield even worse

Italy’s Piracy Shield Blocks Innocent Web Sites, Makes It Hard For Them To Appeal so ISPs are ignoring the law because it’s stupid

EU prepares to give new rights to live streaming sites, to the detriment of the Internet and its users

LaLiga Piracy Blocks Randomly Take Down huge innocent segments of internet with no recourse or warning, slammed as “Unaccountable Internet Censorship”

Now the copyright industry wants to apply deep, automated blocking to the Internet’s core routers

OpenAI plugs ShadowLeak bug in ChatGPT which allowed anybody access to everybodys gmail emails and any other integrations

ChatGPT’s research assistant sprung a leak – since patched – that let attackers steal Gmail secrets with just a single carefully crafted email.

Deep Research, a tool unveiled by OpenAI in February, enables users to ask ChatGPT to browse the internet or their personal email inbox and generate a detailed report on its findings. The tool can be integrated with apps like Gmail and GitHub, allowing people to do deep dives into their own documents and messages without ever leaving the chat window.

Cybersecurity outfit Radware this week disclosed a critical flaw in the feature, dubbed “ShadowLeak,” warning that it could allow attackers to siphon data from inboxes with no user interaction whatsoever. Researchers showed that simply sending a maliciously crafted email to a Deep Research user was enough to get the agent to exfiltrate sensitive data when it later summarized that inbox.

The attack relies on hiding instructions inside the HTML of an email using white-on-white text, CSS tricks, or metadata, which a human recipient would never notice. When Deep Research later crawls the mailbox, it dutifully follows the attacker’s hidden orders and sends the contents of messages, or other requested data, to a server controlled by the attacker.

Radware stressed that this isn’t just a prompt injection on the user’s machine. The malicious request is executed from OpenAI’s own infrastructure, making it effectively invisible to corporate security tooling.

That server-side element is what makes ShadowLeak particularly nasty. There’s no dodgy link for a user to click, and no suspicious outbound connection from the victim’s laptop. The entire operation happens in the cloud, and the only trace is a benign-looking query from the user to ChatGPT asking it to “summarize today’s emails”. […] The researchers argue that the risk isn’t limited to Gmail either. Any integration that lets ChatGPT hoover up private documents could be vulnerable to the same trick if input sanitization isn’t watertight.

[…]

Radware said it reported the ShadowLeak bug to OpenAI on June 18 and the company released a fix on September 3. The Register asked OpenAI what specific changes were made to mitigate this vulnerability and whether it had seen any evidence that the vulnerability had been exploited in the wild before disclosure, but did not receive a response.

Radware is urging organizations to treat AI agents as privileged users and to lock down what they can access. HTML sanitization, stricter control over which tools agents can use, and better logging of every action taken in the cloud are all on its list of recommendations. ®

Source: OpenAI plugs ShadowLeak bug in ChatGPT • The Register

Entra ID bug granted easy access to every tenant

A security researcher claims to have found a flaw that could have handed him the keys to almost every Entra ID tenant worldwide.

Dirk-jan Mollema reported the finding to the Microsoft Security Research Center (MSRC) in July. The issue was fixed and confirmed as mitigated, and a CVE was raised on September 4.

It is, however, an alarming vulnerability involving flawed token validation that can result in cross-tenant access. “If you are an Entra ID admin,” wrote Mollema, “that means complete access to your tenant.”

There are two main elements in the vulnerability. The first, according to Mollema, is undocumented impersonation tokens called “Actor tokens” that Microsoft uses for service-to-service communication. There was a flaw in the legacy Azure Active Directory Graph API that did not properly validate the originating tenant, allowing the tokens to be used for cross-tenant access.

“Effectively,” wrote Mollema, “this means that with a token I requested in my lab tenant I could authenticate as any user, including Global Admins, in any other tenant.”

The tokens allowed full access to the Azure AD Graph API in any tenant. Any hope that a log might save the day was also dashed – “requesting Actor tokens does not generate logs.”

“Even if it did, they would be generated in my tenant instead of in the victim tenant, which means there is no record of the existence of these tokens.”

The upshot of the flaw was a possible compromise for any service that uses Entra ID for authentication, such as SharePoint Online or Exchange Online. Mollema noted that access to resources hosted in Azure was also possible.

[…]

Source: Entra ID bug could have granted access to every tenant • The Register

Samsung confirms its $1,800+ fridges will start showing you ads

Samsung started rolling out an update to its refrigerators that brought ads to the display, whether you like it or not. The whole situation is rather surreal but not entirely unsurprising. There were some doubts that the changelog wasn’t real or that it belonged to a different product. Now, Samsung has confirmed to us that ads are indeed coming to its refrigerators.

We had reached out to Samsung for a statement, and this is what a Samsung spokesperson said:

Samsung is committed to innovation and enhancing every day value for our home appliance customers. As part of our ongoing efforts to strengthen that value, we are conducting a pilot program to offer promotions and curated advertisements on certain Samsung Family Hub refrigerator models in the U.S. market.
As a part of this pilot program, Family Hub refrigerators in the U.S. will receive an over-the-network (OTN) software update with Terms of Service (T&C) and Privacy Notice (PN). Advertising will appear on certain Family Hub refrigerator Cover Screens. The Cover Screen appears when a Family Hub screen is idle. Ad design format may change depending on Family Hub personalization options for the Cover Screen, and advertising will not appear when Cover Screen displays Art Mode or picture albums.
Advertisements can be dismissed on the Cover Screens where ads are shown, meaning that specific ads will not appear again during the campaign period.

As the statement notes, this is a pilot program for certain Samsung Family Hub refrigerator models sold in the US. As part of the program, these refrigerators will display “promotions and curated advertisements” on certain Cover Screens when the Family Hub screen (i.e., the door display) is idle.

The company notes that ads can be dismissed, and dismissed ads will not appear again. The ad design format will also change depending on the Cover Screen’s personalization options. Ads will not appear when the Cover Screen displays photos or art.

From the changelog, we know that ads will be displayed on the Cover Screen for the Weather, Color, and Daily Board themes, whereas the Cover Screen for the Art and Gallery themes will not display advertisements, in line with the company’s statement.

It’s still unclear which exact refrigerators are getting the ad infestation, but Samsung’s current Family Hub-equipped lineup in the US starts at $1,800 and goes all the way up to $3,500. It doesn’t seem like users can entirely turn off ads

Source: Samsung confirms its $1,800+ fridges will start showing you ads

Yay the good old US where this is legal. I am not sure this would go in the EU but then again, I am not sure what EU law would stop this either. Apparently you don’t own what you bought and you can’t stop “new features” if you don’t want them.

