Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
How Block Blast harvests its players for ad money
Ayo Omolewa's technical teardown of Block Blast: decompiling the Android app shows most game logic arrives as server-selected, encrypted JavaScript 'traits', with remote rules deciding pieces, scores and ads, including one that waits for an expensive ad before dealing an unplaceable hand. Includes how to reproduce the findings.
19 min · 4,462 words
Remote Attestation Should Not Be Tolerated
lumi argues that remote attestation—hardware proving software identity to a remote party—is harmful: it enables remote control over what users may run, undermines general-purpose computing, and should be objected to rather than normalized.
4 min · 956 words
The Citizen Lab reports the first public confirmation of zero-click mercenary spyware delivered via targeted ads: Israeli firm Discover-Tech bought ads that infected devices at Al Jazeera with Candiru spyware. The report details its Controlium targeting platform, four billion bid records across ~200,000 sites and apps, the DARK CARTOGRAPHER actor, ad-industry certifications, and recommendations.
105 min · 24,189 words
Mac and iOS developer Jeff Johnson explains why he still avoids passkeys and sticks with randomly generated passwords. Even with the new credential exchange protocol, he argues passkeys tied to iCloud Keychain fail his requirements of logging in from an unfamiliar device and keeping independent backups, and that big platform vendors oversimplify security for everyone.
6 min · 1,273 words
Meta's new commercial terms will allow the scraping of news sites, legal experts say
Legal experts say Meta's updated commercial terms, effective Oct. 30, let the company scrape websites associated with business accounts—raising alarms for news publishers locked into Facebook, Instagram, and WhatsApp.
6 min · 1,455 words
Scott Helme responds to the viral 'Passkeys are a trap' post, explaining what passkey attestation actually does, why it rarely restricts users in practice, and why passkeys remain the best protection available for accounts.
4 min · 880 words
Introducing Firefox Enterprise
Mozilla announces Firefox Enterprise, which pairs the Gecko-based Firefox browser with a customer-operated management console for organizations with strict security, governance and compliance needs, pitching it as a way to reduce dependence on a few technology providers and as a first step in a wider sovereignty push.
3 min · 780 words
Who Is Planting Backdoors in Ledger Crypto Wallets?
Kim Zetter investigates the hardware backdoor planted in Ledger wallets behind an estimated $100 million crypto theft: how the implants evolved, who may be behind the compromised devices, the pivot to Ledger Flex and Stax, and Trezor’s reseller response.
15 min · 3,354 words
My Reddit AMA on the Law of Web Scraping
Law professor Eric Goldman shares his introduction to a Reddit AMA on US web scraping law: the social benefits and harms of scraping, why trespass-to-chattels law is a mess, and why a scraping campaign must survive many doctrines, from contracts to copyright, to be legal.
8 min · 1,825 words
Fingerprints are the new cookies
An interactive essay that assigns each visitor a stable nickname from browser fingerprinting alone, survives cookie clearing and VPNs, and uses it to argue that fingerprint-based tracking and data brokering threaten privacy at a societal level, closing with a walkthrough of the browser signals the script combines.
9 min · 2,048 words
Just say no to OpenAI and Anthropic
Security engineer Micah Lee argues against paying OpenAI and Anthropic, citing the frontier labs' AGI ideology, and explains why open-weight models (e.g. GLM) are now good enough for complex work, with private inference options like Tinfoil and cheap ones like OpenCode Go.
7 min · 1,529 words
Implementing a 3-2-1 Backup Strategy with restic and Backblaze B2
In order to follow a proper 3-2-1 backup strategy, you should have three copies of your important data: two local on different media types, and one off site. For local, I have a [DAS](<https://en.wikipedia.org/wiki/Direct-attachedstorage>) with two 14TB drives configured in a RAID 1 array[1](<htt...
3 min · 660 words
A statement on the Tor Project's relationship with Mullvad
The Tor Project explains why it is continuing its technical collaboration with Mullvad after concerns over a political donation by a Mullvad co-founder, while pausing proactive co-branding and revising how Mullvad Browser is described on Tor's channels to avoid implied endorsement.
2 min · 538 words
When No ID Means No Internet: Age Verification and the Right to Access Information
EFF examines who gets locked out when age verification laws require identity documents to go online, surveying new mandates in Australia, India, the UK and US states and arguing that ID-based checks exclude people without documents and threaten the right to access information.
5 min · 1,071 words
Prompt injection in HTTP headers: what 217 million web responses show
Signals Corps scanned Common Crawl HTTP responses and found 7,959 sites sending headers aimed at AI agents, including 30 prompt-injection attempts. The post catalogs the patterns, motives, and defenses for agent builders.
28 min · 6,512 words
Meta's Muse Is An Adorable Privacy And Security Dumpster Fire
Karl Bode argues that Meta's agentic AI assistant Muse, launched with a zero-day flaw that let attackers spy on Mac users, shows how tech giants are rushing out highly privileged AI agents with little regard for privacy or security while lobbying against regulation and open alternatives.
4 min · 825 words
Authoritarian tendencies of Android Developer Verification Program
Vikrant Singh Chauhan argues Google’s Android Developer Verification Program, sold as malware protection, centralizes who may ship apps and threatens sideloading and small open-source clients—drawing on his experience publishing ivx/ai Chat.
9 min · 2,029 words
Site-Blocking Will Not Defend IP, No Matter the Bill’s Name
EFF's Katharine Trendacosta argues the DEFEND IP Act, like earlier US site-blocking bills from SOPA/PIPA onward, would incentivize censorship, overblocking, and bad-faith blocking while giving targeted site owners no real way to challenge orders.
2 min · 563 words
Three AI Agents, Two Countries, and One Very Uneven World Wide Web
Roya Pakzad compares GPT, Claude, and Muse on multilingual research tasks across languages and jurisdictions, documenting gaps in source access, human-in-the-loop oversight, and observability.
5 min · 1,206 words
David Buchanan explores how C2PA content credentials handle time, and what it takes to forge or bend timestamps in the provenance chain.
4 min · 919 words