ninthalek

‼️🚨 ALARMING: Google now treats privacy as suspicious behavior by default. Users of GrapheneOS, CalyxOS, /e/OS, and other deGoogled Android phones are being locked out of millions of websites unless they install the exact Google Play Services software they deliberately removed. GrapheneOS is recommended by the EFF and used by journalists, lawyers, and activists in high-risk environments. The audience most likely to read Google's data practices and refuse its terms is now flagged as fraudulent for that exact decision. What happened?: ▪️ Google announced "Cloud Fraud Defense" at Cloud Next on April 22-23, 2026, branding it "the next evolution of reCAPTCHA." Existing reCAPTCHA customers were auto-migrated. ▪️ When the system flags traffic as suspicious, the old click-the-bus puzzle is gone. Users get a QR code instead. ▪️ Scanning the QR code requires Google Play Services running on the device. Internet Archive snapshots show this requirement has been live since at least October 2025, silently rolled out for 7 months before anyone noticed. ▪️ No Play Services = no QR scan = locked out. The bigger picture: ▪️ Google already tried this in 2023. It was called Web Environment Integrity (WEI), and it would have let Google decide which devices were "real enough" to access the web. Standards bodies and the public pushed back hard, and Google killed it. Three years later, the same idea is back, just hidden behind a QR code instead of a browser feature. ▪️ reCAPTCHA runs on millions of websites. Every developer who keeps using it is now, by default, telling deGoogled Android users they're not welcome...

It can be unsettling when you notice that a technical assumption you've been making for 40 years has quietly expired. This happened to me a few minutes ago. I maintain a game called "greed". It's an old-style game from the days of character-cell terminals. Not quite a classic deserving of museum status like Colossal Cave Adventure or nethack, but worth keeping alive because it's still solidly playable. And people still are playing it, because yesterday I got a minor bug report about it. Nothing user-visible, just a silly C build problem. I fixed it. Then, because I'm generally trying to get my old C projects out of C into more modern and safer languages, I tried asking my robot friend to port it to Rust. Which it promptly did. But then I noticed something that irritated me. The Rust code had a bunch of unsafe blocks in it, which went directly against my reasons for moving it to Rust. On further examination, I discovered that it was calling the C curses library to do its screen painting. This is where I have to explain about curses. It's an ancient C library for writing TUIs. It looks in your environment for a variable named TERM, uses its value to dredge a bunch of magic strings out of a system-wide database called "terminfo" that tells it how to manipulate your terminal, and then uses those magic strings for screen painting. On modern systems, TERM is always some variant of a color ANSI terminal. In times past, when people attached a wild variety of character cell terminals to Unix systems rather than just sitting at the console, it could have been lots of other things. Those days are gone, but the habit of always going through terminfo so you can support a couple of hundred terminal types has persisted. I prod robot friend to find me a pure Rust equivalent of curses so I don't have to do unsafe and call C code. It says, yes, there is such a thing and it's called crossterm. I tell it: change this code to use crossterm. Robot friend grinds for a bit, and then tells me it can't do that because I don't have cargo (the Rust package manager) installed. This is because I never write Rust by hand. When I ship programs written in Rust, it's because I ported them from some other language and don't expect to ever touch them again without having a robot to do the code-grinding for me. This is when things get slightly strange. It tells me that instead of porting to crossterm, it has written into the greed Rust source its own little screen-painting backend the implements a subset of curses calls and (this is the important part) assumes it's talking to a color ANSI terminal. Robot friend is not an old Unix hand. It doesn't know the unwritten law of the deep magic that you always go through terminfo because...because you might have to support hundreds of terminal types that no longer exist in this century? I blink. I look at the Rust code for the back end. It is small and elegant. No more unsafe. No more dragging around a bunch of C library code. This is ... the right thing? I push it to the public repository. What sealed the deal is that code, even code in a language as rebarbative as Rust, is wet clay now. If, against all odds I get a bug report that says somebody wants to play greed on something that isn't an ANSI terminal emulator, reinstating full curses support will take a one-sentence prompt to my robot friend and mere minutes. I hadn't had to directly confront before the fact that the entire set of assumptions that made TERM and terminfo a thing are as obsolete as dial-up acoustic modems. Still, the moment when I tossed away one of the ancient laws of Unix coding felt a bit like the universe lurching sideways. Indeed do many things come to pass...

Microsoft is investigating mistralai PyPI package v2.4.6 compromise. Attackers injected code in mistralai/client/__init__.py that executes on import, downloads hxxps://83[.]142[.]209[.]194/transformers.pyz to /tmp/transformers.pyz, and launches a second-stage payload on Linux. The file name transformers.pyz appears deliberately chosen to mimic the widely used Hugging Face Transformers library and blend into ML/dev environments. The main payload is a credential stealer, but it also includes country-aware logic; it avoids Russian-language environments and contains a geo fenced destructive branch that has 1-in-6 chance of executing rm -rf / when the system appears to be in Israel or Iran. To mitigate this threat: isolate affected Linux hosts, block 83[.]142[.]209[.]194, hunt for /tmp/transformers.pyz, pgmonitor[.]py, and pgsql-monitor.service, and rotate exposed credentials.

The collapse of trust in science is going to go down in history as one of the most sad, bizarre, and destructive social contagions of modern times. We fed billions, cured diseases and powered nations - yet people ran toward conspiracies instead.