The “Debate Me Bro” Grift: How Trolls Weaponized The Marketplace Of Ideas

[… lots of random stuff about some influencer nobody heard of until the US fascists made him a thing to deflect from Gaza, Ukraine, Trump and Epstein…] The “debate me bro” playbook is simple and effective: demand that serious people engage with your conspiracy theories or extremist talking points. If they decline, cry “censorship!” and claim they’re “afraid of the truth.” If they accept, turn the interaction into a performance designed to generate viral clips and false legitimacy. It’s a heads-I-win-tails-you-lose proposition that has nothing to do with genuine intellectual discourse.

The fundamental issue with “debate me bro” culture isn’t just that it’s obnoxious, it’s that it creates a false equivalence between good-faith expertise and bad-faith trolling. When you agree to debate someone pushing long-debunked conspiracy theories or openly hateful ideologies, you’re implicitly suggesting that their position deserves equal consideration alongside established facts and expert analysis.

This is exactly backwards from how the actual “marketplace of ideas” is supposed to work. Ideas don’t deserve platforms simply because someone is willing to argue for them loudly. They earn legitimacy through evidence, peer review, and sustained engagement with reality. Many of the ideas promoted in these viral “debates” have already been thoroughly debunked and rejected by that marketplace—but the “debate me bro” format resurrects them as if they’re still worth serious consideration.

Perhaps most insidiously, these aren’t actually debates at all. They’re performances designed to generate specific emotional reactions for viral distribution. Participants aren’t trying to persuade anyone or genuinely engage with opposing viewpoints. They’re trying to create moments that will get clipped, shared, and monetized across social media.

[…]

The most toxic evolution of this grift is Jubilee Media’s “Surrounded” series on YouTube (on which Kirk once appeared, because of course he did), which The New Yorker’s Brady Brickner-Wood aptly describes as an attempt to “anthropomorphize the internet, turning incendiary discourse into live-action role-play.” The format is simple: put one public figure in a room with 20 ideologically opposed people and let them duke it out in rapid-fire rounds designed for maximum conflict and viral potential.

As Brickner-Wood notes, these aren’t actual debates in the classical sense of trying to persuade, they’re spectacles designed to set up bad faith dipshits with the opportunity to dunk on others for social media clout.

“Surrounded” videos are a dizzying and bewildering watch, as gruelling as they are compelling. The participants who fare best seem to be familiar with the conventions of interscholastic debate, spouting off statistics and logic puzzles with the alacrity of an extemporaneous-speaking champion. To win an argument in such a condensed amount of time, debaters attempt to short-circuit their opponent’s claim as swiftly and harshly as possible, treating their few minutes of airtime as a domination game rather than, say, a path toward truth or understanding. The goal here is not to inform or educate, to listen or process, to build or intellectualize but to win, to own, to dunk on, to break the opponent’s brain, to spawn an argument of such devastating definitiveness that the matter can be considered, once and for all, closed. Wave the flag, run the clock out—next.

But Surrounded is just the most recent manifestation of a much older problem. We’ve seen multiple bad faith trolls, beyond just Kirk, turn the “debate me bro” model into large media empires. When people point out their bad faith nonsense, we’re told “what are you complaining about, they’re doing things the ‘right way’ by debating with those they disagree with.”

[…]

The format actively discourages the kind of thoughtful, nuanced discussion that might actually change minds—the kind actually designed for persuasion. Instead, it rewards the most inflammatory takes, the most emotionally manipulative tactics, and the most viral-ready soundbites. Anyone going into these situations with good faith gets steamrolled by participants who understand they’re playing a different game entirely.

When trolls demand debates, they’re not interested in having their minds changed or genuinely testing their ideas. They want one of two outcomes: either you decline and they get to claim victory by default, or you accept and they get to use your credibility to legitimize their nonsense while farming viral moments.

None of this means we should avoid authentically engaging with different viewpoints or challenging ideas. But there’s a crucial difference between good-faith intellectual engagement and feeding trolls who are just looking for their next viral moment.

[…]

When we praise bad-faith performers for “engaging” with their critics, we’re not celebrating democratic norms—we’re rewarding those who exploit them.

Source: The “Debate Me Bro” Grift: How Trolls Weaponized The Marketplace Of Ideas

Mercedes to bring back cabin buttons for current and future models

Mercedes-Benz will begin to integrate more physical controls into its digitally focused cabins, as “the data shows us physical buttons are better”, software boss Magnus Östberg has told Autocar.

This starts with the new GLC and CLA Shooting Brake EVs, which both get a host of rockers, rollers and buttons on a new-design steering wheel.

This wheel will be the standard for Mercedes’s models going forward, and the plan is also to fit it to all cars already on sale – starting later this year with the recently launched CLA saloon.

This, Östberg said, is the easiest and most cost-efficient way of adding physical controls to cars that are already on sale while still keeping Mercedes’ digital-first cabins.

Speaking to Autocar at the Munich motor show, he explained: “You can see a difference if you move from the CLA [saloon], which has a touchscreen and fewer hard buttons, to the [new] GLC, where we put back the rollers and buttons, because we see in the data that the rollers and these physical buttons are very important for certain age groups and certain populations.

“So having that balance between physical buttons and the touch is extremely important for us. We’re completely data-driven, seeing that what is actually something that is used high-frequency, the data shows us the physical buttons are better, and that’s why we put them back in.”

That data has come from software-defined vehicles: the CLA is Mercedes’ first SDV and the incoming GLC the second.

As well as being easier to tweak (as software can be updated over the air rather than needing to drag buyers into garages), SDVs also give car makers full access to drivers’ data and usage. “This is so important,” said Östberg, as it means decisions, such as bringing back some physical controls, can be data-driven.

Due to that data, he hinted that other wheel designs could be used depending on the market. For example, while Europeans like buttons, Asian drivers prefer more touchscreen and voice controls.

Östberg said Mercedes is also looking at adding more physical controls elsewhere in the cabin for future models – but this will most likely be kept to SUVs, as “in larger cars we have more freedom to package” and buyers of those cars “care more about buttons”.

[…]

Source: Mercedes to bring back cabin buttons for current and future models | Autocar

Come on BMW, please do the same!

Google confirms crims accessed portal to share data with cops

Google confirmed that miscreants created a fraudulent account in its Law Enforcement Request System (LERS) portal, which police and other government agencies use to ask for data about Google users.

“We have identified that a fraudulent account was created in our system for law enforcement requests and have disabled the account,” a Google spokesperson told The Register on Tuesday. “No requests were made with this fraudulent account, and no data was accessed.”

Google’s admission follows BreachForums posts by Scattered Lapsus$ Hunters – this is the gang allegedly made up of members from three other notorious cybercrime crews, Scattered Spider, ShinyHunters, and Lapsus$. Shortly after announcing their retirement from the ransomware biz, they indicated via screenshots that they had access to Google LERS, as well as the FBI’s National Instant Criminal Background Check System (NICS), a federal system that provides background checks on would-be gun buyers to ensure they aren’t prohibited from owning a firearm. The FBI declined to comment on the extortionists’ claims.

[…]

Source: Google confirms crims accessed its law enforcement portal • The Register

Chart: How People Actually Use ChatGPT, According to Research

Sankey chart showing the most common reasons people use ChatGPT, based on an OpenAI study of 1.1 million messages

New Research Shows How People Actually Use ChatGPT

This was originally posted on our Voronoi app. Download the app for free on iOS or Android and discover incredible data-driven charts from a variety of trusted sources.

  • New research breaks down ChatGPT usage behavior based on over one million messages.
  • Over half of ChatGPT use cases are for learning and productivity.
  • 90% of users rely on the free version of ChatGPT.

What do people actually use ChatGPT for?

It’s a question that has lingered since the tool first went viral back in 2022. Now, a new research paper from OpenAI sheds light on user behavior by analyzing a sample of 1.1 million messages from active ChatGPT users between May 2024 to July 2025.

The findings, summarized in a helpful visualization by Made Visual Daily, show that ChatGPT’s core appeal is utility: helping users solve real-world problems, write better, and find information fast.

How People Use ChatGPT

[table omitted]

Over 55% of ChatGPT prompts fell into either learning or productivity-related tasks. Users often turn to the chatbot for help understanding concepts, writing emails, summarizing articles, or coding. A wide base of users are using the tool as a digital assistant, tutor, or research aide.

Meanwhile, niche categories like roleplaying and entertainment make up a smaller but meaningful slice. These uses include things like fictional storytelling, game design, and writing fan fiction. Their growth points to ChatGPT’s creative potential beyond functional tasks.

Why This Study Matters

This is the first large-scale analysis that classifies how ChatGPT is actually used, rather than relying on anecdotal evidence or surveys. It also reveals how people across professions—from marketers to software developers—are integrating AI into their daily workflows.

Another key insight? Most people still use the free version of ChatGPT. Only about 10% of the prompts analyzed came from paid users of GPT-4, suggesting that even the free-tier model is driving widespread productivity.

Source: Chart: How People Actually Use ChatGPT, According to Research

China: 1-hour deadline on serious cyber incident reporting

Beijing will soon expect Chinese network operators to ‘fess up to serious cyber incidents within an hour of spotting them – or risk penalties for dragging their feet.

From November 1, the Cyberspace Administration of China (CAC) will enforce its new National Cybersecurity Incident Reporting Management Measures, a sweeping set of rules that tighten how quickly incidents must be disclosed.

The rules apply to a broad category of “network operators,” which in China effectively means anyone who owns, manages, or provides network services, and mandate that serious incidents be reported to the relevant authorities within 60 minutes – or in the case of “particularly major” events, 30 minutes.

“If it is a major or particularly important network security incident, the protection department shall report to the national cyber information department and the public security department of the State Council as soon as possible after receiving the report, no later than half an hour,” the CAC states.

The regulations set out a four-tier system for classifying cyber incidents, but reserve their most challenging demands for the highest “particularly major” tier. An incident that falls within this category includes the loss or theft of core or sensitive data that threatens national security or social stability, a leak of more than 100 million citizens’ personal records, or outages that take key government or news websites offline for more than 24 hours.

The CAC also considers direct economic losses of more than ¥100 million (about £10.3 million) enough to trigger the highest classification.

Operators must file their initial report with a laundry list of details: what systems were hit, the timeline of the attack, the type of incident, what damage was done, what steps were taken to contain it, the preliminary cause, vulnerabilities exploited, and even ransom amounts if a shakedown was involved. They also need to include a grim bit of crystal-ball gazing – an assessment of possible future harm, and what government support they need in order to recover.

After the dust settles, a final postmortem must be submitted within 30 days, detailing causes, lessons learned, and where the blame lies.

Anyone caught sitting on an incident or trying to brush it under the carpet can expect to face penalties, with both network operators and government suits in the firing line.

“If the network operator reports late, omitted, falsely reported or concealed network security incidents, causing major harmful consequences, the network operator and the relevant responsible persons shall be punished more severely according to law,” the CAC warns.

Beijing’s cyber cops have rolled out a bunch of reporting channels – hotline 12387, a website, WeChat, email, and more – making it harder for anyone to plead ignorance when their network catches fire.

Compared to Europe’s leisurely 72-hour breach deadline, Beijing’s stopwatch will force many organizations to invest in real-time monitoring and compliance teams that can make a go/no-go call in minutes rather than days.

The introduction of these stringent new reporting rules comes just days after Dior’s Shanghai arm was fined for transferring customer data to its French headquarters without the legally required security screening, proper customer disclosure, or even encryption. ®

Source: China: 1-hour deadline on serious cyber incident reporting • The Register

There must be a huge government department back there waiting to “help out”. I do wonder what shape this kind of “help” will take.

New drug could be first to stop deadly fatty liver disease

Researchers at University of California San Diego School of Medicine have identified a new investigational drug that shows promise in treating metabolic dysfunction-associated steatohepatitis (MASH), a serious form of fatty liver disease linked to obesity and type 2 diabetes that can lead to cirrhosis, liver failure, and even liver cancer.

The study, published in the August 23, 2025 online edition of The Lancet, found that the medication, ION224, targets a liver enzyme called DGAT2, which plays a key role in how the liver produces and stores fat. By blocking this enzyme, the drug helps reduce fat buildup and inflammation, two major drivers of liver damage in MASH.

“This study marks a pivotal advance in the fight against MASH,” said Rohit Loomba, MD, principal investigator of the study and chief of the Division of Gastroenterology and Hepatology at UC San Diego School of Medicine. “By blocking DGAT2, we’re interrupting the disease process at its root cause, stopping fat accumulation and inflammation right in the liver.”

The multicenter, Phase IIb clinical trial involved 160 adults with MASH and early to moderate fibrosis across the United States. Participants received monthly injections of the drug at different doses or a placebo over the course of one year. At the highest dose, 60% showed notable improvements in their liver health compared to the placebo group. These benefits occurred regardless of weight change, suggesting the drug could be used alongside other therapies. The medicine showed no serious side effects linked to the treatment.

MASH, formally known as nonalcoholic steatohepatitis (NASH), affects people with metabolic conditions like obesity and type 2 diabetes. It is often called a “silent” disease because it can progress for years without symptoms.

More than 100 million people have some form of fatty liver disease in the U.S. and as many as 1 in 4 adults worldwide may be affected, according to the Centers for Disease Control and Prevention. If left untreated, MASH can progress to liver failure and often may require a transplant.

“This is the first drug of its kind to show real biological impact in MASH,” Loomba said. “If these findings are confirmed in Phase III trials, we may finally be able to offer patients a targeted therapy that halts and potentially reverses liver damage before it progresses to life-threatening stages.”

Source: New drug could be first to stop deadly fatty liver disease | ScienceDaily

Hosting A Website On A Disposable Vape

For the past years people have been collecting disposable vapes primarily for their lithium-ion batteries, but as these disposable vapes have begun to incorporate more elaborate electronics, these too have become an interesting target for reusability. To prove the point of how capable these electronics have become, [BogdanTheGeek] decided to turn one of these vapes into a webserver, appropriately called the vapeserver.

While tearing apart some of the fancier adult pacifiers, [Bogdan] discovered that a number of them feature Puya MCUs, which is a name that some of our esteemed readers may recognize from ‘cheapest MCU’ articles. The target vape has a Puya PY32F002B MCU, which comes with a Cortex-M0+ core at 24 MHz, 3 kB SRAM and 24 kB of Flash. All of which now counts as ‘disposable’ in 2025, it would appear.

Even with a fairly perky MCU, running a webserver with these specs would seem to be a fool’s errand. Getting around the limited hardware involved using the uIP TCP/IP stack, and using SLIP (Serial Line Internet Protocol), along with semihosting to create a serial device that the OS can use like one would a modem and create a visible IP address with the webserver.

The URL to the vapeserver is contained in the article and on the GitHub project page, but out of respect for not melting it down with an unintended DDoS, it isn’t linked here. You are of course totally free to replicate the effort on a disposable adult pacifier of your choice, or other compatible MCU.

Source: Hosting A Website On A Disposable Vape | Hackaday

A Kentucky Town Experimented With AI. Turns out that most people agree with each other on most things.

A county in Kentucky conducted a month-long “town hall” with nearly 8,000 residents in attendance earlier this year, thanks to artificial intelligence technology.

Bowling Green, Kentucky’s third largest city and a part of Warren County, is facing a huge population spike by 2050. To scale the city in preparation for this, county officials wanted to incorporate the community’s input.

Community outreach is tough business: town halls, while employed widely, don’t tend to gather a huge crowd, and when people do come, it’s a self-selecting pool of people with strong negative opinions only and not representative of the town at large.

On the other hand, gathering the opinion of a larger portion of the city via online surveys would result in a dataset so massive that officials and volunteers would have a hard time combing through and making sense out of it.

Instead, county officials in Bowling Green had AI do that part. And participation was massive: in a roughly month-long online survey, about 10% of Bowling Green residents voiced their opinions on the policy changes they wanted to see in their city. The results were then synthesized by an AI tool and made into a policy report, which is still visible for the public to see on the website.

“If I have a town hall meeting on these topics, 23 people show up,” Warren County judge executive Doug Gorman told PBS News Hour in an interview published this week. “And what we just conducted was the largest town hall in America.

[…]

The prompt was open-ended, just asking participants what they wanted to see in their community over the next 25 years. They could then continue to participate further by voting on other answers.

Over the course of the 33 days that the website was accepting answers, nearly 8,000 residents weighed in more than a million times, and shared roughly 4,000 unique ideas calling for new museums, the expansion of pedestrian infrastructure, green spaces and more.

The answers were then compiled into a report using Sensemaker, an AI tool by Google’s tech incubator Jigsaw that analyzes large sets of online conversations, categorizes what’s said into overarching topics, and analyzes agreement and disagreement to create actionable insights.

At the end, Sensemaker found 2,370 ideas that at least 80% of the respondents could agree on.

[…]

One of the most striking things they found out in Bowling Green was that when the ideas were anonymous and stripped of political identity, the constituents found that they agreed on a lot.

“When most of us don’t participate, then the people who do are usually the ones that have the strongest opinions, maybe the least well-informed, angriest, and then you start to have a caricatured idea of what the other side thinks and believes. So one of the most consequential things we could do with AI is to figure out how to help us stay in the conversation together,” Jigsaw CEO Yasmin Green told PBS.

[…]

 

Source: A Kentucky Town Experimented With AI. The Results Were Stunning

Reddit will block the Internet Archive because AI MONEY

Reddit says that it has caught AI companies scraping its data from the Internet Archive’s Wayback Machine, so it’s going to start blocking the Internet Archive from indexing the vast majority of Reddit. The Wayback Machine will no longer be able to crawl post detail pages, comments, or profiles; instead, it will only be able to index the Reddit.com homepage, which effectively means Internet Archive will only be able to archive insights into which news headlines and posts were most popular on a given day.

”Internet Archive provides a service to the open web, but we’ve been made aware of instances where AI companies violate platform policies, including ours, and scrape data from the Wayback Machine,” spokesperson Tim Rathschmidt tells The Verge.

The Internet Archive’s mission is to keep a digital archive of websites on the internet and “other cultural artifacts,” and the Wayback Machine is a tool you can use to look at pages as they appeared on certain dates, but Reddit believes not all of its content should be archived that way. “Until they’re able to defend their site and comply with platform policies (e.g., respecting user privacy, re: deleting removed content) we’re limiting some of their access to Reddit data to protect redditors,” Rathschmidt says.

[…]

Source: Reddit will block the Internet Archive | The Verge

The privacy argument does not hold – the Reddit content is freely viewable to anyone with a web browser. And Reddit is making content deals with AI companies. So it looks like Reddit is a kettle calling the pot black there.

Toxic Fumes Are Leaking Into Airplanes, Sickening Crews and Passengers

[…] After months of worsening symptoms, Chesson was diagnosed with a traumatic brain injury and permanent damage to her peripheral nervous system caused by the fumes she inhaled. Her doctor, Robert Kaniecki, a neurologist and consultant to the Pittsburgh Steelers, said in an interview that the effects on her brain were akin to a chemical concussion and “extraordinarily similar” to those of a National Football League linebacker after a brutal hit. “It’s impossible not to draw that conclusion,” he said.

Kaniecki said he has treated about a dozen pilots and over 100 flight attendants for brain injuries after exposure to fumes on aircraft over the last 20 years. Another was a passenger, a frequent flier with Delta’s top-tier rewards status who was injured in 2023.

Chesson’s experience is one dramatic instance among thousands of so-called fume events reported to the Federal Aviation Administration since 2010, in which toxic fumes from a jet’s engines leak unfiltered into the cockpit or cabin. The leaks occur due to a design element in which air you breathe on an aircraft is pulled through the engine. The system, known as “bleed air,” has been featured in almost every modern commercial jetliner except Boeing’s 787.

The rate of incidents is accelerating in recent years, a Wall Street Journal investigation has found, driven in large part by leaks on Airbus’s bestselling A320 family of jets—the aircraft Chesson was flying.

The Journal’s reporting—based on a review of more than one million FAA and National Aeronautics and Space Administration reports, thousands of pages of documents and research papers and more than 100 interviews—shows that aircraft manufacturers and their airline customers have played down health risks, successfully lobbied against safety measures, and made cost-saving changes that increased the risks to crew and passengers.

The fumes—sometimes described as smelling of “wet dog,” “Cheetos” or “nail polish”—have led to emergency landings, sickened passengers and affected pilots’ vision and reaction times midflight, according to official reports.

Most odors in aircraft aren’t toxic, and neither are all vapors. The effects are often fleeting, mild or present no symptoms.

But they can also be longer-lasting and severe, according to doctors, medical records and affected crew members.

The cause of fume events isn’t a mystery. Airbus and Boeing, the two biggest aircraft manufacturers, have acknowledged that malfunctions can lead to oil and hydraulic fluid leaking into the engines or power units and vaporizing at extreme heat. This results in the release of unknown quantities of neurotoxins, carbon monoxide and other chemicals into the air.

[…]

Manufacturers, regulators and airlines have said these types of incidents are too infrequent, levels of contamination too low and scientific research on lasting health risks too inconclusive to warrant a comprehensive fix. In some cases, they have attributed reported health-effects from fume exposure to factors including hyperventilation, jet lag, psychological stress, mass hysteria and malingering.

Internally, industry staffers have flagged their own fears about the toxic makeup of engine oils.

[…]

The individual airlines mentioned in this article noted their commitment to the safety of their passengers and crew, and said they follow the protocols established by the FAA and the manufacturers of their planes.

[…]

The FAA on its website says the incidents are “rare” and cites a 2015 review that estimated a rate of “less than 33 events per million aircraft departures.” That rate would suggest a total of about 330 fume events on U.S. airlines last year.

In reality, the FAA received more than double that number of reports of fume events in 2024 from the 15 biggest U.S. airlines alone, according to the Journal’s analysis of service difficulty reports for flights between 2010 and early 2025. The rate has soared in recent years. In 2014, the Journal found about 12 fume events per million departures. By 2024, the rate had jumped to nearly 108. (Read more about how the Journal conducted its analysis.)

In a statement, the FAA attributed the increase in part to a change in its guidance for reporting fume events, although that revision was only implemented in November of last year.

[…]

The FAA doesn’t have a formal definition of a fume event and the service reports often don’t indicate the severity. In its review, the Journal mirrored the industry’s practice of relying on crew reports of specific odors and associated maintenance reports. Changes in crew awareness could impact reporting rates.

The actual rate is likely far higher, as crews don’t always report incidents to their airlines, which likewise don’t report all instances to the FAA. A review of internal data by the airline lobby International Air Transport Association, calculated a total rate of 800 per million departures in the U.S., according to an internal document from a member carrier.

The Journal’s analysis suggests that the growth is driven by the world’s bestselling aircraft: the Airbus A320. In 2024, among the three largest U.S. airlines with mixed fleets, the rate of reports on A320s had increased to more than seven times the rate on their Boeing 737 aircraft.

[…]

The Journal’s analysis shows incidents began climbing in 2016, the year Airbus started delivering its new A320neo, what would become the world’s fastest-selling model. It boasted a new generation of fuel-efficient engines, including one that was plagued by rapidly degrading seals meant to keep oil from leaking into the air supply.

Under pressure from airlines who complained that fume events were keeping aircraft out of service for up to days at a time, Airbus loosened maintenance rules, according to a review of internal documents and people familiar with the changes.

For example, under the old guidelines, Airbus typically required an inspection and deep-clean after a fume event. Under the revised rules, if the smell wasn’t strong and hadn’t occurred in the last 10 days, airlines wouldn’t need to take immediate action.

[…]

Source: Toxic Fumes Are Leaking Into Airplanes, Sickening Crews and Passengers

This sounds like the kind of health risk ignoring that went / goes on in Tobacco companies and impact sport head injury risk

US, CA and EU Airlines Sell 5 Billion Plane Ticket Records to the Government For Warrantless Searching

A data broker owned by the country’s major airlines, including American Airlines, United, and Delta, [and Air France, Lufthansa, JetBlue] is selling access to five billion plane ticketing records to the government for warrantless searching and monitoring of peoples’ movements, including by the FBI, Secret Service, ICE, and many other agencies, according to a new contract and other records reviewed by 404 Media.
The contract provides new insight into the scale of the sale of passengers’ data by the Airlines Reporting Corporation (ARC), the airlines-owned data broker. The contract shows ARC’s data includes information related to more than 270 carriers and is sourced through more than 12,800 travel agencies. ARC has previously told the government to not reveal to the public where this passenger data came from, which includes peoples’ names, full flight itineraries, and financial details.
“Americans’ privacy rights shouldn’t depend on whether they bought their tickets directly from the airline or via a travel agency. ARC’s sale of data to U.S. government agencies is yet another example of why Congress needs to close the data broker loophole by passing my bipartisan bill, the Fourth Amendment Is Not For Sale Act,” Senator Ron Wyden told 404 Media in a statement.
ARC is owned and operated by at least eight major U.S. airlines, publicly released documents show. Its board of directors includes representatives from American Airlines, Delta, United, Southwest, Alaska Airlines, JetBlue, and European airlines Air France and Lufthansa, and Canada’s Air Canada. ARC acts as a bridge between airlines and travel agencies, in which it helps with fraud prevention and finds trends in travel data. ARC also sells passenger data to the government as part of what it calls the Travel Intelligence Program (TIP).
TIP is updated every day with the previous day’s ticket sales and can show a person’s paid intent to travel. Government agencies can then search this data by name, credit card, airline, and more.
The new contract shows that ARC has access to much more data than previously reported. Earlier coverage found TIP contained more than one billion records spanning more than 3 years of past and future travel. The new contract says ARC provides the government with “5 billion ticketing records for searching capabilities.”
Gallery Image
Gallery Image
Screenshots of the documents obtained by 404 Media.
404 Media obtained the contract through a Freedom of Information Act (FOIA) with the Secret Service. The contract indicates the Secret Service plans to pay ARC $885,000 for access to the data stretching into 2028.
[…]
An ARC spokesperson told 404 Media in an email that TIP “was established by ARC after the September 11, 2001, terrorist attacks and has since been used by the U.S. intelligence and law enforcement community to support national security and prevent criminal activity with bipartisan support. Over the years, TIP has likely contributed to the prevention and apprehension of criminals involved in human trafficking, drug trafficking, money laundering, sex trafficking, national security threats, terrorism and other imminent threats of harm to the United States.”
The spokesperson added “Pursuant to ARC’s privacy policy, consumers may ask ARC to refrain from selling their personal data.”
After media coverage and scrutiny from Senator Wyden’s office of the little-known data selling, ARC finally registered as a data broker in the state of California in June. Senator Wyden previously said it appeared ARC had been in violation of Californian law for not registering while selling airline customers’ data for years.

Source: Airlines Sell 5 Billion Plane Ticket Records to the Government For Warrantless Searching

Supposedly you can opt out by emailing them at privacy@arccorp.com

Danish Minister of Justice and chief architect of the current Chat Control proposal, Peter Hummelgaard:

Danish Minister of Justice, Peter Hummelgaard.

“We must break with the totally erroneous perception that it is everyone’s civil liberty to communicate on encrypted messaging services.”

Share your thoughts via https://fightchatcontrol.eu/, or to jm@jm.dk directly.

Source: https://www.ft.dk/samling/20231/almdel/REU/spm/1426/index.htm

In the answers he cites “but we must protect the children” – as soon as that argument is trotted out have a good look at what they are taking away from you. After all, who can be against the safety of children? But blanket surveillance is bad for children and awful for society. If you know you are being watched, you can’t speak freely, you can’t voice your opinion and democracy cannot function. THAT is bad for the children.

There is something rotten in the state of Denmark. Big Brother, 1984, they were warnings, not manuals.

Source: https://mastodon.social/@chatcontrol/115204439983078498

More discussion: https://www.reddit.com/r/europe/comments/1nhdtoz/danish_minister_of_justice_we_must_break_with_the/

PS I would not buy a used camel from this creep.

The Stop Killing Games movement is nearing an official meeting with EU lawmakers

The Stop Killing Games campaign is continuing to gain momentum after hitting more than a million signatures in July. After a July 31st deadline, the movement secured around 1.45 million signatures, which the organizers are currently in the process of verifying. The initiative aims to enact legislation that preserves access to video games, even when developers decide to end support, as seen with Ubisoft when it delisted The Crew and revoked access to players who already purchased the game. There were some early concerns about the potential for falsely-submitted signatures, but the latest update from organizers said that early reports show around 97 percent of the signatures are valid.

According to the European Commission’s website, EU authorities have three months to verify the signatures once they are submitted. After that, the organizers said they will personally deliver the petition to the European Commission. With initial estimates clearing the threshold of one million verified signatures, the following steps involve getting meetings with both the European Commission and the European Parliament.

From the date of the initiative’s submission, the European Union will get six months to decide what to do regarding the Stop Killing Games movement. There is the possibility of the governing bodies not taking any action at all, but the organizers said they are “preparing to ensure our initiative cannot be ignored.” To prepare for the meetings, the organizers said they will be reaching out to members of Parliament and the Commission, while also trying to counter any misinformation or industry lobbying. For now, the campaign will post more frequent updates on its Discord community and social media channels.

Source: The Stop Killing Games movement is nearing an official meeting with EU lawmakers

Newly Granted Nintendo Patents An ‘Embarrassing Failure’ By The USPTO, Says Patent Attorney

As you will hopefully recall, that very strange patent lawsuit between Nintendo and PocketPair over the latter’s hit game, Palworld, is ongoing. At the heart of that case is a series of overly broad patents for what are generally considered generic game mechanics that also have a bunch of prior art from before their use by Nintendo in its Pokémon games. These include concepts like throwing a capture item at an NPC to collect a character, as well as riding and mounting/dismounting NPCs in an open world setting. The result, even as the litigation is ongoing, has been PocketPair patching out several of these game mechanics from its game in order to protect itself. That it feels this is necessary as a result of these broad patents is unfortunate.

And, because of the failure of the USPTO to do its job, it seems things will only get worse. Nintendo was awarded two additional patents in just the past couple of weeks and those patents are being called an “embarrassing failure” by patent attorney Kirk Sigmon.

The last 10 days have brought a string of patent wins for Nintendo. Yesterday, the company was granted US patent 12,409,387, a patent covering riding and flying systems similar to those Nintendo has been criticized for claiming in its Palworld lawsuit (via Gamesfray). Last week, however, Nintendo received a more troubling weapon in its legal arsenal: US patent 12,403,397, a patent on summoning and battling characters that the United States Patent and Trademark Office granted with alarmingly little resistance.

According to videogame patent lawyer Kirk Sigmon, the USPTO granting Nintendo these latest patents isn’t just a moment of questionable legal theory. It’s an indictment of American patent law.

[…]

Sigmon notes that both patents are for mechanics and concepts that ought to be obvious to anyone with a reasonable amount of skill in this industry, which ought to have made them ineligible to be patented. That standard of patent law only works, however, if the USPTO acts as a true interlocutor during the filing process. In both of these cases, though, the USPTO appears to have not been in the mood to do their jobs.

Sigmon notes that it is common for patent applications like this to show some amount of questioning or pushback from the examiner. In both of these cases, that seemed almost entirely absent from the process, especially for patent ‘397.

[…]

When the claims were ultimately allowed, the only reasoning the USPTO offered was a block quote of text from the claims themselves.

The ‘397 patent granted last week is even more striking. It’s a patent on summoning and battling with “sub-characters,” using specific language suggesting it’s based on the Let’s Go! mechanics in the Pokémon Scarlet and Violet games. Despite its relevance to a conceit in countless games—calling characters to battle enemies for you—it was allowed without any pushback whatsoever from the USPTO, which Sigmon said is essentially unheard of.

“Like the above case, the reasons for allowance don’t give us even a hint of why it was allowed: the Examiner just paraphrases the claims (after block quoting them) without explaining why the claims are allowed over the prior art,” Sigmon said. “This is extremely unusual and raises a large number of red flags.”

[…]

with the Palworld example fresh in our minds, we do certainly know what the granting of patents like this will result in: more patent bullying by Nintendo.

“Pragmatically speaking, though, it’s not impossible to be sued for patent infringement even when a claim infringement argument is weak, and bad patents like this cast a massive shadow on the industry,” Sigmon said.

For a company at Nintendo’s scale, the claims of the ‘397 patent don’t need to make for a strong argument that would hold up in court. The threat of a lawsuit can stifle competition well enough on its own when it would cost millions of dollars to defend against.

And in the current environment, where challenging bad patents has become essentially pointless, you can bet we’ll see Nintendo wielding these patents against competitors in the near future.

Source: Newly Granted Nintendo Patents An ‘Embarrassing Failure’ By The USPTO, Says Patent Attorney | Techdirt

Kodak’s mini camera fits on your keyring and is smaller than an AirPods case. Annoyingly like a lootbox and sold out already.

Kodak has shrunk a camera to fit onto a keyring, but it still manages to shoot both photo and video. It’s hard not to compare the Kodak Charmera to the ubiquitous Labubu craze, considering the highly collectible nature of Reto Pro selling these officially licensed mini cameras as a single blind box for $29.99 or a full set of six for $179.94. The keyring cameras, which only weigh 30 grams, are already sold out on the Reto Pro website, but are expected to be restocked.

The blind box can be unwrapped for one of seven designs, including one secret version that has a transparent shell to show off the tiny camera’s internals. According to the website, the basic style odds are one out of six, while the secret edition has a probability of one out of 48.

[…]

Source: Kodak’s mini camera fits on your keyring and is smaller than an AirPods case

Swiss government may disable privacy tech, stoking fears of mass surveillance

The Swiss government could soon require service providers with more than 5,000 users to collect government-issued identification, retain subscriber data for six months and, in many cases, disable encryption.

The proposal, which is not subject to parliamentary approval, has alarmed privacy and digital-freedoms advocates worldwide because of how it will destroy anonymity online, including for people located outside of Switzerland.

A large number of virtual private network (VPN) companies and other privacy-preserving firms are headquartered in the country because it has historically had liberal digital privacy laws alongside its famously discreet banking ecosystem.

Proton, which offers secure and end-to-end encrypted email along with an ultra-private VPN and cloud storage, announced on July 23 that it is moving most of its physical infrastructure out of Switzerland due to the proposed law.

The company is investing more than €100 million in the European Union, the announcement said, and plans to help develop a “sovereign EuroStack for the future of our home continent.” Switzerland is not a member of the EU.

Proton said the decision was prompted by the Swiss government’s attempt to “introduce mass surveillance.”

Proton founder and CEO Andy Yen told Radio Télévision Suisse (RTS) that the suggested regulation would be illegal in the EU and United States.

“The only country in Europe with a roughly equivalent law is Russia,” Yen said.

[…]

Internet users would no longer be able to register for a service with just an email address or anonymously and would instead have to provide their passport, drivers license or another official ID to subscribe, said Chloé Berthélémy, senior policy adviser at European Digital Rights (eDRI), an association of civil and human rights organizations from across Europe.

The regulation also includes a mass data retention obligation requiring that service providers keep users’ email addresses, phone numbers and names along with IP addresses and device port numbers for six months, Berthélémy said. Port numbers are unique identifiers that send data to a specific application or service on a computer.

All authorities would need to do to obtain the data, Berthélémy said, is make a simple request that would circumvent existing legal control mechanisms such as court orders.

“The right to anonymity is supporting a very wide range of communities and individuals who are seeking safety online,” Berthélémy said.

“In a world where we have increasing attacks from governments on specific minority groups, on human rights defenders, journalists, any kind of watchdogs and anyone who holds those in power accountable, it’s very crucial that we … preserve our privacy online in order to do those very crucial missions.”

Source: Swiss government looks to undercut privacy tech, stoking fears of mass surveillance | The Record from Recorded Future News

Samsung patches Android WhatsApp vuln exploited in the wild on Apple devices

Samsung has fixed a critical flaw that affects its Android devices – but not before attackers found and exploited the bug, which could allow remote code execution on affected devices.

The vulnerability, tracked as CVE-2025-21043, affects Android OS versions 13, 14, 15, and 16. It’s due to an out-of-bounds write vulnerability in libimagecodec.quram.so, a parsing library used to process image formats on Samsung devices, which remote attackers can abuse to execute malicious code.

“Samsung was notified that an exploit for this issue has existed in the wild,” the electronics giant noted in its September security update.

The Meta and WhatsApp security teams found the flaw and reported it to Samsung on August 13. Apps that process images on Samsung kit, potentially including WhatsApp, may trigger this library, but Samsung didn’t name specific apps.

The warning is interesting, because Meta shortly thereafter issued a security advisory warning that attackers may have chained a WhatsApp bug with an Apple OS-level flaw in highly targeted attacks.

The WhatsApp August security update included a fix for CVE-2025-55177 that, as Meta explained, “could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.”

That security advisory went on to say, “We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.”

CVE-2025-43300 is an out-of-bounds write issue that Apple addressed on August 20 with a patch that improves bounds checking in the ImageIO framework. “Processing a malicious image file may result in memory corruption,” the iThings maker said at the time. “Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.”

While Meta didn’t mention the newer Android OS-level flaw in its August WhatsApp security update, it seems that CVE-2025-21043 could also be chained to CVE-2025-55177 for a similar attack targeting WhatsApp users on Samsung Android devices instead of Apple’s.

[…]

Source: Samsung patches Android 0-day exploited in the wild • The Register

Spotify pissy after 10,000 users sold their own data to build AI tools

For millions of Spotify users, the “Wrapped” feature—which crunches the numbers on their annual listening habits—is a highlight of every year’s end, ever since it debuted in 2015. NPR once broke down exactly why our brains find the feature so “irresistible,” while Cosmopolitan last year declared that sharing Wrapped screenshots of top artists and songs had by now become “the ultimate status symbol” for tens of millions of music fans.

It’s no surprise then that, after a decade, some Spotify users who are especially eager to see Wrapped evolve are no longer willing to wait to see if Spotify will ever deliver the more creative streaming insights they crave.

With the help of AI, these users expect that their data can be more quickly analyzed to potentially uncover overlooked or never-considered patterns that could offer even more insights into what their listening habits say about them.

Imagine, for example, accessing a music recap that encapsulates a user’s full listening history—not just their top songs and artists.

[…]

In pursuit of supporting developers offering novel insights like these, more than 18,000 Spotify users have joined “Unwrapped,” a collective launched in February that allows them to pool and monetize their data.

Voting as a group through the decentralized data platform Vana—which Wired profiled earlier this year—these users can elect to sell their dataset to developers who are building AI tools offering fresh ways for users to analyze streaming data in ways that Spotify likely couldn’t or wouldn’t.

In June, the group made its first sale, with 99.5 percent of members voting yes. Vana co-founder Anna Kazlauskas told Ars that the collective—at the time about 10,000 members strong—sold a “small portion” of its data (users’ artist preferences) for $55,000 to Solo AI.

While each Spotify user only earned about $5 in cryptocurrency tokens—which Kazlauskas suggested was not “ideal,” wishing the users had earned about “a hundred times” more—she said the deal was “meaningful” in showing Spotify users that their data “is actually worth something.”

“I think this is what shows how these pools of data really act like a labor union,” Kazlauskas said. “A single Spotify user, you’re not going to be able to go say like, ‘Hey, I want to sell you my individual data.’ You actually need enough of a pool to sort of make it work.”

[…]

Spotify is not happy about Unwrapped, which is perhaps a little too closely named to its popular branded feature for the streaming giant’s comfort. A spokesperson told Ars that Spotify sent a letter to the contact info listed for Unwrapped developers on their site, outlining concerns that the collective could be infringing on Spotify’s Wrapped trademark.

Further, the letter warned that Unwrapped violates Spotify’s developer policy, which bans using the Spotify platform or any Spotify content to build machine learning or AI models. And developers may also be violating terms by facilitating users’ sale of streaming data.

“Spotify honors our users’ privacy rights, including the right of portability,” Spotify’s spokesperson said. “All of our users can receive a copy of their personal data to use as they see fit. That said, UnwrappedData.org is in violation of our Developer Terms which prohibit the collection, aggregation, and sale of Spotify user data to third parties.”

But while Spotify suggests it has already taken steps to stop Unwrapped, the Unwrapped team told Ars that it never received any communication from Spotify. It plans to defend users’ right to “access, control, and benefit from their own data,” its statement said, while providing reassurances that it will “respect Spotify’s position as a global music leader.”

Unwrapped “does not distribute Spotify’s content, nor does it interfere with Spotify’s business,” developers argued. “What it provides is community-owned infrastructure that allows individuals to exercise rights they already hold under widely recognized data protection frameworks—rights to access their own listening history, preferences, and usage data.”

“When listeners choose to share or monetize their data together, they are not taking anything away from Spotify,” developers said. “They are simply exercising digital self-determination. To suggest otherwise is to claim that users do not truly own their data—that Spotify owns it for them.”

Jacob Hoffman-Andrews, a senior staff technologist for the digital rights group the Electronic Frontier Foundation, told Ars that—while EFF objects to data dividend schemes “where users are encouraged to share personal information in exchange for payment”—Spotify users should nevertheless always maintain control of their data.

“In general, listeners should have control of their own data, which includes exporting it for their own use,” Hoffman-Andrews said. “An individual’s musical history is of use not just to Spotify but also to the individual who created it. And there’s a long history of services that enable this sort of data portability, for instance Last.fm, which integrates with Spotify and many other services.”

[…]

“This is the heart of the issue: If Spotify seeks to restrict or penalize people for exercising these rights, it sends a chilling message that its listeners should have no say in how their own data is used,” the Unwrapped team’s statement said. “That is out of step not only with privacy law, but with the values of transparency, fairness, and community-driven innovation that define the next era of the Internet.”

Unwrapped sign-ups limited due to alleged Spotify issues

There could be more interest in Unwrapped. But Kazlauskas alleged to Ars that in the more than six months since Unwrapped’s launch, “Spotify has made it extraordinarily difficult” for users to port over their data. She claimed that developers have found that “every time they have an easy way for users to get their data,” Spotify shuts it down “in some way.”

Supposedly because of Spotify’s interference, Unwrapped remains in an early launch phase and can only offer limited spots for new users seeking to sell their data. Kazlauskas told Ars that about 300 users can be added each day due to the cumbersome and allegedly shifting process for porting over data.

Currently, however, Unwrapped is working on an update that could make that process more stable, Kazlauskas said, as well as changes to help users regularly update their streaming data. Those updates could perhaps attract more users to the collective.

[…]

Source: Spotify peeved after 10,000 users sold data to build AI tools – Ars Technica

The Software Engineers Paid to Fix Vibe Code

Freelance developers and entire companies are making a business out of fixing shoddy vibe coded software.

I first noticed this trend in the form of a meme that was circulating on LinkedIn, sharing a screenshot of several profiles who advertised themselves as “vibe coding cleanup specialists.”

[…]

“I’ve been offering vibe coding fixer services for about two years now, starting in late 2023. Currently, I work with around 15-20 clients regularly, with additional one-off projects throughout the year,” Hamid Siddiqi, who offers to “review, fix your vibe code” on Fiverr, told me in an email. “I started fixing vibe-coded projects because I noticed a growing number of developers and small teams struggling to refine AI-generated code that was functional but lacked the polish or ‘vibe’ needed to align with their vision. I saw an opportunity to bridge that gap, combining my coding expertise with an eye for aesthetic and user experience.”

Siddiqi said common issues he fixes in vibe coded projects include inconsistent UI/UX design in AI-generated frontends, poorly optimized code that impacts performance, misaligned branding elements, and features that function but feel clunky or unintuitive. He said he also often refines color schemes, animations, and layouts to better match the creator’s intended aesthetic.

Siddiqi is one of dozens of people on Fiverr who is now offering services specifically catering to people with shoddy vibe coded projects. Established software development companies like Ulam Labs, now say “we clean up after vibe coding. Literally.”

“Built something fast? Now it’s time to make it solid,” Ulam Labs says on its site. “We know how it goes.
You had to move quickly, get that MVP [minimally viable product] out, and validate the idea. But now the tech debt is holding you back: no tests, shaky architecture, CI/CD [Continuous Integration and Continuous Delivery/Deployment] is a dream, and every change feels like defusing a bomb. That’s where we come in.”

Swatantra Sohni, who started VibeCodeFixers.com, a site for people with vibe coded projects who need help from experienced developers to fix or finish their projects, says that almost 300 experienced developers have posted their profiles to the site. He said so far VibeCodeFixers.com has only connected between 30-40 vibe code projects with fixers, but that he hasn’t done anything to promote the service and at the moment is focused on adding as many software developers to the platform as possible.

Sohni said that he’s been vibe coding himself since before Andrej Karpathy coined the term in February. He bought a bunch of vibe coding related domains, and realized a service like VibeCodeFixers.com was necessary based on how often he had to seek help from experts on his own vibe coding projects. In March, the site got a lot of attention on X and has been slowly adding people to the platform since.

Sohni also wrote a “Vibecoding Community Research Report” based on interviews with non-technical people who are vibe coding their projects that he shared with me. The report identified a lot of the same issues as Siddiqi, mainly that existing features tend to break when new ones are added.

“Most of these vibe coders, either they are product managers or they are sales guys, or they are small business owners, and they think that they can build something,” Sohni told me. “So for them it’s more for prototyping. Vibe coding is, at the moment, kind of like infancy. It’s very handy to convey the prototype they want, but I don’t think they are really intended to make it like a production grade app.”

Another big issue Sohni identified is “credit burn,” meaning the money vibe coders waste on AI usage fees in the final 10-20 percent stage of developing the app, when adding new features breaks existing features. In theory, it might be cheaper and more efficient for vibe coders to start over at that point, but Sohni said people get attached to their first project.

“What happens is that the first time they build the app, it’s like they think that they can build the app with one prompt, and then the app breaks, and they burn the credit. I think they are very emotionally connected to the app, because this act of vibe coding involves you, your creativity.”

In theory it might be cheaper and more efficient for vibe coders to start over if the LLM starts hallucinating and creating problems, but Sohni that’s when people come to VibeCodeFixers.com. They want someone to fix the bugs in their app, not create a new one.

Sohni told me he thinks vibe coding is not going anywhere, but neither are human developers.

“I feel like the role [of human developers] would be slightly limited, but we will still need humans to keep this AI on the leash,” he said.

Source: The Software Engineers Paid to Fix Vibe Coded Messes

The article writer is highly sceptical about vibe coding, but it’s not going anywhere and it empowers the actual commissioners of the software to build proof of concepts using elements they like, so they are not at the mercy of a software development company who may or may not see and understand the vision as they see it.